CVE-2026-10002: Use after free in PDFium in Google Chrome prior to 148

Synopsis

A use-after-free vulnerability exists in PDFium, the PDF rendering library embedded in Google Chrome versions prior to 148.0.7778.216. The flaw is reachable over the network and requires no authentication, but does require the victim to open a specially crafted PDF file. Successful exploitation corrupts heap memory and gives the attacker the ability to read sensitive data, tamper with application state, and crash or take control of the affected process. A patched-image rebuild at version 148.0.7778.216 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network; the target Chrome instance must be reachable in the sense that the victim browses to or opens a remote-attacker-controlled PDF.

• AuthenticationNot required

  No account or credential of any kind is required; the attacker only needs to get the victim to open a crafted PDF file.

• Victim interactionRequired

  The victim must actively open or render a crafted PDF file, making this a social-engineering vector where the attacker must convince the user to take that action.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special race conditions, memory layout dependencies, or other environmental preconditions beyond victim interaction.

Blast Radius

• A successful attacker reads process memory, which may include session tokens, cached credentials, and rendered document contents.
• The attacker can write to or corrupt heap memory within the Chrome renderer process, modifying in-memory application state.
• The attacker can crash the Chrome renderer process, disrupting the user's browsing session and any active PDF workflows.
• Heap corruption at this severity level carries a realistic risk of full remote code execution within the Chrome renderer process sandbox.