CVE-2026-121166

Awaiting Analysis Awaiting Analysis - Queue

Type Confusion in PDFium in Google Chrome

Publication date: 2026-11-03

Last updated on: 2026-11-03

Assigner: Chrome

Description

Type confusion in PDFium in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted PDF file. (Chromium security severity: High)

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-11-03

Last Modified

2026-11-03

Generated

2026-11-04

AI Q&A

2026-11-04

EPSS Evaluated

N/A

NVD

CVE-2026-121166

EUVD

EUVD-2026-116518

Affected Vendors & Products

Vendor	Product	Version / Range
Google	Chrome	157.0.8103.38

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-843	The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.

Attack-Flow Graph

Executive Summary

This vulnerability is a type confusion issue in PDFium, which is the PDF rendering engine used by Google Chrome. A type confusion flaw occurs when a program accesses a variable or object in a way that is inconsistent with its intended type, potentially leading to unexpected behavior. In this case, the issue allowed a remote attacker to execute arbitrary code within the Chrome sandbox by tricking a user into opening a specially crafted PDF file.

Impact Analysis

If you are using a vulnerable version of Google Chrome, an attacker could exploit this flaw to run malicious code on your system by convincing you to open a malicious PDF file. Since the code runs inside the Chrome sandbox, it may be limited in what it can do, but it could still allow the attacker to steal data, install malware, or perform other unauthorized actions on your device.

Mitigation Strategies

Update Google Chrome to version 157.0.8103.38 or later to address the vulnerability.

Hi! I’m here to help you understand CVE-2026-121166. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...