CVE-2026-91737 in Chrome
Summary
by MITRE • 09/15/2026
Use after free in PDF in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/16/2026
The vulnerability described constitutes a critical memory safety issue within the PDF rendering engine of Google Chrome, specifically affecting versions prior to 153.0.8010.47. This flaw is classified as an out-of-bounds use or use-after-free condition, which represents one of the most dangerous classes of software vulnerabilities in modern application development. The root cause lies in improper management of memory pointers within the PDF processing component. When Chrome parses a maliciously crafted HTML page that embeds or references a specially constructed PDF document, it allocates specific blocks of memory to handle various elements of the file structure. However, due to a logic error in the reference counting mechanism or pointer lifecycle management, these memory blocks are freed while they are still being actively referenced by other parts of the application state. This creates a dangling pointer situation where the program continues to operate on deallocated memory regions.
From an operational perspective, this vulnerability allows for arbitrary code execution within the browser's sandbox environment. The Chromium security severity is rated as High because it bypasses standard web isolation mechanisms through sophisticated exploitation techniques. Attackers can craft HTML pages that trigger specific sequences of PDF parsing operations designed to manipulate heap metadata or overwrite function pointers in memory. By carefully controlling the contents written into the freed memory region, an attacker can redirect program execution flow to inject and run shellcode. This effectively neutralizes the sandbox protections intended to isolate untrusted web content from the underlying operating system, granting the malicious code full privileges of the user running the browser process.
The technical implications are severe as this type of vulnerability is frequently leveraged in drive-by download attacks where no user interaction beyond visiting a webpage is required. The exploitation chain typically involves triggering the PDF parser with malformed data structures that cause premature deallocation followed by immediate reuse under attacker control. This aligns closely with CWE-416, which defines use after free as referencing memory after it has been freed, leading to undefined behavior and potential code execution. Furthermore, in the context of the MITRE ATT&CK framework, this vulnerability facilitates initial access through technique T1189 Drive-by Compromise and enables privilege escalation or persistence if combined with other exploits, falling under techniques such as T1055 Process Injection when the shellcode is injected into a legitimate process.
Mitigation strategies primarily involve immediate patching to version 153.0.8010.47 or later, which includes fixes for memory management logic in the PDFium library and related rendering components. Security teams should ensure that browser auto-update mechanisms are enabled to prevent exposure windows. Additionally, deploying endpoint detection and response solutions with behavioral analysis capabilities can help identify anomalous processes spawned by Chrome instances attempting to execute code from non-standard memory regions. Network-level controls such as web application firewalls may also be configured to block requests containing suspicious PDF payloads or malformed HTML structures known to trigger this specific vulnerability pattern. Regular security audits focusing on C++ memory safety and static analysis tools that detect dangling pointer usage are recommended for long-term resilience against similar vulnerabilities in complex software ecosystems.