The vulnerability is a use‑after‑free condition in PDFium, the PDF rendering engine embedded in Google Chrome. When a specially crafted PDF file is opened, the engine can deallocate memory that is still in use, leading to memory corruption that an attacker can control to execute arbitrary code. The potential impact is confined to the browser sandbox; thus, an attacker can gain code execution inside the Chrome process but not elevate privileges to the host operating system. The weaknesses are identified as CWE‑416 and CWE‑825.

The flaw affects the Google Chrome browser wherever PDFium is included. Chrome builds prior to 149.0.7827.53 are vulnerable, as the CVE entry explicitly lists this version range.

This is a remotely exploitable flaw that requires the user to open a malicious PDF. The attack vector is client‑side and therefore limited to situations where an attacker can deliver a PDF to a user or trick the user into visiting a site that triggers a PDF download. The CVSS score of 8.8 denotes high severity, but the EPSS score is <1% and the vulnerability is not listed in the CISA KEV catalog. Because the exploitation delivers code only inside a sandboxed Chrome instance, the overall risk for compromise of the host system is reduced compared to full remote code execution.