A heap buffer overflow in the PDFium rendering engine used by Google Chrome on Windows allows a remote attacker who persuades a user to interact with a specially crafted PDF file to execute arbitrary code within the browser's sandbox. The flaw requires specific user gestures but can be triggered by opening the PDF, resulting in code execution in a confined environment. The vulnerability is classified as high severity and is identified as CWE-120 and CWE-122, representing an unchecked buffer copy and improper heap management.

Google Chrome for Windows is impacted. All installations of Chrome prior to version 147.0.7727.101 are vulnerable. The issue applies to any user running the older stable channel revision on a Windows system, regardless of additional hardware or software configuration.

The baseline CVSS score of 8.3 indicates a high level of severity, and the EPSS score is < 1%, indicating a very low but non-zero probability of exploitation. The vulnerability does not appear in CISA's Known Exploited Vulnerabilities catalog, suggesting no confirmed public exploitation attempts as of this analysis. Exploitation requires social engineering – the user must open the file and perform the required gestures – but once achieved, the attack can deliver arbitrary code within the sandbox. Maintenance of the risk remains high until the Chrome patch is installed or mitigated through user education.