CVE-2026-11305: Google Chrome Use-After-Free Vulnerability

CVE-2026-11305 Overview

CVE-2026-11305 is a use-after-free vulnerability [CWE-416] in PDFium, the PDF rendering engine bundled with Google Chrome. The flaw affects all Chrome desktop builds prior to version 149.0.7827.53 on Windows, macOS, and Linux. A remote attacker can trigger the condition by serving a crafted PDF file to a target user. Successful exploitation allows arbitrary code execution inside the Chrome renderer sandbox. The bug requires user interaction, typically loading or viewing the malicious PDF in the browser.

Critical Impact
Remote attackers can execute arbitrary code inside the Chrome renderer sandbox by delivering a crafted PDF, putting browser users at risk of drive-by compromise.

Affected Products

Google Chrome prior to 149.0.7827.53 on Microsoft Windows
Google Chrome prior to 149.0.7827.53 on Apple macOS
Google Chrome prior to 149.0.7827.53 on Linux

Discovery Timeline

2026-06-05 - CVE-2026-11305 published to the National Vulnerability Database (NVD)
2026-06-08 - Last updated in the NVD database

Technical Details for CVE-2026-11305

Vulnerability Analysis

The vulnerability resides in PDFium, the open-source PDF parser and renderer used by Chrome. PDFium handles complex PDF object graphs containing fonts, forms, JavaScript, and embedded resources. A use-after-free [CWE-416] occurs when code continues to reference a heap object after it has been deallocated. An attacker who controls the contents of a PDF can manipulate object lifetimes to force this condition during parsing or rendering.

Exploitation produces arbitrary code execution inside the renderer process. The renderer remains constrained by the Chrome sandbox, so a separate sandbox escape is required for full host compromise. Chromium classifies the bug at Low severity internally, while NVD assigns a CVSS 3.1 base score of 8.8 reflecting network reachability and high impact on confidentiality, integrity, and availability.

Root Cause

The root cause is improper object lifetime management within PDFium. A heap-allocated object is freed while another code path retains a dangling pointer to it. When the dangling pointer is dereferenced, attacker-controlled data placed into the reclaimed allocation can be treated as a valid object. This primitive supports type confusion and control-flow hijacking inside the renderer.

Attack Vector

The attack vector is network-based with user interaction. An attacker hosts a malicious PDF on a website, sends it as an email attachment, or embeds it inside a third-party page. When the victim opens the PDF in Chrome, PDFium parses the document and triggers the use-after-free. No authentication or elevated privileges are required.

No verified public exploit code is available for CVE-2026-11305. See the Chromium Issue Tracker Entry and the Google Chrome Desktop Update for vendor technical details.

Detection Methods for CVE-2026-11305

Indicators of Compromise

Chrome renderer processes (chrome.exe --type=renderer) crashing with access violations shortly after loading a PDF
Inbound PDF documents from untrusted senders containing malformed object streams, large /JavaScript actions, or unusual font dictionaries
Renderer processes spawning unexpected child processes or initiating outbound network connections after PDF rendering
Chrome crash reports referencing PDFium modules such as pdfium.dll or libpdfium.so

Detection Strategies

Inspect web and email gateway telemetry for PDF attachments arriving from low-reputation domains and route them to sandbox detonation.
Hunt for Chrome version strings below 149.0.7827.53 across managed endpoints using software inventory data.
Correlate Chrome renderer crashes with subsequent suspicious child process creation or credential access activity.

Monitoring Recommendations

Forward Chrome crash dumps and Windows Error Reporting events to a central log store for analytics.
Monitor endpoint process trees for chrome.exe renderer children launching shells, scripting hosts, or LOLBins.
Alert on outbound connections initiated by Chrome renderer processes immediately after PDF file activity.

How to Mitigate CVE-2026-11305

Immediate Actions Required

Update Google Chrome to version 149.0.7827.53 or later on Windows, macOS, and Linux endpoints.
Force-restart Chrome after deployment so the patched binaries load; pending updates do not take effect until a relaunch.
Verify enterprise update channels and managed browser policies are not blocking the stable channel update.
Block or quarantine inbound PDF attachments from untrusted external senders until patch coverage is confirmed.

Patch Information

Google released the fix in the Chrome stable channel build 149.0.7827.53 for desktop. Refer to the Google Chrome Desktop Update advisory for full release notes and to the Chromium Issue Tracker Entry for issue metadata. Chromium-based browsers that consume upstream Chromium releases should ingest the equivalent merge before exposure ends.

Workarounds

Disable the built-in PDF viewer by setting the AlwaysOpenPdfExternally enterprise policy so PDFs download instead of rendering in Chrome.
Route PDF handling to a hardened, sandboxed reader managed outside the browser process.
Restrict PDF downloads from untrusted origins using URL filtering and SafeSearch enforcement at the proxy layer.

bash

# Verify installed Chrome version on Windows endpoints
reg query "HKLM\Software\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv

# Verify installed Chrome version on Linux endpoints
google-chrome --version

# Enterprise policy to disable in-browser PDF rendering (Windows)
reg add "HKLM\Software\Policies\Google\Chrome" /v AlwaysOpenPdfExternally /t REG_DWORD /d 1 /f