CVE-2026-11303 is a use-after-free vulnerability in the PDFium library used by Google Chrome. The issue allows remote code execution inside the sandbox environment when a user opens a specially crafted PDF file. The vulnerability affects Chrome versions prior to 149.0.7827.53. The CVSS 3.1 base score is 8.8, indicating high impact with network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and high confidentiality, integrity, and availability impacts. No known exploits in the wild have been reported. The vendor advisory linked indicates a stable channel update addressing this issue.

Successful exploitation allows remote attackers to execute arbitrary code within the sandboxed environment of Chrome by tricking users into opening a malicious PDF file. This can lead to full compromise of the affected browser process, impacting confidentiality, integrity, and availability of the system running the browser.

A fix is available in Google Chrome version 149.0.7827.53. Users and administrators should update to this version or later to remediate the vulnerability. Refer to the official Google Chrome stable channel update advisory for confirmation and update instructions: https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html