CVE-2026-11305: PDFium Use-After-Free in Chrome

Technical summary

CVE-2026-11305 is a use-after-free vulnerability (CWE-416) in PDFium, Google's open-source PDF viewer library. The flaw occurs when PDFium processes specially crafted PDF files, causing it to reference memory that has already been freed. An attacker can construct a malicious PDF that triggers this memory access pattern, leading to memory corruption. Although execution is confined to Chrome's sandbox—limiting direct system compromise—the attacker can still read sensitive data from the browser process, modify rendered content, or cause denial of service. Exploitation requires user interaction (opening a PDF), but given the ubiquity of PDF sharing, this barrier is modest.

Business impact

For organizations, this vulnerability creates risk across several dimensions. Employees who receive phishing emails with malicious PDF attachments could have their browser sessions compromised, potentially exposing credentials, session tokens, or sensitive documents open in other tabs. In industries handling confidential information—legal, financial, healthcare—a successful exploit could lead to data exfiltration. The vulnerability also affects macOS and Linux users proportionally to their Chrome adoption. From an incident response perspective, sandboxed code execution can still be leveraged as a stepping stone to escape the sandbox via secondary vulnerabilities, though that requires chaining. The relatively high CVSS score (8.8) underscores that this is not a low-risk issue despite Chromium's internal severity classification.

Affected systems

Google Chrome versions prior to 149.0.7827.53 are affected on all major platforms: Windows, macOS, and Linux. The vulnerability is in PDFium, which is bundled with Chrome and used as the default PDF handler. Users running Chrome 149.0.7827.53 or later are protected. Organizations should verify their Chrome version distribution; unpatched instances remain at risk. Note that PDFium is also embedded in other Chromium-based browsers, though this CVE explicitly references Chrome. Enterprise deployments should check whether Chromium derivatives in their environment have received corresponding updates.

Exploitability

Exploitation requires a user to open a malicious PDF in Chrome. The attacker has no privilege requirement and can deliver the PDF via email, web download, or file sharing services. The attack surface is high because PDF files are routinely shared in business communication and often opened without scrutiny. No authentication or elevated privileges are needed. However, the attack does require user interaction (opening the file), which provides a minor friction point. The sandbox containment means the attacker cannot immediately access the operating system, though they gain significant access to browser memory and the rendering process. Overall, this is a practical, real-world threat given PDF ubiquity and user behavior.

Remediation

The primary remediation is to update Google Chrome to version 149.0.7827.53 or later. Chrome auto-updates by default, but users should verify their version via Settings > About Chrome and trigger an update if necessary. For organizations deploying Chrome via managed policies, update the Chrome version in your deployment package or let managed devices auto-update. As a temporary mitigation pending patches, organizations can disable PDF preview in Chrome or route PDFs through an external viewer, though this is cumbersome and not recommended as a long-term solution. User education about not opening PDF attachments from untrusted sources remains important but is not a substitute for patching.

Patch guidance

Update Chrome to version 149.0.7827.53 or later. Chrome's auto-update mechanism will deploy this version automatically for most users within 24–48 hours, though timing varies by platform and user restart habits. For IT administrators: verify successful rollout via Chrome Management Console; confirm version numbers across your deployed fleet. Test this patch in a non-production environment first if your organization has custom extensions or PDF processing workflows, though most users will experience no compatibility issues. Organizations using Chromium-based derivatives (Edge, Brave, etc.) should check those vendors' security advisories separately, as they may follow different patching schedules.

Detection guidance

Detecting exploitation is challenging because successful attacks occur within the sandboxed process and leave minimal host-level forensic traces. Monitor for: (1) Unexpected Chrome process crashes or high CPU/memory usage correlating with PDF opens, which may indicate exploitation attempts; (2) Unusual network traffic from Chrome processes, which could indicate data exfiltration post-compromise; (3) User reports of browser hangs or crashes after opening PDFs from unknown sources. Log Chrome's version string across your fleet to identify unpatched instances. Consider enabling Chrome security event logging in managed environments. Proactive detection of the malicious PDF itself is difficult without a known sample; reputation-based filtering of email attachments and web downloads provides baseline protection but is not foolproof.

Why prioritize this

Despite Chromium's internal Low severity classification, the CVSS 8.8 score reflects real-world risk. Prioritize patching because: (1) exploitation is trivial (crafted PDF + user click); (2) impact is high (code execution with data access); (3) affected population is massive (Chrome users globally); (4) the attack vector is common and difficult to block with user behavior alone. Organizations with high email volume or those handling sensitive documents should patch immediately. This is not an emergency zero-day (patch is available), but it is a legitimate priority for IT teams in the next maintenance cycle.

Risk score, explained

The CVSS 3.1 score of 8.8 (HIGH severity) reflects: Network-based attack vector (AV:N) with low complexity (AC:L), no privilege requirement (PR:N), and user interaction required (UI:R). The impact assessment—high for confidentiality (C:H), integrity (I:H), and availability (A:H)—assumes an attacker within the sandbox can read sensitive data, modify page content, or crash the process. The score does not heavily discount sandbox containment, reflecting the view that sandbox escapes are plausible with secondary exploits, and the data access within the browser alone is serious. In SEC.co's risk model, this aligns with HIGH priority given the attack surface and user interaction is a weak barrier in practice.

Frequently asked questions