This vulnerability is a heap buffer overflow (CWE-122) in the PDFium library used by Google Chrome on Windows platforms before version 147.0.7727.101. Exploitation requires user interaction through specific UI gestures on a maliciously crafted PDF, enabling remote code execution inside the sandbox environment. The CVSS 3.1 base score is 8.3, reflecting network attack vector, high complexity, no privileges required, user interaction needed, and high impact on confidentiality, integrity, and availability. The issue was publicly disclosed on April 15, 2026, with a vendor advisory linked to a stable channel update.

Successful exploitation can lead to arbitrary code execution within the sandboxed environment of Chrome on Windows, potentially compromising confidentiality, integrity, and availability of the affected system. The attack requires user interaction and a crafted PDF file. There are no reports of active exploitation in the wild at the time of disclosure.

Google has released a stable channel update for Chrome that addresses this vulnerability. Users should update to version 147.0.7727.101 or later to remediate this issue. Patch status is not explicitly confirmed in the advisory text provided, so users should verify update installation via official Chrome update channels. No additional mitigation steps are indicated by the vendor advisory.