This vulnerability involves an integer overflow in PDFium, a PDF rendering engine used by Google Chrome. Specifically, it affects Chrome versions before 148.0.7778.216. An attacker who has compromised the renderer process can leverage a crafted font file to execute arbitrary code inside the sandbox environment. The CVSS vector indicates the attack requires network access, high attack complexity, no privileges, user interaction, and results in high confidentiality, integrity, and availability impact.

Successful exploitation allows arbitrary code execution within the sandboxed renderer process, potentially leading to further compromise of the affected system. The vulnerability impacts confidentiality, integrity, and availability at a high level. However, exploitation requires prior compromise of the renderer process and user interaction.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html for current remediation guidance. Until official fixes are confirmed and applied, users should exercise caution with untrusted PDF files and font content. No explicit vendor advisory states that the issue is already mitigated or that no action is required.