A use‑after‑free flaw in Chrome’s PDF parser is triggered when the browser processes a PDF that is referenced from a specially crafted HTML page. The bug allows a remote attacker to corrupt freed memory and execute arbitrary code inside the sandboxed renderer process, bypassing isolation controls and potentially compromising the user’s machine.

Affects Google Chrome browser versions prior to 156.0.8078.47 on all desktop platforms where the built‑in PDF viewer is enabled. Updating to Chrome 156.0.8078.47 or later removes the flaw.

The CVSS score is 8.8, indicating high severity. The EPSS score is less than 1%, suggesting exploitation is rare but technically possible. The vulnerability is not listed in CISA’s KEV catalog. Exploitation can be carried out from an attacker‑controlled web page that serves a malicious PDF, making traditional phishing or social engineering tactics viable. Because the flaw permits remote code execution within the browser context, it poses a substantial threat to confidentiality, integrity, and availability of affected users. Prompt patching remains the most effective mitigation.