Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.8
CVE-2026-9957: Google Chrome PDF Use After Free Vulnerability (Remote Code Execution)
CVE-2026-9957 · published 5 months ago
Summary
Google Chrome versions prior to 148.0.7778.216 have a vulnerability that could allow an attacker to execute malicious code on your computer if you open a specially crafted PDF file. This is a serious issue because it could be used to steal your data or take control of your computer. Update your Google Chrome browser to the latest version to fix this issue.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:11 | debian | chromium | All versions |
| Debian:12 | debian | chromium | All versions |
| Debian:13 | debian | chromium | All versions |
| Debian:14 | debian | chromium | All versions |
Original advisory text
Use after free in PDF in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted PDF file. (Chromium security severity: High)
Use after free in PDF in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted PDF file. (Chromium security severity: High)
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Type
CWE-416Use After Free
Timeline
Published28 May 2026
Updated3 Nov 2026
First seen29 May 2026
Track software like this
Free during beta