CVE-2026-110147 in Chrome
Summary
by MITRE • 10/13/2026
Use after free in PDF in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/13/2026
The vulnerability described constitutes a critical memory safety issue within the PDF rendering engine of Google Chrome, specifically affecting versions prior to 155.0.8059.79. This flaw is classified as an out-of-bounds use or use-after-free condition, which represents one of the most dangerous classes of software vulnerabilities in modern computing environments. The root cause lies in improper management of memory pointers within the PDF processing component. When Chrome parses a maliciously crafted HTML page that embeds or references a specially constructed PDF file, it allocates specific blocks of memory to handle various objects and structures defined by the PDF specification. Under normal circumstances, these allocations are tracked carefully, ensuring that when an object is no longer needed, its memory is properly deallocated and any pointers referencing it are nullified or updated. However, in this instance, a logic error allows certain references to persist even after the underlying memory has been freed back to the system allocator.
This use-after-free condition creates a window of opportunity for arbitrary code execution within the browser's sandboxed environment. When an attacker crafts a PDF file with specific malformed structures or metadata, they can manipulate the timing and state of memory operations such that the application attempts to access or modify data at a memory address that has already been released. Because modern operating systems employ sophisticated memory protection mechanisms like Address Space Layout Randomization (ASLR) and Data Execution Prevention (DEP), simply accessing freed memory does not immediately result in code execution. Instead, it leads to undefined behavior, which can manifest as crashes or, more critically, allow an attacker to control the contents of that freed memory block through heap spraying techniques. By carefully controlling what data is written into the reused memory location before the vulnerable pointer accesses it, a remote attacker can overwrite function pointers or object vtables with addresses pointing to malicious shellcode injected elsewhere in the process memory space.
The operational impact of this vulnerability is severe due to its potential for remote code execution via social engineering vectors such as phishing emails or compromised websites hosting crafted HTML pages containing embedded PDFs. Although Chrome employs a multi-process architecture where renderer processes run in restricted sandboxes, successfully exploiting a use-after-free flaw can allow an attacker to escape these sandbox boundaries under certain conditions or achieve significant privilege escalation within the process context itself. This could lead to full system compromise if combined with other vulnerabilities or if the browser is configured to allow higher privileges for specific sites. The severity rating of High reflects both the ease of exploitation given mature exploit development techniques and the high value placed on preventing remote code execution in widely used web browsers that serve as gateways to corporate networks and personal data stores.
From a standards perspective, this vulnerability aligns with CWE-416: Use After Free, which describes situations where pointers are not properly invalidated after memory is freed, leading to unpredictable behavior when the pointer is subsequently dereferenced. In terms of attack tactics, this exploitation path corresponds to ATT&CK technique T1203: Exploitation for Client Execution, specifically within the context of web browsers and document parsers like PDF engines. The attacker leverages user interaction or automated browsing contexts to trigger the parsing routine that contains the flaw, thereby initiating the chain of events leading to code execution without requiring direct command-line access or local file system privileges initially.
Mitigation strategies primarily involve updating Google Chrome to version 155.0.8059.79 or later, where these memory management issues have been addressed through rigorous code reviews and automated fuzzing efforts that identify such edge cases in complex parsers like the PDFium library used by Chromium-based browsers. Organizations should enforce automatic update policies for all endpoints running Chrome to ensure timely patch deployment against known high-severity vulnerabilities. Additionally, security teams can implement application control solutions or browser hardening configurations that restrict the ability of web content to execute native code or access sensitive system resources, thereby reducing the blast radius even if a vulnerability is successfully exploited. Regular monitoring of threat intelligence feeds for indicators of compromise associated with PDF-based exploits can also help in detecting active attempts to leverage this flaw before widespread damage occurs.