CVE-2026-118345 in Chrome
Summary
by MITRE • 10/28/2026
Use after free in PDFium in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/28/2026
The vulnerability identified as a use-after-free flaw within PDFium, the component responsible for rendering Portable Document Format files in Google Chrome prior to version 156.0.8078.73, represents a critical memory management error that can lead to arbitrary code execution. This specific class of defect occurs when an application continues to reference a block of memory after it has been freed or deallocated by the system. In the context of PDFium, this typically arises during the parsing and rendering of complex or maliciously crafted PDF documents embedded within HTML pages. When the browser processes such content, internal pointers may retain references to previously allocated memory structures that have already been released back to the heap allocator. If an attacker can control the contents of this freed memory region before it is reallocated for a different purpose, they can manipulate the data structure associated with those dangling pointers, effectively gaining control over program execution flow.
From a technical perspective, use-after-free vulnerabilities are particularly dangerous because they allow attackers to corrupt internal state information or hijack function call sequences. In Chrome's architecture, where security relies heavily on sandboxing to isolate untrusted web content from the host operating system, exploiting this flaw requires precise memory manipulation techniques such as heap spraying or specific allocation patterns to ensure that attacker-controlled data is placed in the freed memory slot. Once the vulnerable code path accesses these corrupted pointers, it may execute arbitrary instructions within the browser process context. Although Chrome employs multiple layers of defense including Data Execution Prevention and Address Space Layout Randomization, sophisticated exploits can bypass these mitigations through techniques like ROP chains or direct shellcode injection if the sandbox boundaries are successfully breached due to the memory corruption.
The operational impact of this vulnerability is severe, classified with a High security severity by Chromium developers because it enables remote code execution without user interaction beyond visiting a malicious webpage. An attacker could craft an HTML page containing a specially designed PDF object that triggers the use-after-free condition upon rendering. Successful exploitation allows the adversary to execute arbitrary commands on the victim's machine within the browser process, potentially leading to full system compromise if sandbox escape techniques are combined with this initial foothold. This affects not only individual users but also organizations relying on Chrome for secure web browsing and document viewing, as it undermines trust in the platform’s ability to safely render third-party content formats like PDFs which are ubiquitous in modern web applications.
To mitigate risks associated with this vulnerability, immediate action involves updating Google Chrome to version 156.0.8078.73 or later where these memory management issues have been addressed by developers through improved pointer validation and lifecycle tracking within the PDFium library. Organizations should enforce automated patching policies for all endpoints running affected browser versions. Additionally, implementing strict content security policies can help restrict inline scripts and potentially limit the attack surface presented to users visiting untrusted sites. Security teams are also advised to monitor network traffic for unusual patterns indicative of exploit attempts targeting known vulnerable components and consider deploying endpoint detection solutions that flag anomalous memory access behaviors consistent with use-after-free exploitation techniques.
This vulnerability aligns with Common Weakness Enumeration identifier CWE-416, which describes the error condition where a pointer is used after it has been freed, leading to undefined behavior or security breaches. In terms of offensive cyber operations mapping, this flaw facilitates initial access and privilege escalation vectors consistent with MITRE ATT&CK technique T1203, specifically regarding exploitation for client-side execution. Understanding these mappings helps defenders prioritize remediation efforts based on established industry standards while providing context for threat intelligence analysts tracking adversary tactics that leverage memory corruption bugs in widely deployed software components like web browsers.