CVE-2026-11670: Use after free in PDF in Google Chrome prior to 149

Synopsis

Use-after-free in the PDF component of Google Chrome (versions prior to 149.0.7827.103) allows a remote attacker to execute arbitrary code inside the Chrome sandbox by convincing a user to open a crafted PDF file. The vulnerability is reachable over the network and requires no authentication, but does require the victim to interact with a malicious file. A patched-image rebuild at version 149.0.7827.103 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the crafted PDF over the network, so the targeted Chrome instance must be reachable or the user must be able to fetch attacker-controlled content from the network.

• AuthenticationNot required

  No account or credential is needed; the attacker delivers the payload without authenticating to any service.

• Victim interactionRequired

  The victim must open or render a crafted PDF file, requiring the attacker to use a social-engineering vector such as a malicious link, email attachment, or embedded file.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other environmental preconditions.

Blast Radius

• Arbitrary code executes inside the Chrome renderer sandbox, giving the attacker control over the renderer process.
• Confidential data accessible to the renderer, including page content, cached credentials, and session tokens, is readable by the attacker.
• The attacker can modify data handled within the sandboxed process, including intercepting or tampering with rendered content.
• The renderer process crashes or becomes unresponsive, disrupting the user session for the affected tab or window.