The flaw is located in PDFium, the PDF rendering engine used by Google Chrome. It permits a brute‑force attack that can recover the key for an encrypted PDF, allowing an attacker to read the document’s hidden content. The weakness involves impaired key management (CWE-326) and use of an insufficient cryptographic algorithm (CWE-334). The result is disclosure of confidential information that was intended to be protected by encryption.

Google Chrome versions before 147.0.7727.55 on any operating system are impacted. Users who have not installed this update are vulnerable to the attack by interacting with a malicious PDF. The problem is confined to the browser; the underlying operating systems are not directly affected.

The vulnerability scores a moderate severity. The chance of widespread exploitation is low, and it is not listed in the CISA Known Exploited Vulnerabilities catalog. Successful exploitation requires an attacker to supply a malicious PDF that the victim opens. The attack demands several attempts and therefore represents a moderate effort for the adversary.