CVE-2026-11307

HighCVSS 8.8/10Last modified Jul 23, 2026

Description

Use after free in PDFium in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted PDF file. (Chromium security severity: Low)

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-416

Affected software

VendorProductVersions
GoogleChrome>= 149.0.7827.53, < 149.0.7827.53

References

Timeline

Published
Jun 5, 2026
Last modified
Jul 23, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-1130706.5Use after free in GetUserMedia in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process toCVE-2026-1130718.8Use of insufficiently random values in Notifications in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to spooCVE-2026-1130729.6Use after free in CSS in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a cCVE-2026-1130738.8Incomplete cleanup in Browser in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTCVE-2026-1130748.8Incorrect authorization in Media in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker who had compromised the renCVE-2026-1130758.8Origin validation error in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypasCVE-2026-1130768.8Race condition in Toolbar in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bCVE-2026-1130776.5Incorrect authorization in Core in Google Chrome on on Mac prior to 156.0.8078.47 allowed a remote attacker who had compromised the rendererCVE-2026-1130789.6Race condition in Compositing in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to CVE-2026-1130798.8UI misrepresentation in SiteIsolation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer proCVE-2026-113086.3Inappropriate implementation in Extensions in Google Chrome prior to 149.0.7827.53 allowed an attacker who convinced a user to install a malCVE-2026-1130808.8UI misrepresentation in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to spoof address bar via a crafted
CVE-2026-11307: High severity, CVSS 8.8 | Vulnix