A flaw in Chrome’s PDF a remote attacker to craft a PDF that manipulates the browser’s user interface. When a user opens the malicious file, deceptive controls or messages can appear as authentic UI elements, potentially leading the user to perform unintended actions or disclose sensitive data. The weakness is classified as CWE‑451, indicating that the vulnerability results from manipulating input data. The CVSS score of 6.5 signals a medium severity impact focused on user deception rather than direct code execution or data loss.

Any installation of Google Chrome that incorporates an unpatched version of PDFium may be affected. The vulnerability exists in builds prior to version 150.0.7871.46; later releases contain the fix. Because the vendor advisory does not enumerate each sub‑release, all Chrome builds before that build number should be treated as vulnerable until the browser receives an updated release.

Exploitation requires the victim to open a crafted PDF file, so the likely attack vector involves user interaction such as clicking on a malicious link or attaching a file. The EPSS score of less than 1% indicates a low probability of exploitation in the wild, and the vulnerability is not listed in CISA’s KEV catalogue. Nevertheless, the moderate CVSS score and potential for social engineering underscore the need for timely remediation through patching.