CVE-2026-11304: Use after free in PDFium in Google Chrome prior to 149

Synopsis

Use-after-free in PDFium, the PDF rendering library embedded in Google Chrome prior to version 149.0.7827.53, allows a remote attacker to exploit heap corruption by delivering a crafted PDF file to a target user. The vulnerability is reachable over the network but requires the victim to open a malicious PDF, with no authentication barrier on the attacker's side. Successful exploitation gives the attacker full read, write, and execution capability within the renderer process, enabling data theft, content tampering, and potential remote code execution. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the crafted PDF over the network, so the target service or user must be reachable from an internet or network-adjacent position.

• AuthenticationNot required

  No account or credential is needed on the attacker's side; the attack is launched purely through a malicious file delivered to the victim.

• Victim interactionRequired

  The victim must open or render the crafted PDF file, making this a social-engineering vector where the attacker must convince a user to interact with the malicious document.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other environmental preconditions.

Blast Radius

• A successful attacker reads memory contents from the Chrome renderer process heap, which can include session tokens, cached credentials, and document contents.
• The attacker writes arbitrary data into freed heap memory, enabling modification of in-process state and potentially injecting shellcode or manipulating rendered output.
• Full confidentiality, integrity, and availability impact is confirmed by the CVSS tokens, meaning the attacker can crash the renderer, exfiltrate data, or pivot to further exploitation within the process sandbox.
• If a sandbox escape is chained separately, the heap corruption primitive established here provides the initial foothold for broader host compromise.