CVE-2026-11304

chromium-browser: Use after free in PDFium

View on CVE.org
Published Jun 4, 2026 CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Description
Use after free in PDFium in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file. (Chromium security severity: Low)

Analysis

AI-generated

Technical impact

The vulnerability is a use after free in the PDFium rendering engine of Google Chrome that permits a heap corruption through a maliciously crafted PDF file. This is a manifestation of CWE‑416 (Use after Free) and potentially CWE‑825 (Stack and Heap Corruption), allowing attackers to potentially execute arbitrary code from the victim's system.

Affected Systems

Google Chrome versions prior to 149.0.7827.53, specifically the PDFium component included in those Chrome builds.

Risk and Exploitability

Based on the description, the likely attack vector is delivery of a malicious PDF file to the victim via browsing or email. The CVSS score is 8.8, and EPSS data is < 1%, but the identified low severity in Chromium’s labeling indicates limited field impact. Nonetheless, the nature of the weakness suggests potential for remote code execution if an attacker can deliver a crafted PDF to the target. No exploitation techniques are published, and the vulnerability is not listed in the CISA KEV catalog, reducing the likelihood of widespread exploitation at present.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Google Chrome to version 149.0.7827.53 or later, which contains the PDFium fix.
  • Disable the built‑in PDF viewer within Chrome settings or by setting the PDF viewer extension to block PDFs from unknown origins.
  • If an upgrade is delayed, avoid opening PDF files from untrusted sources until a patch is applied.

Generated by OpenCVE AI on June 7, 2026 at 15:32 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Debian DSA Debian DSA DSA-6325-1 chromium security update
History
Type Values Removed Values Added
First Time appeared Apple
Apple macos
Linux
Linux linux Kernel
Microsoft
Microsoft windows
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*
Vendors & Products Apple
Apple macos
Linux
Linux linux Kernel
Microsoft
Microsoft windows
Type Values Removed Values Added
Title chromium-browser: Use after free in PDFium
Weaknesses CWE-825
References
Metrics threat_severity

None

 threat_severity

Low
Type Values Removed Values Added
Title Use After Free in PDFium Leading to Heap Corruption in Google Chrome
Type Values Removed Values Added
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome
Type Values Removed Values Added
Title Use After Free in PDFium Leading to Heap Corruption in Google Chrome
Type Values Removed Values Added
Description Use after free in PDFium in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file. (Chromium security severity: Low)
Weaknesses CWE-416
References
Earlier changes (2)
Weaknesses

Sources

Status
PUBLISHED
Assigner
Chrome
Published
Updated
Jun 5, 2026, 3:19 PM
Reserved
Jun 4, 2026, 5:11 PM

View source JSON

Updated
Jun 5, 2026, 3:19 PM

JSON

Status
Analyzed
Published
Jun 5, 2026, 12:17 AM
Modified
Jul 23, 2026, 7:10 AM

View source JSON

Severity
Low
Public date
Jun 2, 2026, 12:00 AM

View source Bugzilla JSON

Updated
Jun 7, 2026, 3:45 PM

JSON