CVE-2026-11305: Use after free in PDFium in Google Chrome prior to 149

Synopsis

A use-after-free vulnerability in PDFium, the PDF rendering library bundled with Google Chrome, allows a remote attacker to execute arbitrary code inside Chrome's sandbox by delivering a crafted PDF file. The vulnerability is reachable over the network and requires no authentication, but does require the victim to open a malicious PDF. Successful exploitation gives the attacker code execution within the Chrome sandbox, which may serve as a stepping stone to further compromise. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for environments running an affected Chrome version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the malicious PDF over the network, so the affected Chrome instance must be reachable or browsing to attacker-controlled content.

• AuthenticationNot required

  No credentials or account access are needed; any unauthenticated remote attacker can attempt exploitation.

• Victim interactionRequired

  The victim must open or be redirected to a crafted PDF file, making a social-engineering or drive-by delivery step necessary.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions or specific memory layout requirements.

Blast Radius

• Attacker executes arbitrary code within the Chrome renderer sandbox, gaining full control of the sandboxed process.
• Confidential data rendered or cached by the browser process, including session tokens and page content, becomes readable to the attacker.
• Attacker can modify in-memory state of the sandboxed process, potentially tampering with rendered content or facilitating a sandbox-escape chain.
• The compromised renderer process can be crashed or made unavailable, disrupting the user's browsing session.