This vulnerability involves a use-after-free condition in the PDFium library used by Google Chrome before version 148.0.7778.216. Exploiting this flaw requires a user to open a specially crafted PDF file, which can trigger heap corruption. The CVSS score of 8.8 reflects a high-severity remote code execution risk with no privileges required but user interaction needed. The issue was publicly disclosed and patched by Google in the referenced stable channel update.

Successful exploitation can lead to remote code execution or other severe impacts such as full compromise of the affected system's confidentiality, integrity, and availability. The attacker must convince the user to open a malicious PDF file, which then triggers heap corruption via the use-after-free bug in PDFium. There are no reports of active exploitation in the wild at the time of disclosure.

Google has released an official fix in Chrome version 148.0.7778.216. Users and administrators should update to this version or later to remediate the vulnerability. Since this is a client-side vulnerability requiring user interaction, applying the update is the primary mitigation. No additional vendor-recommended mitigations or workarounds are indicated in the advisory.