CVE-2026-11306: Use after free in PDFium in Google Chrome prior to 149

Synopsis

Use-after-free in PDFium, the PDF rendering library bundled with Google Chrome prior to version 149.0.7827.53, allows a remote attacker to execute arbitrary code inside the browser sandbox by getting a user to open a crafted PDF file. The vulnerability is reachable over the network and requires no authentication, but does require the victim to interact with a malicious file. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for environments running an affected version of Chrome.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network, typically by hosting a malicious PDF on a site the victim visits or by sending it as a download.

• AuthenticationNot required

  No account or credential of any kind is needed; the attacker is anonymous.

• Victim interactionRequired

  The victim must open or render a crafted PDF file, making social engineering (phishing link, email attachment, or drive-by download) a prerequisite.

• Attack complexityDetail

  Exploit conditions are reliable and free of race conditions or environmental dependencies, making successful exploitation straightforward once the victim opens the file.

Blast Radius

• The attacker executes arbitrary code in the context of the Chrome renderer process, gaining full control over the code running inside that sandboxed process.
• Confidential data visible to the renderer, such as page content, session state, and in-memory credentials, is readable by the attacker.
• The attacker can modify data processed by the renderer, including form submissions and rendered document content.
• The renderer process can be crashed or made unresponsive, disrupting the user's browsing session for any tab handled by that process.