CVE-2026-14108: Chrome PDFium Use-After-Free Remote Code Execution Vulnerability

Technical summary

CVE-2026-14108 is a use-after-free memory corruption flaw in PDFium (CWE-416) that permits arbitrary code execution in the Chrome sandbox context. The vulnerability is triggered when a specially crafted PDF is processed by the renderer engine. While Chromium's security team classified this as Low severity, the CVSS v3.1 score of 8.8 reflects the high confidentiality, integrity, and availability impact achievable through user-directed exploitation. The attack vector is network-based with no privilege escalation required; only user interaction is necessary.

Business impact

Organizations where users regularly handle PDF files face elevated risk. Successful exploitation could allow attackers to exfiltrate sensitive data from the browser process, modify cached information, or trigger denial-of-service conditions—all within the confines of the sandbox. While the sandbox mitigates full system compromise, it is not an absolute guarantee. This is particularly concerning for firms handling classified or sensitive documents, research institutions, and legal entities that rely on PDF workflows.

Affected systems

Google Chrome versions prior to 150.0.7871.47 are vulnerable on Windows, macOS, and Linux. PDFium is integral to Chrome's rendering engine, so all end-user installations of affected Chrome versions present risk. Related Chromium-based browsers may also be affected depending on their release schedules and update mechanisms; verify your specific browser vendor's advisory.

Exploitability

Exploitation requires a user to open a malicious PDF, making this a social engineering vector rather than a fully remote, passive attack. No exploit code has been disclosed in public KEV catalogs. However, the straightforward nature of the vulnerability and the ubiquity of PDF files make this a practical attack vector in targeted campaigns or mass phishing scenarios. Attackers could host malicious PDFs on compromised websites or send them via email.

Remediation

Users and administrators must update Google Chrome to version 150.0.7871.47 or later. On Windows and macOS, Chrome typically auto-updates; verify that automatic updates are enabled. For enterprise deployments, enforce Chrome update policies through group policy (Windows) or MDM profiles (macOS). Linux distributions may offer Chrome updates through their package managers. Test updates in non-production environments before enterprise rollout.

Patch guidance

Google Chrome 150.0.7871.47 and all subsequent releases contain the fix. Verify your current version by navigating to chrome://settings/help in the browser—Chrome will report the installed version and begin downloading updates if behind. Organizations using Chrome Enterprise licenses should consult Google's security advisory for any enterprise-specific patch timelines. Unmanaged systems should rely on auto-update; if disabled, users must manually trigger the update check.

Detection guidance

Monitor for unexpected child processes spawned by the Chrome renderer (chrome.exe or equivalent on macOS/Linux). Look for PDF files opened from untrusted sources in user directories and browser cache. Network-based detection is limited without payload analysis; focus on behavioral detection post-exploitation (e.g., unusual outbound connections from Chrome, file modifications from the renderer context). Endpoint detection and response (EDR) tools should flag memory corruption exploits or sandbox escape attempts. File integrity monitoring on downloaded PDFs may help identify unusual files before user interaction.

Why prioritize this

Despite Chromium's Low severity rating, the CVSS 8.8 score and proven code execution capability warrant medium-to-high priority patching. The user-interaction requirement and sandbox confinement provide some operational safety, but the prevalence of PDF handling and PDF's role in business communications make this a practical exploitation vector. Prioritize patching in user-facing roles and departments that handle external documents daily.

Risk score, explained

The CVSS 8.8 score reflects the worst-case scenario: an attacker achieving full code execution and high impact to confidentiality, integrity, and availability. The network attack vector and low complexity contribute to the elevated score. However, the required user interaction and sandbox environment lower real-world exploitability compared to, for example, a network-reachable remote code execution vulnerability. The discrepancy between Chromium's Low severity and CVSS 8.8 likely stems from Chromium's confidence in its sandbox architecture; CVSS scoring does not assume sandbox protections and assesses theoretical impact.

Frequently asked questions