This vulnerability involves a use-after-free condition in the PDFium library used by Google Chrome. Specifically, versions prior to 149.0.7827.53 are affected. Exploitation requires a crafted PDF file that could trigger heap corruption, potentially leading to arbitrary code execution or browser instability. The Chromium security team rates the severity as low. The issue was publicly disclosed on June 4, 2026, and a stable channel update including the fix was released by Google. No CVSS score is assigned, and no known active exploitation has been reported.

Successful exploitation could lead to heap corruption within the Chrome process handling PDF files. This may result in denial of service or potentially limited code execution within the browser context. However, the low severity rating suggests the impact is limited or exploitation complexity is high. No known active exploitation in the wild reduces immediate risk.

A fixed version of Google Chrome (149.0.7827.53) has been released by Google to address this vulnerability. Users and administrators should update affected Chrome installations to this version or later to remediate the issue. No additional mitigation steps are indicated by the vendor advisory.