A use‑after‑free flaw (CWE‑416) in the PDFium component of Google Chrome enables a remote attacker to potentially execute arbitrary code inside the browser sandbox. The vulnerability is triggered by a specially crafted HTML page that embeds malicious PDF content. If successfully exploited, the attacker can run code with the privileges of the browser context, which may lead to further compromise of the system.

The flaw exists in Chrome versions prior to 156.0.8078.73. All builds earlier than that release are affected, regardless of operating system. The problem resides entirely in the PDFium component that Chrome uses for PDF rendering.

Chromium labels the issue as high severity; the CVSS score is not listed but the severity rating indicates a serious threat. EPSS information is not available, and the vulnerability has not appeared in the CISA KEV catalog. The attack vector appears remote, requiring the attacker to serve a malicious HTML document that includes PDF content to exploit the PDFium use‑after‑free. Successful exploitation would grant the attacker code execution within the sandboxed browser process.