CVE-2025-1918: Google Chrome PDFium RCE Vulnerability

CVE-2025-1918 Overview

CVE-2025-1918 is an out-of-bounds read vulnerability in PDFium, the PDF rendering engine bundled with Google Chrome. The flaw affects all Chrome versions prior to 134.0.6998.35. A remote attacker can trigger out-of-bounds memory access by enticing a user to open a crafted PDF file in the browser. Google classifies the Chromium security severity as Medium, while the National Vulnerability Database assigns a higher CVSS score reflecting the network attack vector and potential impact on confidentiality, integrity, and availability. The weakness is tracked as CWE-125: Out-of-bounds Read.

Critical Impact

A remote attacker can read memory outside the intended buffer in PDFium by serving a malicious PDF, potentially leading to information disclosure or supporting further memory corruption exploitation chains.

Affected Products

• Google Chrome versions prior to 134.0.6998.35
• PDFium component embedded within Chromium-based browsers
• Downstream Chromium derivatives that had not yet rebased to the patched milestone

Discovery Timeline

• 2025-03-05 - CVE-2025-1918 published to NVD
• 2025-04-01 - Last updated in NVD database

Technical Details for CVE-2025-1918

Vulnerability Analysis

The vulnerability resides in PDFium, the open-source library Chrome uses to parse and render PDF documents. PDFium reads bytes beyond the bounds of an allocated buffer when processing specific structures inside a maliciously crafted PDF. Out-of-bounds reads of this type can leak adjacent process memory back to attacker-controlled rendering logic. They can also be combined with other primitives to defeat memory layout protections such as Address Space Layout Randomization (ASLR).

Exploitation requires user interaction. A target user must load the crafted PDF in Chrome, typically by visiting an attacker-controlled page that embeds or auto-loads the document. Because Chrome opens PDFs inline by default, the attack surface extends to any browsing context that can render attacker-supplied content, including iframes and email preview panes built on Chromium.

Google resolved the issue in the Chrome stable channel release 134.0.6998.35. The fix landed through the upstream Chromium project, and details are tracked in the Chromium Issue Tracker entry.

Root Cause

The root cause is missing or incorrect bounds validation [CWE-125] while parsing fields inside PDF objects. PDFium accesses memory using an offset or length derived from attacker-controlled data without verifying that the resulting pointer remains within the allocated buffer.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker hosts a crafted PDF on a web server or delivers it through phishing. When the victim opens the file in a vulnerable Chrome version, PDFium parses the malformed structures and performs the out-of-bounds read inside the renderer process.

No verified public proof-of-concept is available. The vulnerability mechanism is documented in the Google Chrome update announcement.

Detection Methods for CVE-2025-1918

Indicators of Compromise

• Chrome renderer process crashes or SIGSEGV events correlated with PDF rendering activity
• Inbound HTTP responses delivering PDF content with abnormal cross-reference tables or malformed object streams
• Browser telemetry showing PDF loads from low-reputation domains followed by anomalous child process behavior

Detection Strategies

• Inventory Chrome installations across managed endpoints and flag any version below 134.0.6998.35
• Inspect proxy and web gateway logs for PDF downloads from untrusted origins, especially those triggered by redirect chains
• Hunt for renderer process crashes referencing pdfium.dll or PDFium symbols in Windows Error Reporting and macOS crash logs

Monitoring Recommendations

• Forward browser crash telemetry and EDR process-event data to a centralized analytics platform for correlation against PDF activity
• Track Chrome version distribution as a continuous compliance metric in vulnerability management dashboards
• Alert on unsigned or newly observed PDF files executed in browser contexts immediately after web navigation events

How to Mitigate CVE-2025-1918

Immediate Actions Required

• Update Google Chrome to version 134.0.6998.35 or later on all managed and unmanaged endpoints
• Force-restart Chrome after deployment so the patched binaries replace the running renderer processes
• Update any Chromium-based browsers and embedded WebView components that share the PDFium codebase

Patch Information

Google released the fix in the Chrome stable channel update on March 4, 2025. Administrators should consult the Google Chrome update announcement and validate deployment through enterprise update policies. Chromium downstream consumers should rebase to the corresponding milestone.

Workarounds

• Disable the internal PDF viewer through enterprise policy AlwaysOpenPdfExternally until patching completes
• Block inbound PDF attachments at the email gateway from untrusted senders during the remediation window
• Restrict PDF rendering in browsers using application allowlists or web content filtering policies

# Configuration example: enforce minimum Chrome version via Windows Group Policy registry key
reg add "HKLM\Software\Policies\Google\Chrome" /v AlwaysOpenPdfExternally /t REG_DWORD /d 1 /f