CVE-2026-9957: Use after free in PDF in Google Chrome prior to 148

Synopsis

A use-after-free vulnerability in the PDF component of Google Chrome allows a remote attacker to execute arbitrary code inside the browser sandbox. The flaw is reachable over the network with no authentication required, but the victim must open a specially crafted PDF file. Successful exploitation gives the attacker code execution within the Chrome sandbox, which combined with a sandbox escape could lead to full system compromise. A patched-image rebuild at version 148.0.7778.216 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the crafted PDF over the network, so the targeted Chrome instance must be reachable or the user must browse to attacker-controlled content.

• AuthenticationNot required

  No account or credentials are needed; the attacker only needs to get the victim to open a malicious PDF.

• Victim interactionRequired

  The victim must actively open or preview a crafted PDF file, making this a social-engineering or drive-by delivery scenario.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, memory-layout guesses, or other variable environmental factors.

Blast Radius

• Attacker executes arbitrary code inside the Chrome renderer sandbox, gaining control of the sandboxed process.
• Confidential data visible to the renderer, such as page contents, cached credentials, and DOM storage, becomes readable to the attacker.
• The attacker can modify in-memory page state and inject content into the rendered document.
• If chained with a sandbox escape, the attacker gains code execution at the OS user level on the victim host.