CVE-2026-11303: Use after free in PDFium in Google Chrome prior to 149

Synopsis

Use-after-free in PDFium, the PDF rendering library bundled with Google Chrome prior to version 149.0.7827.53. The vulnerability is reachable over the network and requires no authentication, but does require the victim to open a crafted PDF file. Successful exploitation gives a remote attacker arbitrary code execution inside the Chrome sandbox. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for environments running an affected version of Chrome.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network by serving or transmitting a crafted PDF file to the victim's browser.

• AuthenticationNot required

  No account or credential is needed; any unauthenticated remote party can attempt the attack.

• Victim interactionRequired

  The victim must open a crafted PDF file, meaning the attacker depends on a social-engineering or drive-by delivery step to trigger the vulnerability.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other environmental factors.

Blast Radius

• A successful attacker executes arbitrary code in the context of the Chrome renderer process inside the sandbox.
• Confidential data visible to the renderer, such as page contents, stored credentials, or session tokens, can be read.
• The attacker can tamper with rendered content or initiate further exploitation steps targeting a sandbox escape.
• The affected Chrome renderer process crashes or becomes unstable, disrupting the user's browsing session.