CVE-2026-11303: Chrome PDFium Use-After-Free Remote Code Execution Vulnerability

Technical summary

CVE-2026-11303 is a use-after-free flaw (CWE-416) in PDFium's PDF processing code. Use-after-free vulnerabilities occur when a program accesses memory that has already been freed, allowing an attacker to manipulate that freed memory region to achieve code execution. In this case, a maliciously crafted PDF file triggers the use-after-free condition during PDF parsing or rendering. The vulnerability is exploitable remotely—an attacker needs only to host the malicious PDF and convince a user to open it, either directly or through a link. Although execution occurs within Chrome's sandbox (limiting immediate system-level access), the sandbox itself can be escaped through additional vulnerabilities or used as a pivot point for further attacks.

Business impact

Organizations face elevated risk of user compromise. Employees who open PDFs from untrusted sources—including those received via email, downloaded from compromised websites, or accessed through phishing—are at immediate risk. Successful exploitation could lead to credential theft, intellectual property exfiltration, malware installation, or lateral movement within corporate networks. The user-interaction requirement means social engineering and targeted attacks are viable vectors. For businesses relying on PDF workflows, this vulnerability underscores the importance of keeping Chrome updated and controlling PDF handling processes.

Affected systems

The vulnerability affects Google Chrome prior to version 149.0.7827.53 on all major platforms: Windows, macOS, and Linux. While PDFium is Google's own library and Chrome is the primary vector, the vulnerability's presence in Chrome deployments across these operating systems makes it broadly relevant. Users of Chromium-based browsers built from older source branches may also be affected; verify your browser's version and update status.

Exploitability

Exploitability is moderate to high. The attack requires crafting a malicious PDF file and user interaction—convincing or tricking someone into opening it—but no special privileges or complex setup is needed. The attacker does not need authentication or special system access. Once the PDF is opened in a vulnerable Chrome version, the use-after-free condition is triggered automatically. The CVSS score of 8.8 (HIGH) reflects the combination of network accessibility, low attack complexity, and severe impact (confidentiality, integrity, and availability compromised). The vulnerability is not currently listed in CISA's Known Exploited Vulnerabilities catalog, but the technical simplicity and high impact make rapid weaponization likely if not already underway.

Remediation

Immediate action: Update Google Chrome to version 149.0.7827.53 or later on all affected platforms. Users can check their Chrome version by navigating to chrome://settings/help, which will automatically check for updates and apply them. For organizations, deploy Chrome updates through your standard endpoint management tools (MDM, SCCM, or equivalent) to ensure rapid rollout. In parallel, educate users about the risks of opening PDFs from untrusted sources and reinforce email security practices. Consider restricting PDF handling policies—for example, requiring PDFs to be opened in sandboxed viewers rather than directly in browsers where possible.

Patch guidance

Google has released Chrome 149.0.7827.53 as the patched version addressing CVE-2026-11303. Verify the exact patch version against Google's official security advisory before deployment. Most users on standard Chrome update channels will receive the patch automatically; however, enterprise customers managing updates through group policy or other mechanisms should prioritize this release. Test the patched version in a controlled environment if possible to ensure compatibility with your organization's workflows before broad deployment. After patching, confirm that affected systems have updated by auditing Chrome versions across your environment.

Detection guidance

Detection is challenging at the network level because the malicious PDF is typically delivered through normal channels (email, web download). Focus detection efforts on: (1) Endpoint telemetry—monitor for Chrome processes spawning unexpected child processes or accessing sensitive files after opening PDFs; (2) Web gateway logs—identify unusual PDF downloads, especially from external sources; (3) Intrusion detection—look for activity consistent with post-exploitation, such as credential access or data exfiltration following PDF interaction; (4) Patch compliance—scan for Chrome versions prior to 149.0.7827.53 and flag for immediate update. Behavioral monitoring for anomalous Chrome activity is more practical than signature-based detection of the malicious PDF itself, given the ease of crafting variants.

Why prioritize this

This vulnerability merits immediate priority for three reasons. First, the CVSS score of 8.8 and severe impact (arbitrary code execution in a browser sandbox) reflect real damage potential. Second, the attack surface is broad—any Chrome user opening a PDF is at risk, with no special technical prerequisites for attackers. Third, although not yet in CISA's KEV catalog, the straightforward nature of the vulnerability and high-profile target (Chrome) suggest active exploitation is likely. For organizations with heavy PDF usage or significant Chrome deployments, this ranks as a critical update. Prioritize patching over other lower-impact maintenance tasks.

Risk score, explained

The CVSS 3.1 score of 8.8 (HIGH severity) is driven by: (1) Network accessibility (AV:N)—the attack is initiated remotely via a crafted file; (2) Low attack complexity (AC:L)—no special conditions or brute force required; (3) No privileges needed (PR:N) and user interaction required (UI:R)—the attacker needs only to trick a user into opening a PDF; (4) High impact across confidentiality, integrity, and availability (C:H/I:H/A:H)—code execution within the sandbox can steal data, modify content, or crash the process, with potential for further system compromise. The score appropriately reflects the combination of ease of exploitation, broad user base exposure, and severe potential damage.

Frequently asked questions