Use after free in PDFium in Google Chrome prior to 149

CVE-2026-11304 is a use-after-free bug in Chrome's embedded PDF renderer, PDFium. Affected builds are Google Chrome desktop versions prior to 149.0.7827.53 on Linux and prior to 149.0.7827.53/54 on Windows and macOS, and exploitation requires getting a user to open attacker-controlled PDF content in a vulnerable browser. The public description says the flaw may allow heap corruption via a crafted PDF file; it does not publicly claim a sandbox escape or guaranteed full host compromise.

The 8.8 HIGH score is a classic CVSS overstatement for browser bugs because it assumes worst-case impact once the bug triggers, but it ignores the real-world chain: user interaction, client-side reachability, Chrome sandboxing, and the lack of observed exploitation. More importantly, Google/Chrome itself labeled this issue with Chromium security severity: Low, which is a strong signal that the vendor does not view the public bug as an easy or high-value standalone enterprise break.

Why this verdict

• Downgrade for attacker position: the attacker is remote but must still convince a user to open a crafted PDF, which makes this a delivery problem, not a straight reachable service bug.
• Downgrade for real-world blast radius: successful exploitation most plausibly lands in a sandboxed browser process, not instant unconstrained host takeover.
• Downgrade for threat evidence: no KEV, no public exploitation, and a very low EPSS all argue against emergency-tier prioritization.
• Downgrade for vendor assessment: Chrome itself called the bug Low severity, while the 8.8 comes from scoring enrichment logic that predictably inflates browser memory-corruption cases.
• Hold at MEDIUM, not LOW: Chrome is ubiquitous, PDFs are common lures, and use-after-free bugs can become valuable when paired with a second-stage exploit chain.

Why not higher?

There is no public evidence that CVE-2026-11304 is being used in the wild, and the published record does not claim a sandbox escape. The enterprise damage path depends on multiple compounding prerequisites: user action, exploit reliability against a hardened browser, and likely a second-stage escape or follow-on objective.

Why not lower?

This is still a memory-corruption bug in an extremely common client application, and PDF workflows are normal enough that users will render attacker-controlled documents. Even when a standalone bug is not emergency-grade, the reachable population is large enough that it should not be treated as mere backlog trivia.

1. Force rapid browser auto-update — Validate that Chrome enterprise policies are allowing and enforcing stable-channel updates so endpoints move past 149.0.7827.53/54. For a MEDIUM verdict there is no mitigation SLA — go straight to the 365-day remediation window, but in practice browser updates should happen much faster because the operational cost is low.
2. Block risky PDF delivery paths — Use email gateway, secure web gateway, and chat/file-sharing controls to detonate, rewrite, or quarantine unsolicited PDFs from low-trust senders. This materially cuts the only practical first step in the chain and is the best compensating control until patch coverage is complete.
3. Harden browser-to-reader handling — Where business workflow allows it, open untrusted PDFs in a more controlled viewer path or remote browser/session isolation instead of directly inside user Chrome sessions. Apply this for high-risk user groups first while you finish patch rollout inside the 365-day remediation window.
4. Watch for browser crash clusters — Alert on abnormal spikes in chrome/chromium crashes involving PDF rendering, especially if they correlate with downloaded PDFs, phish campaigns, or child-process anomalies. Failed exploit attempts often show up as noisy browser instability before they show up as confirmed compromise.

Run this on the target host or via your software-distribution/EDR live response tooling. Invoke it as python3 check_chrome_cve_2026_11304.py with standard user rights; it attempts to auto-detect Chrome on Windows, macOS, and Linux and prints VULNERABLE, PATCHED, or UNKNOWN.

#!/usr/bin/env python3
# Check local Google Chrome version for CVE-2026-11304 exposure
# Exit codes:
#   0 = PATCHED
#   1 = VULNERABLE
#   2 = UNKNOWN / could not determine

import os
import platform
import re
import subprocess
import sys
from shutil import which

FIXED = (149, 0, 7827, 53)


def parse_version(text):
    if not text:
        return None
    m = re.search(r'(\d+)\.(\d+)\.(\d+)\.(\d+)', text)
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def run_cmd(cmd):
    try:
        p = subprocess.run(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, timeout=10)
        out = (p.stdout or '') + '\n' + (p.stderr or '')
        return out.strip()
    except Exception:
        return ''


def detect_windows():
    candidates = [
        [r'C:\Program Files\Google\Chrome\Application\chrome.exe', '--version'],
        [r'C:\Program Files (x86)\Google\Chrome\Application\chrome.exe', '--version'],
    ]
    local_appdata = os.environ.get('LOCALAPPDATA')
    if local_appdata:
        candidates.append([os.path.join(local_appdata, 'Google', 'Chrome', 'Application', 'chrome.exe'), '--version'])

    for cmd in candidates:
        if os.path.exists(cmd[0]):
            out = run_cmd(cmd)
            v = parse_version(out)
            if v:
                return v, cmd[0]

    ps = which('powershell') or which('pwsh')
    if ps:
        script = r"""
$paths = @(
  'HKLM:\Software\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe',
  'HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe',
  'HKCU:\Software\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe'
)
foreach ($p in $paths) {
  try {
    $item = Get-ItemProperty -Path $p -ErrorAction Stop
    if ($item.'(default)') { Write-Output $item.'(default)'; break }
  } catch {}
}
"""
        out = run_cmd([ps, '-NoProfile', '-Command', script])
        exe = out.strip().splitlines()[0] if out.strip() else ''
        if exe and os.path.exists(exe):
            ver = parse_version(run_cmd([exe, '--version']))
            if ver:
                return ver, exe

    return None, None


def detect_macos():
    paths = [
        '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome',
        os.path.expanduser('~/Applications/Google Chrome.app/Contents/MacOS/Google Chrome'),
    ]
    for p in paths:
        if os.path.exists(p):
            out = run_cmd([p, '--version'])
            v = parse_version(out)
            if v:
                return v, p
    return None, None


def detect_linux():
    names = ['google-chrome', 'google-chrome-stable', 'chromium', 'chromium-browser']
    for name in names:
        exe = which(name)
        if exe:
            out = run_cmd([exe, '--version'])
            v = parse_version(out)
            if v:
                return v, exe

    extra_paths = [
        '/opt/google/chrome/chrome',
        '/usr/bin/google-chrome',
        '/usr/bin/google-chrome-stable',
        '/snap/bin/chromium',
    ]
    for p in extra_paths:
        if os.path.exists(p):
            out = run_cmd([p, '--version'])
            v = parse_version(out)
            if v:
                return v, p

    return None, None


def compare_versions(found, fixed):
    if found < fixed:
        return -1
    if found > fixed:
        return 1
    return 0


def main():
    system = platform.system().lower()
    if 'windows' in system:
        version, source = detect_windows()
    elif 'darwin' in system:
        version, source = detect_macos()
    else:
        version, source = detect_linux()

    if not version:
        print('UNKNOWN: could not determine local Chrome/Chromium version')
        sys.exit(2)

    print(f'DETECTED: {source} -> {".".join(map(str, version))}')
    cmp = compare_versions(version, FIXED)
    if cmp < 0:
        print('VULNERABLE')
        sys.exit(1)
    else:
        print('PATCHED')
        sys.exit(0)


if __name__ == '__main__':
    main()

Sources

1. NVD entry for CVE-2026-11304
2. Chrome Releases stable channel update for desktop (June 2, 2026)
3. Chromium issue 504418475
4. Canadian Centre for Cyber Security advisory AV26-544
5. GovCERT.HK alert A26-06-08
6. CISA Known Exploited Vulnerabilities Catalog
7. FIRST EPSS overview