PatchSiren cyber security CVE debrief
CVE-2026-11307 Google CVE debrief
CVE-2026-11307 is a use-after-free vulnerability in PDFium in Google Chrome prior to 149.0.7827.53. This vulnerability allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted PDF file. The CVSS score for this vulnerability is 8.8, indicating a high severity. The vulnerability was published on [cvePublishedAt] and modified on [cveModifiedAt].
- Vendor
- Product
- Chrome
- CVSS
- HIGH 8.8
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-06-05
- Original CVE updated
- 2026-06-08
- Advisory published
- 2026-06-05
- Advisory updated
- 2026-06-08
Who should care
Users of Google Chrome prior to version 149.0.7827.53 should update to the latest version to mitigate this vulnerability.
Technical summary
The vulnerability is a use-after-free issue in PDFium, a library used by Google Chrome to render PDF files. This type of vulnerability occurs when a program attempts to use memory after it has been freed, which can lead to arbitrary code execution. In this case, a remote attacker could exploit this vulnerability by providing a crafted PDF file that, when processed by Google Chrome, would execute arbitrary code inside the browser's sandbox.
Defensive priority
High
Recommended defensive actions
- Update Google Chrome to version 149.0.7827.53 or later.
Evidence notes
The CVE record and NVD detail can be found at [resourceLinkAnnotations:cve-org] and [resourceLinkAnnotations:nvd], respectively. Additional information can be found in the Chrome release notes at [resourceLinkAnnotations:ref-4].
Official resources
-
CVE-2026-11307 CVE record
CVE.org
-
CVE-2026-11307 NVD detail
NVD
-
Source item URL
nvd_modified
-
Mitigation or vendor reference
[email protected] - Release Notes
-
Source reference
[email protected] - Permissions Required
CVE-2026-11307 was published on 2026-06-05T00:17:08.733Z and modified on 2026-06-08T18:04:27.217Z.