CVE-2026-10945: Use after free in PDF in Google Chrome prior to 149

Synopsis

A use-after-free vulnerability in Google Chrome's PDF renderer affects all Chrome versions prior to 149.0.7827.53. The bug is reachable over the network but requires the victim to perform specific UI gestures with a crafted PDF file; no authentication is needed from the attacker's side. Successful exploitation lets an attacker execute arbitrary code inside the Chrome sandbox, combining full confidentiality, integrity, and availability impact within that sandboxed process. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the crafted PDF over the network, so the victim's browser must be reachable or the attacker must be able to serve content to it remotely.

• AuthenticationNot required

  No account or credential is required from the attacker; the attack is launched by serving a malicious PDF to any visiting user.

• Victim interactionRequired

  The victim must open the crafted PDF and perform specific UI gestures within the Chrome PDF viewer, making this a social-engineering-dependent attack.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, memory-layout guessing, or other environmental preconditions.

Blast Radius

• Executes arbitrary attacker-controlled code inside the Chrome renderer sandbox, giving the attacker full control of that process.
• Reads any data accessible to the sandboxed renderer, including page content, cookies visible to the renderer context, and in-memory document data.
• Writes or modifies data within the sandboxed process, enabling tampering with rendered content or in-process state.
• Crashes or destabilizes the affected renderer process, causing loss of availability for the browsing session or any embedded Chrome component.