CVE-2026-91737: Google Chrome PDF Use After Free Vulnerability

CVE-2026-91737 Overview

CVE-2026-91737 is a use-after-free vulnerability [CWE-416] in the PDF component of Google Chrome versions prior to 153.0.8010.47. A remote attacker can execute arbitrary code inside the Chrome renderer sandbox by convincing a user to visit a crafted HTML page that loads a malicious PDF document. Google's Chromium security team rated the flaw as High severity. Successful exploitation gives an attacker code execution constrained by the renderer sandbox, which is commonly chained with a sandbox escape to achieve full system compromise. The vulnerability affects Chrome across all desktop platforms shipped through the Stable channel.

Critical Impact
Remote attackers can trigger arbitrary code execution in the Chrome sandbox by luring a user to a malicious HTML page that embeds a crafted PDF.

Affected Products

Google Chrome for Windows prior to 153.0.8010.47
Google Chrome for macOS prior to 153.0.8010.47
Google Chrome for Linux prior to 153.0.8010.47

Discovery Timeline

2026-09-15 - CVE-2026-91737 published to NVD
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-91737

Vulnerability Analysis

The vulnerability resides in Chrome's PDF handling code, which is provided by the PDFium engine embedded in the browser. A use-after-free condition occurs when the PDF component retains a pointer to a heap object after that object has been freed. When the freed memory is reallocated with attacker-controlled data and the dangling pointer is dereferenced, the attacker can hijack control flow inside the renderer process.

Because PDF rendering runs inside the Chrome sandbox, initial code execution is constrained. Attackers routinely pair renderer bugs of this class with a separate sandbox escape to achieve arbitrary code execution on the host. User interaction is required, matching the UI:R attribute in the CVSS vector.

Root Cause

The defect is a memory lifetime management error in the PDF component. The affected code path releases a heap-allocated object while another reference to that object remains reachable. Subsequent operations dereference the stale pointer, allowing an attacker who controls heap layout to place a crafted object at the freed address and manipulate program state.

Attack Vector

Exploitation begins with a victim loading a crafted HTML page in Chrome. The page embeds or references a specially constructed PDF that triggers the vulnerable code path. No credentials are required, and the attack traverses the network. Because delivery relies on a browser visit, phishing links, malicious ads, and compromised third-party content are viable delivery channels.

No public proof-of-concept exploit has been observed at time of publication. Technical details are tracked in the Chromium Issue #558036280, which is currently access-restricted per Google's standard disclosure policy.

Detection Methods for CVE-2026-91737

Indicators of Compromise

Chrome renderer process crashes referencing PDFium modules or heap corruption signatures in Windows Error Reporting or crash_reporter logs.
Unexpected spawning of child processes from chrome.exe following navigation to an unfamiliar HTML page that loads PDF content.
Outbound connections from Chrome renderer processes to newly registered or low-reputation domains hosting .pdf resources.

Detection Strategies

Inventory installed Chrome versions across the estate and flag any host running a build earlier than 153.0.8010.47.
Correlate browser crash telemetry with subsequent process creation or credential access events to identify potential exploitation chains.
Hunt for anomalous PDF downloads or inline PDF loads originating from newly observed domains referenced by HTML pages.

Monitoring Recommendations

Enable endpoint detection and response telemetry for browser child process activity, file writes to user profile directories, and script interpreter launches by Chrome.
Forward Chrome update status from managed enrollment systems to a centralized log store to confirm patch adoption.
Monitor web proxy logs for HTML pages that embed PDFs from third-party origins, particularly outside standard business categories.

How to Mitigate CVE-2026-91737

Immediate Actions Required

Update Chrome to version 153.0.8010.47 or later on all Windows, macOS, and Linux endpoints.
Restart Chrome after the update installs; the patched binary is not active until the browser process is relaunched.
Push the update through managed policy for enterprise fleets rather than relying on user-initiated relaunches.

Patch Information

Google released the fix in the Stable channel update announced in the Chrome Releases blog. Chrome versions 153.0.8010.47 and later contain the corrected PDF component. Chromium-based browsers such as Microsoft Edge, Brave, Opera, and Vivaldi should be updated to versions incorporating the equivalent upstream fix once vendors publish them.

Workarounds

Disable the internal Chrome PDF viewer by setting AlwaysOpenPdfExternally via enterprise policy to route PDFs to a hardened external viewer.
Restrict navigation to untrusted sites through web filtering or URLBlocklist policies until patch deployment is verified.
Warn users to avoid opening PDF links from unsolicited email or unfamiliar web pages during the patch rollout window.

bash

# Verify installed Chrome version on Linux and macOS
google-chrome --version

# Windows: query the installed version from the registry
reg query "HKLM\SOFTWARE\Google\Chrome\BLBeacon" /v version

# Enterprise policy fragment (Windows) to force PDFs to open externally
# HKLM\SOFTWARE\Policies\Google\Chrome
#   AlwaysOpenPdfExternally = 1 (REG_DWORD)