This vulnerability is a use-after-free issue in Google Chrome's PDF handling code prior to version 146.0.7680.178. Exploiting this flaw enables remote code execution inside the sandbox environment by processing a malicious PDF file. The CVSS vector indicates the attack can be performed remotely without privileges, requires user interaction, and impacts confidentiality, integrity, and availability with high severity. The vulnerability was publicly disclosed on April 1, 2026, and is assigned CVE-2026-5287.

Successful exploitation allows a remote attacker to execute arbitrary code within the sandboxed environment of Google Chrome, potentially compromising the confidentiality, integrity, and availability of the affected system. The attack requires the victim to open a crafted PDF file. There are no reports of active exploitation in the wild at the time of disclosure.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability affects versions prior to 146.0.7680.178, updating Google Chrome to version 146.0.7680.178 or later is the likely remediation once confirmed by the vendor. Until then, users should exercise caution when opening PDF files from untrusted sources.