The vulnerability is a use‑after‑free condition in PDFium, the PDF rendering engine embedded in Google Chrome. When a specially crafted PDF file is opened, the engine can deallocate memory that is still in use, leading to memory corruption that an attacker can control to execute arbitrary code. The potential impact is confined to the browser sandbox; thus, an attacker can gain code execution inside the Chrome process but not elevate privileges to the host operating system. The weakness is identified as CWE‑416.

The flaw affects the Google Chrome browser on all supported platforms—Windows, macOS, and Linux—where the PDFium component is included. The CVE entry does not specify exact released versions that are vulnerable, so affected builds are unknown until a vendor assessment is made.

This is a remotely exploitable flaw that requires the user to open a malicious PDF. The attack vector is client‑side and therefore limited to situations where an attacker can deliver a PDF to a user or trick the user into visiting a site that triggers PDF download. The CVSS score of 8.8 denotes high severity, but the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. Because the exploitation delivers code only inside a sandboxed Chrome instance, the overall risk for compromise of the host system is reduced compared to full remote code execution.