A heap buffer overflow and out-of-bounds write exist in PDFium, the PDF rendering engine used by Google Chrome. A crafted PDF file can trigger memory corruption that allows a remote attacker to execute arbitrary code within the browser’s sandbox. The flaw is characterized as a heap buffer overflow (CWE-122) and an out-of-bounds write (CWE-787). Once the exploit is triggered, the attacker can potentially escape the sandbox and compromise the host system.

Google Chrome desktop versions prior to 147.0.7727.101 are affected. The vulnerability applies to all builds that ship with the vulnerable PDFium code during the stable release channel.

The vulnerability has a CVSS score of 8.8, indicating high severity, but no EPSS score is currently available, and it is not listed in the CISA KEV catalog. The most likely attack vector involves a remote attacker delivering a malicious PDF via email, web download, or other file transfer methods. Once a user opens the compromised PDF in Chrome, the flaw can be leveraged to gain arbitrary code execution while still confined initially to the sandbox; however, subsequent exploits could escape to the host. Given the severity and the ease of exploitation, this poses a significant risk to users who do not promptly update their browsers.