CVE-2026-11307 is a use-after-free vulnerability in the PDFium library used by Google Chrome. This vulnerability allows remote code execution inside the sandbox environment when a user opens a maliciously crafted PDF file. The flaw affects versions of Chrome prior to 149.0.7827.53. The CVSS v3.1 base score is 8.8, indicating high impact with network attack vector, low attack complexity, no privileges required, user interaction required, and high confidentiality, integrity, and availability impacts. Google has released a stable channel update to fix this vulnerability as referenced in their official advisory.

Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code within the sandboxed environment of Google Chrome by tricking a user into opening a crafted PDF file. This could lead to full compromise of the affected browser process, including confidentiality, integrity, and availability impacts. However, exploitation requires user interaction (opening the malicious PDF).

A fix is available in Google Chrome version 149.0.7827.53. Users and administrators should update to this version or later to remediate the vulnerability. Refer to the official Google Chrome stable channel update advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html for details and update instructions.