A use‑after‑free flaw in Chrome's PDF rendering engine (PDFium) permits an attacker to craft a malicious PDF that, when opened, triggers arbitrary code execution inside the Chrome sandbox. The vulnerability aligns with CWE‑416 and CWE‑825, enabling a remote attacker to run code within the process context that otherwise would have been restricted by the sandbox. This compromise jeopardizes the integrity and confidentiality of the user's environment.

Google Chrome desktop versions prior to 149.0.7827.53 are affected. No other products or version ranges are listed.

The CVSS score is 8.8, indicating a high severity vulnerability, and the EPSS score is < 1%, suggesting a very low but non‑zero exploitation probability. The vulnerability is not listed in the CISA KEV catalog, indicating no known widespread exploitation. Attackers must deliver a specially crafted PDF to the victim, who then opens it. If leveraged, code execution would occur within the Chrome sandbox but still represent a significant local privilege escalation. Without a publicly available exploit and considering Chromium's internal low severity classification, the attack likelihood appears modest.