CVE-2026-11304: Google Chrome Use After Free Vulnerability

CVE-2026-11304 Overview

CVE-2026-11304 is a use-after-free vulnerability in PDFium, the PDF rendering component used by Google Chrome. The flaw affects Chrome versions prior to 149.0.7827.53 across Windows, macOS, and Linux. A remote attacker can trigger heap corruption by serving a crafted PDF file, potentially leading to arbitrary code execution within the renderer process. Exploitation requires the victim to open or render the malicious PDF, satisfying the user interaction requirement reflected in the CVSS vector. The vulnerability is classified under CWE-416: Use After Free. Google has shipped a fix in the Stable channel update referenced in the Chrome Release Update.

Critical Impact
A crafted PDF can corrupt the renderer heap and enable remote code execution in the browser sandbox context.

Affected Products

Google Chrome prior to 149.0.7827.53
Chromium-based browsers using vulnerable PDFium builds on Microsoft Windows
Chromium-based browsers using vulnerable PDFium builds on Apple macOS and Linux

Discovery Timeline

2026-06-05 - CVE-2026-11304 published to NVD
2026-06-08 - Last updated in NVD database

Technical Details for CVE-2026-11304

Vulnerability Analysis

The issue resides in PDFium, the open-source PDF library embedded in Chrome to parse and render PDF documents. A use-after-free condition occurs when code continues to reference a heap object after that object has been freed. Attackers can shape the freed memory region with attacker-controlled data, then trigger the dangling reference to corrupt heap metadata or hijack control flow. In a browser context, successful exploitation typically yields code execution inside the renderer process, which then serves as a stepping stone for sandbox escape chains. The Chromium project rates the internal security severity as Low, but the network-reachable attack surface and high impact on confidentiality, integrity, and availability raise the external CVSS rating. Public technical details are limited because the Chromium Issue Report remains restricted pending broader patch adoption.

Root Cause

The defect is a [CWE-416] use-after-free in PDFium object lifetime management. A heap object is released while at least one reference path retains a pointer to it, allowing subsequent operations on stale memory during PDF parsing or rendering.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker hosts or delivers a specially crafted PDF, typically through a malicious website, phishing email, or compromised advertisement. When Chrome opens or previews the PDF, PDFium processes the malformed structures and reaches the vulnerable code path.

No verified proof-of-concept code is publicly available. The vulnerability manifests during PDF object parsing within the PDFium renderer. Refer to the Chrome Release Update for vendor-published details.

Detection Methods for CVE-2026-11304

Indicators of Compromise

Unexpected renderer process crashes in Chrome with PDF content loaded, particularly SIGSEGV or heap corruption faults in PDFium modules.
Outbound child process spawns from chrome.exe immediately following PDF rendering events.
PDF files delivered from low-reputation domains or attachments containing unusual stream objects and JavaScript actions.

Detection Strategies

Inventory installed Chrome versions across endpoints and flag any build below 149.0.7827.53.
Inspect web proxy and email gateway logs for PDF downloads from newly registered or uncategorized domains.
Hunt for renderer crash telemetry referencing pdfium.dll, libpdfium, or PDFiumEngine modules.

Monitoring Recommendations

Forward browser crash dumps and process telemetry to a centralized data lake for correlation with PDF access events.
Alert on anomalous child processes created by Chrome renderer processes, which may indicate sandbox escape attempts.
Track Chrome auto-update status and report stalled updates as a compliance signal.

How to Mitigate CVE-2026-11304

Immediate Actions Required

Update Google Chrome to version 149.0.7827.53 or later on all Windows, macOS, and Linux endpoints.
Restart browsers after the update to ensure the patched PDFium binary is loaded.
Validate that Chromium-based browsers (Edge, Brave, Opera, Vivaldi) have absorbed the upstream PDFium fix.

Patch Information

Google addressed CVE-2026-11304 in the Stable channel release 149.0.7827.53 for Desktop. Details are published in the Chrome Release Update. Enterprise administrators should deploy the update via managed update channels or Group Policy, and verify the version string under chrome://settings/help.

Workarounds

Disable the internal PDF viewer by setting the AlwaysOpenPdfExternally enterprise policy to route PDFs to a hardened external reader.
Block PDF attachments from untrusted senders at the email gateway until patching is verified.
Restrict direct PDF downloads from untrusted web categories using web filtering policies.

bash

# Configuration example: enforce minimum Chrome version via policy (Windows)
reg add "HKLM\Software\Policies\Google\Chrome" /v AlwaysOpenPdfExternally /t REG_DWORD /d 1 /f

# Linux: verify installed Chrome version
google-chrome --version