CVE-2026-10945: Chrome PDF Use-After-Free RCE Vulnerability – Patch Available

Technical summary

CVE-2026-10945 is a use-after-free vulnerability (CWE-416) in Chrome's PDF rendering engine. The flaw arises from improper memory management where a freed object is accessed after deallocation. An attacker crafts a malicious PDF that, when opened and manipulated through specific user gestures (clicking, scrolling, or similar interactions), triggers code execution within the Chrome sandbox. The vulnerability requires user interaction but carries no prerequisites for network access or authentication. The attack vector is network-based, with low attack complexity and no privilege escalation required.

Business impact

Organizations reliant on Chrome for business operations face operational disruption and data theft risks. Although the attack is sandboxed, successful exploitation could lead to credential theft, browser data exfiltration, or lateral movement into corporate networks if combined with other vulnerabilities. The requirement for user interaction limits mass exploitation but makes targeted campaigns feasible. Widespread browser usage in enterprise environments amplifies the potential impact.

Affected systems

Google Chrome versions prior to 149.0.7827.53 on Windows, macOS, and Linux are affected. The vulnerability applies to any user who opens untrusted PDF files with Chrome, whether through direct opening, downloads, or embedded previews in web applications. Systems with the PDF plugin or viewer enabled are at heightened risk.

Exploitability

This vulnerability has not been added to CISA's Known Exploited Vulnerabilities (KEV) catalog, indicating no evidence of active exploitation in the wild at the time of initial analysis. However, the low attack complexity and reliance only on user interaction make it attractive for targeted spear-phishing campaigns. Creating a weaponized malicious PDF is straightforward once the memory corruption trigger is understood. Organizations should assume exploitation could accelerate once public proof-of-concept code emerges.

Remediation

Users and administrators must update Chrome to version 149.0.7827.53 or later. This update patches the memory management flaw in the PDF handler. For managed environments, deploy patches through Chrome's enterprise update mechanisms or native OS package managers. Organizations may also mitigate risk by disabling the embedded PDF viewer and routing PDF rendering to external applications until patching is complete, though this reduces functionality.

Patch guidance

Chrome will auto-update to version 149.0.7827.53 or later on supported systems. Enterprise customers using Chrome Enterprise should verify availability through the admin console and deploy via managed update channels. Users on Windows can check chrome://settings/help to confirm the installed version. On macOS, verify via Chrome menu > About Google Chrome. Linux users should confirm patch availability through their distribution's package repository. Verify the patch is installed before resuming normal PDF handling workflows.

Detection guidance

Monitor for Chrome updates to version 149.0.7827.53 or later in your environment using endpoint detection and response (EDR) tools, SIEM systems, or Chrome Enterprise reporting. Network indicators are minimal since the attack occurs client-side; focus instead on behavioral signals such as unexpected Chrome sandbox escapes or post-exploitation indicators. Review browser security logs for PDF file interactions from untrusted sources. Organizations using web filtering should flag suspicious PDF sources and alert users to malicious file patterns.

Why prioritize this

This vulnerability scores 8.8 (HIGH severity) due to high impact across confidentiality, integrity, and availability, combined with low attack complexity and no authentication requirements. Although sandboxed, code execution is the worst-case outcome. The lack of KEV status and public exploits currently available provides a brief window for patching before active attacks emerge. Wide exposure (billions of Chrome users) and reliance on user interaction make targeted campaigns probable in the short term.

Risk score, explained

CVSS 3.1 score of 8.8 reflects: Attack Vector (Network) – the PDF can be delivered remotely; Attack Complexity (Low) – crafting a malicious PDF is straightforward; Privileges Required (None) – no account access needed; User Interaction (Required) – user must open the PDF and interact with it; Scope (Unchanged) – impact is limited to the Chrome sandbox; Confidentiality/Integrity/Availability (High) – code execution can leak data, modify state, or crash the browser. The HIGH severity designation aligns with Chromium's internal security rating.

Frequently asked questions