CVE-2026-110155: Google Chrome PDFium Buffer Overflow Flaw

CVE-2026-110155 Overview

CVE-2026-110155 is a heap buffer overflow [CWE-122] in PDFium, the PDF rendering engine embedded in Google Chrome. A remote attacker can execute arbitrary code inside the Chrome sandbox by convincing a user to visit a crafted HTML page that loads malicious PDF content. The flaw affects Chrome versions prior to 155.0.8059.79 and was addressed in the Stable channel update. Chromium rates the security severity as High.

Critical Impact
Successful exploitation enables arbitrary code execution within the renderer sandbox, providing attackers an initial foothold that can be chained with sandbox escape vulnerabilities for full system compromise.

Affected Products

Google Chrome Desktop (Windows, macOS, Linux) versions prior to 155.0.8059.79
PDFium component shipped with vulnerable Chrome builds
Chromium-based browsers that embed the affected PDFium version

Discovery Timeline

2026-10-13 - CVE-2026-110155 published to NVD
2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-110155

Vulnerability Analysis

The vulnerability resides in PDFium, the open-source PDF renderer integrated into Chrome. A crafted PDF document delivered through an HTML page triggers a heap-based buffer overflow during parsing or rendering. The overflow corrupts adjacent heap memory, enabling an attacker to influence control-flow data and achieve arbitrary code execution within the renderer process.

Exploitation requires user interaction, specifically visiting an attacker-controlled page. Code execution is confined to the Chrome sandbox, so an additional sandbox escape is needed for full host compromise. Attackers frequently chain renderer bugs with sandbox or kernel vulnerabilities to achieve this.

Root Cause

The root cause is a heap buffer overflow classified under [CWE-122]. PDFium writes beyond the bounds of an allocated heap buffer when processing attacker-controlled fields in a malformed PDF object. The specific allocation site and object type have not been publicly disclosed in the vendor advisory. The fix shipped in Chrome 155.0.8059.79 through the Stable channel update.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker hosts a malicious HTML page that embeds or references a crafted PDF. When a victim loads the page in a vulnerable Chrome build, PDFium parses the PDF and triggers the overflow. The vulnerability can also be weaponized via malvertising, phishing links, or compromised legitimate sites.

No public proof-of-concept exploit is currently available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. See the Chromium Issue Tracker Entry for restricted technical details.

Detection Methods for CVE-2026-110155

Indicators of Compromise

Chrome renderer process crashes correlated with PDF loading, visible in crash dumps referencing PDFium modules
Unexpected child processes spawned by chrome.exe renderer processes after visiting external sites
Outbound connections from renderer processes to unfamiliar domains hosting PDF content
Browser telemetry showing Chrome versions below 155.0.8059.79 in the environment

Detection Strategies

Inventory installed Chrome versions across endpoints and flag any build earlier than 155.0.8059.79
Monitor endpoint telemetry for anomalous process behavior originating from Chrome renderer processes, including memory allocation anomalies and shellcode execution patterns
Inspect web proxy logs for PDF downloads from low-reputation domains and correlate with user browsing sessions

Monitoring Recommendations

Enable browser crash telemetry forwarding to centralized logging for correlation with threat intelligence feeds
Deploy EDR rules that alert on sandbox escape attempts, such as renderer processes writing to sensitive registry keys or spawning shells
Track Chrome update compliance using endpoint management tooling and alert on devices that fall behind the Stable channel

How to Mitigate CVE-2026-110155

Immediate Actions Required

Update Google Chrome to version 155.0.8059.79 or later across all managed endpoints
Restart Chrome after the update to ensure the patched PDFium library is loaded
Audit third-party Chromium-based browsers and apply vendor patches as they become available
Communicate the risk to users and advise against opening untrusted PDF links until patching completes

Patch Information

Google released the fix in the Chrome Stable channel update to version 155.0.8059.79. Refer to the Google Chrome Stable Update advisory for release notes and distribution details. Enterprise administrators should deploy the update through managed software distribution channels.

Workarounds

Disable the built-in Chrome PDF viewer via enterprise policy and route PDFs to an alternative, patched reader
Restrict access to untrusted web content using URL filtering and web isolation technologies
Enforce Site Isolation and strict sandboxing policies to limit the blast radius of renderer compromises

bash

# Verify Chrome version meets the patched build on Linux
google-chrome --version

# Windows enterprise policy to disable the internal PDF viewer
# Set via Group Policy: Computer Configuration > Administrative Templates > Google > Google Chrome
# Policy name: AlwaysOpenPdfExternally = Enabled
reg add "HKLM\SOFTWARE\Policies\Google\Chrome" /v AlwaysOpenPdfExternally /t REG_DWORD /d 1 /f