Use after free in PDFium in Google Chrome prior to 149

CVE-2026-11303 is a CWE-416 use-after-free in Chrome's PDFium renderer. Affected builds are Chrome prior to 149.0.7827.53 on Linux and prior to 149.0.7827.53/54 on Windows and macOS, with the June 2, 2026 stable release carrying the fix. The bug is triggered by a crafted PDF and can yield code execution in the browser's sandboxed renderer process.

The raw CVSS 8.8 overstates enterprise urgency if you read it like 'host compromise from the internet.' The decisive reality check is that execution is explicitly *inside the sandbox*, exploitation needs user interaction with attacker-supplied content, there is no KEV listing, no public in-the-wild signal, and EPSS is extremely low; that pushes this down from emergency patching into routine-but-real browser hygiene.

Why this verdict

• Start at 8.8, then subtract hard for sandbox confinement: the stated impact is arbitrary code execution *inside a sandbox*, which materially narrows blast radius versus true browser-to-host RCE.
• Subtract for user interaction: the attacker still needs a user to open or render a crafted PDF, so this is not an unauthenticated server-side smash-and-grab path.
• Subtract for threat intel reality: no KEV listing, no public PoC found, and EPSS 0.0008 all argue against rapid mass exploitation pressure right now.

Why not higher?

It is not HIGH or CRITICAL because the exploit chain, as disclosed, stops at sandboxed renderer execution. To become enterprise-disruptive at scale, an attacker usually needs a second vulnerability, a very specific browser-session objective, or a separate post-exploitation path that is not included in this CVE.

Why not lower?

It is not LOW or IGNORE because Chrome is ubiquitous across enterprise fleets and PDF handling is routine user behavior. Even sandboxed browser code execution can still support phishing bypass, session abuse, or follow-on exploitation, so this deserves scheduled remediation rather than documentation-only treatment.

1. Verify browser auto-update health — Make sure managed endpoints are actually receiving Chrome stable updates and not pinned behind broken update channels or stale ring policies. For a MEDIUM verdict there is no mitigation SLA; use normal operations and go straight to the remediation window while confirming that stragglers are visible.
2. Restrict inline PDF handling for high-risk users — For admins, executives, developers with prod access, and internet-facing support staff, consider forcing PDF download/open in a hardened reader or isolated browser session instead of inline rendering. This is a selective risk-reduction move, not a fleet-wide emergency control, and should be deployed during normal control windows because there is no noisgate mitigation deadline for MEDIUM.
3. Lean on browser isolation where already deployed — If your stack already includes remote browser isolation or detonation for web/email-delivered documents, route suspicious PDFs through it. This helps most at the lure and render stages without needing disruptive endpoint changes.
4. Watch for renderer crashes and odd Chrome child processes — Hunt for spikes in Chrome crash telemetry, browser-instigated download chains, or chrome.exe/Google Chrome spawning unusual children. This won't prevent the bug, but it can catch attempted exploitation and follow-on activity while patch coverage converges.

Run this on the target endpoint or via your endpoint-management agent, not from an auditor workstation. Invoke with python3 check_chrome_cve_2026_11303.py on Linux/macOS or py check_chrome_cve_2026_11303.py on Windows; standard user rights are usually enough because it only reads installed version metadata and common executable paths.

#!/usr/bin/env python3
# Check Google Chrome / Chromium family version against CVE-2026-11303 patch floor.
# Outputs exactly one of: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import os
import platform
import re
import shutil
import subprocess
import sys

PATCH_FLOOR = (149, 0, 7827, 53)


def parse_version(text):
    if not text:
        return None
    m = re.search(r'(\d+)\.(\d+)\.(\d+)\.(\d+)', text)
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def run_version_cmd(path):
    try:
        cp = subprocess.run([path, '--version'], capture_output=True, text=True, timeout=5)
        out = (cp.stdout or '') + ' ' + (cp.stderr or '')
        return parse_version(out)
    except Exception:
        return None


def detect_windows():
    versions = []
    # Registry beacon first
    try:
        import winreg
        reg_paths = [
            (winreg.HKEY_CURRENT_USER, r'Software\Google\Chrome\BLBeacon'),
            (winreg.HKEY_LOCAL_MACHINE, r'SOFTWARE\Google\Chrome\BLBeacon'),
            (winreg.HKEY_LOCAL_MACHINE, r'SOFTWARE\WOW6432Node\Google\Chrome\BLBeacon'),
        ]
        for hive, key in reg_paths:
            try:
                with winreg.OpenKey(hive, key) as k:
                    val, _ = winreg.QueryValueEx(k, 'version')
                    v = parse_version(str(val))
                    if v:
                        versions.append(('registry', v))
            except OSError:
                pass
    except Exception:
        pass

    # Executable fallback
    env_paths = [
        os.path.join(os.environ.get('ProgramFiles', r'C:\Program Files'), 'Google', 'Chrome', 'Application', 'chrome.exe'),
        os.path.join(os.environ.get('ProgramFiles(x86)', r'C:\Program Files (x86)'), 'Google', 'Chrome', 'Application', 'chrome.exe'),
        os.path.join(os.environ.get('LocalAppData', ''), 'Google', 'Chrome', 'Application', 'chrome.exe'),
    ]
    for p in env_paths:
        if p and os.path.exists(p):
            v = run_version_cmd(p)
            if v:
                versions.append((p, v))

    return versions


def detect_macos():
    versions = []
    candidates = [
        '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome',
        os.path.expanduser('~/Applications/Google Chrome.app/Contents/MacOS/Google Chrome'),
        '/Applications/Chromium.app/Contents/MacOS/Chromium',
    ]
    for p in candidates:
        if os.path.exists(p):
            v = run_version_cmd(p)
            if v:
                versions.append((p, v))
    return versions


def detect_linux():
    versions = []
    commands = ['google-chrome', 'google-chrome-stable', 'chromium-browser', 'chromium', 'chrome']
    for cmd in commands:
        path = shutil.which(cmd)
        if path:
            v = run_version_cmd(path)
            if v:
                versions.append((path, v))
    return versions


def main():
    system = platform.system().lower()
    if 'windows' in system:
        found = detect_windows()
    elif 'darwin' in system:
        found = detect_macos()
    else:
        found = detect_linux()

    if not found:
        print('UNKNOWN')
        sys.exit(2)

    # Use the highest discovered version if multiple channels/installs exist.
    highest = max(v for _, v in found)

    if highest >= PATCH_FLOOR:
        print('PATCHED')
        sys.exit(0)
    else:
        print('VULNERABLE')
        sys.exit(1)


if __name__ == '__main__':
    main()

Sources

1. Chrome Releases: Stable Channel Update for Desktop (June 2, 2026)
2. Chromium issue 504416752
3. Chromium Security page
4. CISA Known Exploited Vulnerabilities Catalog
5. FIRST EPSS data and statistics
6. FIRST EPSS API documentation
7. Chromium source tag diff for 149.0.7827.59 patch line
8. Chrome Enterprise previous release notes