CVE-2026-6361
Heap Buffer Overflow in PDFium Enables Remote Code Execution
Publication date: 2026-04-15
Last updated on: 2026-04-29
Assigner: Chrome
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| chrome | to 147.0.7727.101 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-122 | A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc(). |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a heap buffer overflow in PDFium, a component used by Google Chrome on Windows versions prior to 147.0.7727.101. It allows a remote attacker to execute arbitrary code inside a sandbox if they convince a user to perform specific user interface gestures while opening a specially crafted PDF file.
How can this vulnerability impact me? :
The vulnerability can lead to remote code execution within the sandbox environment of Google Chrome. This means an attacker could potentially run malicious code on your system without your permission if you open a crafted PDF file and perform certain UI actions. Although the code execution is sandboxed, it still poses a significant security risk.