A use‑after‑free flaw exists in the PDF rendering engine of Google Chrome that permits a malicious PDF file to trigger memory corruption and execute arbitrary instructions while the browser is running. The exploitation can run code that remains bound to the Chrome sandbox, potentially enabling further compromise of the local user context. The weakness corresponds to memory management and resource handling errors as captured by CWE‑416 and CWE‑825.

The issue affects all instances of Google Chrome running any supported operating system—including Windows, macOS, and Linux—if the browser version is older than 146.0.7680.178. The vulnerability is tied to the core application binary and applies across standard desktop builds on all platforms.

The CVSS base score of 8.8 indicates a high severity for remote code execution. The EPSS score of less than 1% suggests that exploitation occurrences are currently rare, and the vulnerability is not listed in the CISA KEV catalog, implying a lack of widespread documented exploits. Based on the description, the likely attack vector is that the victim opens a specially crafted PDF file in Chrome; upon rendering, the use‑after‑free is triggered and code runs within the sandboxed process. No additional network privileges or system access are required beyond the normal browsing activity.