This vulnerability involves a use-after-free error in the PDFium library used by Google Chrome before version 148.0.7778.216. Exploitation could lead to heap corruption triggered by a specially crafted PDF file. The Chromium project rates this vulnerability as high severity. The issue was publicly disclosed on May 28, 2026, and a stable channel update was announced by Google. No CVSS score is assigned, and no known active exploitation has been reported.

Successful exploitation of this vulnerability could result in heap corruption, potentially allowing an attacker to execute arbitrary code or cause a denial of service within the context of the affected Chrome browser. The impact is considered high severity by the Chromium security team. No known exploits in the wild have been documented at this time.

Users should apply the stable channel update to Google Chrome version 148.0.7778.216 or later as indicated in the vendor advisory (https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html). Patch status is not explicitly confirmed in the provided data, so users must verify the update status via the vendor advisory. No additional mitigation steps are specified by the vendor.