CVE-2026-79119: Google Chrome PDF Use-After-Free Vulnerability

CVE-2026-79119 Overview

CVE-2026-79119 is a use-after-free vulnerability [CWE-416] in the PDF component of Google Chrome. The flaw affects Chrome versions prior to 152.0.7977.65. A remote attacker can execute arbitrary code inside the Chrome sandbox by convincing a user to open a crafted PDF file. Google's Chromium team rates the security severity as Low, while NVD scores the issue at 8.8 (High) due to network attack vector and high impact on confidentiality, integrity, and availability. Exploitation requires user interaction but no authentication or elevated privileges.

Critical Impact
Successful exploitation allows arbitrary code execution within the Chrome renderer sandbox, providing a foothold for chained sandbox escape attacks against the host operating system.

Affected Products

Google Chrome versions prior to 152.0.7977.65
Chromium-based browsers using the vulnerable PDF component
Desktop builds on Windows, macOS, and Linux stable channels

Discovery Timeline

2026-08-25 - CVE-2026-79119 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-79119

Vulnerability Analysis

The vulnerability resides in Chrome's PDF handling subsystem, which is based on the PDFium library. A use-after-free condition [CWE-416] occurs when the PDF renderer references memory that has already been freed. Attackers who control the allocator state at the time of the dangling access can steer execution into attacker-supplied data.

The issue is reachable through normal browsing. A user only needs to load a crafted PDF, either directly in the browser or through an embedded frame. Exploitation yields code execution inside the Chrome sandbox process, meaning subsequent sandbox escape primitives are required to reach the host.

Root Cause

Use-after-free defects in PDFium typically arise from object lifetime mismanagement between JavaScript-driven PDF actions and the underlying document object model. When a script releases a referenced object while a callback or event handler still holds a pointer, the reused allocation can be manipulated to control a virtual function pointer or freed structure.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker hosts a crafted PDF on a controlled site or delivers it through email, chat, or an advertising network. When Chrome parses the malicious PDF, the crafted object graph triggers the freed-memory access and pivots execution. See the Chromium Issue Tracker #513688690 and the Google Chrome Stable Update advisory for reference. No public proof-of-concept is available at time of writing.

Detection Methods for CVE-2026-79119

Indicators of Compromise

Chrome renderer processes crashing with heap corruption signatures when opening PDF content
Outbound network connections from Chrome renderer processes to unfamiliar domains immediately after PDF loads
Unexpected child processes spawned from chrome.exe following PDF rendering
PDF files delivered from newly registered domains or via unsolicited links

Detection Strategies

Inventory installed Chrome versions across the fleet and flag any build below 152.0.7977.65
Correlate browser process telemetry with PDF MIME type downloads to surface exploitation attempts
Alert on renderer sandbox escape indicators such as token duplication or privileged API calls originating from Chrome children

Monitoring Recommendations

Track Chrome browser version compliance through endpoint management tooling
Log and inspect PDF downloads from external sources at the web proxy
Monitor for anomalous memory allocation patterns and crash reports on endpoints running Chrome

How to Mitigate CVE-2026-79119

Immediate Actions Required

Update Google Chrome to version 152.0.7977.65 or later on all endpoints
Restart Chrome after updating to ensure the patched binaries load into memory
Prioritize patch deployment for users who routinely handle external PDF content
Validate that enterprise Chrome update policies are not blocking the stable channel rollout

Patch Information

Google addressed the vulnerability in the stable channel update announced in the Google Chrome Stable Update advisory. Upgrading to Chrome 152.0.7977.65 or later removes the vulnerable code path. Chromium-based browsers such as Microsoft Edge, Brave, and Opera should be updated once their upstream releases integrate the fix.

Workarounds

Disable the internal Chrome PDF viewer and route PDFs through a hardened external reader until patching completes
Block or sandbox PDF downloads from untrusted sources at the web gateway
Enforce Site Isolation and strict sandbox policies through Chrome enterprise configuration

bash

# Enterprise policy example to disable the built-in PDF viewer via Chrome policy
# Windows registry path
HKLM\Software\Policies\Google\Chrome\AlwaysOpenPdfExternally = 1

# macOS/Linux managed preferences JSON
{
  "AlwaysOpenPdfExternally": true
}