A use-after-free flaw in Chrome's PDFium engine can let a remote attacker craft a PDF file that triggers the vulnerability and executes arbitrary code inside Chrome's sandbox. The weakness, identified as CWE‑416, removes a memory reference after the object has been freed, allowing code execution that bypasses the browser's isolation mechanisms. The impact is code execution, which can compromise the host system if the sandbox is bypassed or if the attacker escalates privileges to the user context.

Google Chrome browsers running any version earlier than 151.0.7922.72 are affected. The flaw resides in the PDFium component bundled with these releases. All platforms that ship the impacted Chrome binaries are vulnerable until the patch is applied.

Chrome receives a CVSS score of 8.8, indicating a high severity. The EPSS score is below 1 %, showing a very low current exploitation likelihood. The vulnerability is not listed in the CISA KEV catalog, but the high base score suggests it should be treated with priority. Attackers are likely to exploit the flaw by delivering a crafted PDF file and opening it in the vulnerable Chrome instance, which is a remote attack vector that requires no special network privileges.