A heap buffer overflow in the PDFium rendering engine used by Google Chrome on Windows allows a remote attacker who persuades a user to interact with a specially crafted PDF file to execute arbitrary code within the browser's sandbox. The flaw requires specific user gestures but can be triggered by opening the PDF, resulting in code execution in a confined environment. The vulnerability is classified as high severity and is identified as CWE-122, representing improper heap management.

Google Chrome for Windows is impacted. All installations of Chrome prior to version 147.0.7727.101 are vulnerable. The issue applies to any user running the older stable channel revision on a Windows system, regardless of additional hardware or software configuration.

The baseline CVSS score of 7.2 indicates a high level of severity, and no exploit probability metric is currently published. The vulnerability does not appear in CISA's Known Exploited Vulnerabilities catalog, suggesting no confirmed public exploitation attempts as of this analysis. Exploitation requires social engineering – the user must open the file and perform the required gestures – but once achieved, the attack can deliver arbitrary code with sandbox privileges. Maintenance of the risk is high until the Chrome patch is installed or mitigated through user education.