CVE-2026-11307: Use after free in PDFium in Google Chrome prior to 149

Synopsis

A use-after-free vulnerability in PDFium, the PDF rendering library bundled with Google Chrome, allows a remote attacker to execute arbitrary code inside the browser sandbox. The vulnerability is reachable over the network with no authentication required, but the victim must open a crafted PDF file. Successful exploitation gives the attacker code execution within the Chrome sandbox, which can be a stepping stone to further privilege escalation. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for environments running an affected version of Chrome.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network, for example by hosting or distributing a crafted PDF that the victim's browser fetches.

• AuthenticationNot required

  No account or credential is needed; the attack works against any unauthenticated browser session.

• Victim interactionRequired

  The victim must open a crafted PDF file, requiring the attacker to socially engineer the target into doing so.

• Attack complexityDetail

  Exploitation is reliable and condition-free once the victim opens the file; no race conditions or special environment configuration are needed.

Blast Radius

• The attacker executes arbitrary code within the Chrome renderer sandbox, giving them full control of that sandboxed process.
• Confidential data accessible to the renderer, such as page content, session cookies, and credentials visible in the current browser context, is exposed.
• The attacker can modify data within the sandboxed environment, including in-memory state of the active page or PDF content.
• Sandbox escape primitives combined with this foothold can be used as a launchpad for further privilege escalation on the host system.