CVE-2026-6361
HighSummary
Heap buffer overflow in PDFium in Google Chrome on Windows prior to version 147.0.7727.101 allows a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code inside a sandbox via a crafted PDF file.
Risk Assessment
An attacker could exploit this vulnerability to execute malicious code, potentially compromising the user's system.
Recommendation
It is recommended to update Google Chrome to the latest version to mitigate this vulnerability.
Other vulnerabilities in PDFium in Google Chrome
See all- CVE-2019-13721High
Use after free in PDFium in Google Chrome prior to version 78.0.3904.87 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- CVE-2017-5111High
A use after free in PDFium in Google Chrome prior to version 61.0.3163.79 for Linux, Windows, and Mac allows a remote attacker to potentially exploit memory corruption via a crafted PDF file.
- CVE-2017-5108High
Type confusion in PDFium in Google Chrome prior to version 60.0.3112.78 for Mac, Windows, Linux, and Android allowed a remote attacker to potentially maliciously modify objects via a crafted PDF file.
- CVE-2017-5095High
Stack overflow in PDFium in Google Chrome prior to version 60.0.3112.78 for Linux, Windows, and Mac allowed a remote attacker to potentially exploit stack corruption via a crafted PDF file.
- CVE-2016-5183High
A heap use after free in PDFium in Google Chrome prior to version 54.0.2840.59 for Windows, Mac, and Linux; 54.0.2840.85 for Android allows a remote attacker to potentially exploit heap corruption via crafted PDF files.
Original NVD description (English source)
Heap buffer overflow in PDFium in Google Chrome on Windows prior to 147.0.7727.101 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code inside a sandbox via a crafted PDF file. (Chromium security severity: High)