The vulnerability is a use after free in the PDFium rendering engine of Google Chrome that permits a heap corruption through a maliciously crafted PDF file. Such corruption could be leveraged by a remote attacker to execute arbitrary code from the victim's system, aligning with the CWE‑416 weakness for improper release of object.

Google Chrome versions prior to 149.0.7827.53, specifically the PDFium component included in those Chrome builds.

Based on the description, the likely attack vector is delivery of a malicious PDF file to the victim via browsing or email. The CVSS score is not provided, and EPSS data is unavailable, but the identified low severity in Chromium’s labeling indicates limited field impact. Nonetheless, the nature of the weakness suggests potential for remote code execution if an attacker can deliver a crafted PDF to the target. No exploitation techniques are published, and the vulnerability is not listed in the CISA KEV catalog, reducing the likelihood of widespread exploitation at present.