The reported issue is a use‑after‑free flaw in PDFium, the PDF rendering engine used by Google Chrome. The bug allows a malicious PDF file to trigger heap corruption on the rendering thread, giving an attacker the possibility to execute arbitrary code or crash the browser. This weakness is identified as CWE‑416 and CWE‑825 and classified by Chromium as a high‑severity vulnerability.

Google Chrome browsers older than version 148.0.7778.216 on desktop operating systems are affected. The flaw resides in the PDFium component that processes PDF documents before rendering them inside the browser. Users of these older releases are at risk if they open crafted PDF files from untrusted sources.

The EPSS score indicates a very low likelihood of exploitation (< 1 %). The CVSS score is 8.8, indicating high severity. This weakness involves both CWE‑416 and CWE‑825. The vulnerability was not reported in the CISA KEV catalog, indicating no documented widespread exploitation. Nevertheless, any remote adversary that can supply a malicious PDF file—such as via email attachment or compromised web page—could potentially exploit the bug. The attack vector is therefore inferred to be a remote exploitation through a malicious PDF that the victim opens in Chrome.