Description

Use after free in PDF in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted PDF file. (Chromium security severity: Low)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-25T21:18:06.990Z",
  "pubdate": "2026-08-25T21:18:06.990Z",
  "executiveSummary": "A use-after-free vulnerability exists in the PDF rendering component of Google Chrome prior to version 152.0.7977.65.\nThis memory corruption flaw allows a remote, unauthenticated attacker to execute arbitrary code within the constraints of the browser sandbox.\nThe vulnerability is triggered by processing a specially crafted PDF document, which induces the browser to perform operations on freed memory locations.\nWhile the Chromium security severity is rated as Low, the impact remains significant due to the potential for arbitrary code execution (ACE), which could serve as a prerequisite for sandbox escape or system-level exploitation.\nThe attack is remotely exploitable without user interaction beyond navigating to or opening a malicious PDF file.\nSuccessful exploitation compromises the integrity and confidentiality of the browser session and provides a vector for further malicious activities.",
  "technicalDetails": "The vulnerability is a classic use-after-free (UAF) condition located within the PDF parsing or rendering engine of the Chromium browser framework.\nA use-after-free occurs when an application continues to use a pointer to a memory region after that memory has been deallocated. In the context of PDF processing, this often involves the improper management of object lifecycles during the parsing of complex or malformed PDF structures.\nWhen a PDF document containing specifically structured, nested, or malformed data is processed, the PDF engine may allocate a resource in heap memory. Due to a flaw in the reference counting or lifecycle management logic, a dangling pointer may be created if the resource is prematurely freed while still being referenced by another part of the engine.\nAn attacker can exploit this by 'grooming' the heap to place controlled data—often referred to as a payload—into the memory address that was recently deallocated. When the PDF engine subsequently attempts to access the memory via the dangling pointer, it inadvertently executes or operates upon the attacker-supplied data.\nThe attack flow proceeds as follows: First, the attacker delivers a malicious PDF file to the victim. Upon the victim opening this file, the browser's PDF renderer initializes the vulnerable object. Second, the attacker triggers an object deletion within the PDF structure that incorrectly updates the references, leaving a dangling pointer active in a global or persistent object state. Third, the attacker uses secondary PDF primitives to allocate new objects (heap spraying) to reclaim the memory area previously occupied by the freed object, overwriting it with malicious instructions or data structures, such as a forged virtual method table (vtable). Finally, when the engine attempts to invoke a method or access data through the dangling pointer, the execution flow is redirected to the attacker's controlled code.\nBecause the vulnerability occurs within the renderer process, the resulting code execution is subject to the Chromium sandbox. However, successful exploitation provides the attacker with a platform to execute malicious logic, which can then be leveraged alongside additional exploits to escape the sandbox and compromise the host operating system. The vulnerability affects all versions of Google Chrome earlier than 152.0.7977.65."
}