CVE-2026-9958: Use after free in PDFium in Google Chrome prior to 148

Synopsis

A use-after-free vulnerability exists in PDFium, the PDF rendering library bundled with Google Chrome prior to version 148.0.7778.216. The flaw is reachable over the network and requires no authentication, but does require the victim to open a crafted PDF file, which triggers heap corruption in the renderer process. Successful exploitation gives the attacker full read, write, and crash capability inside the affected process, enabling data theft, content tampering, or a renderer crash. A patched-image rebuild at version 148.0.7778.216 is available on HarborGuard for environments running an affected version of Chrome.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the malicious PDF over the network, so the targeted host must be able to reach or receive content from an attacker-controlled source.

• AuthenticationNot required

  No account or credential is needed; the attacker only needs to get the crafted PDF in front of the victim.

• Victim interactionRequired

  The victim must open or preview a crafted PDF file, making this a social-engineering vector where the attacker must induce the user to act.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other environmental factors beyond victim interaction.

Blast Radius

• Reads arbitrary memory within the Chrome renderer process, including cached credentials, session tokens, and rendered page content.
• Writes to freed heap memory, allowing an attacker to corrupt renderer state or inject controlled data into process memory.
• Crashes the Chrome renderer process, causing a denial of service for the affected browser tab or the entire browser depending on sandbox configuration.
• Depending on sandbox integrity, heap corruption may be chained toward a sandbox escape, broadening attacker reach beyond the renderer.