{"id":"CVE-2026-126901","kind":"vulnerability","aliases":["CVE-2026-126901"],"related":[],"title":"Google Chrome: PDF use-after-free lets a crafted web page run code","description":"Use after free in PDF in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","summary":"A use-after-free bug in the PDF component of Google Chrome, before version 157.0.8103.78, lets a remote attacker run code inside the browser sandbox through a crafted HTML page. The sources rate it High severity in Chromium.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["browser","chrome","desktop","vendor"],"not_affected_if":["chrome-updated"],"how_to_check":"- Open Chrome and check the version under Settings > About Chrome, or run `chrome --version` on the command line.\n- Confirm the version is at or above `157.0.8103.78`.","fix":"- Google Chrome: move to `157.0.8103.78` or later.","status":"open","published_at":"2026-11-11T23:17:19+00:00","first_seen_at":"2026-11-11T23:29:39+00:00","triaged_at":"2026-11-11T23:31:49+00:00","updated_at":"2026-11-11T23:31:49+00:00","category":"vendor","confidence":0.8,"triage":{"at":"2026-11-11T23:31:49Z","model":"claude-haiku-5-5","output":{"fix":"- Google Chrome: move to `157.0.8103.78` or later.","reach":"internet","title":"Google Chrome: PDF use-after-free lets a crafted web page run code","impact":"high","summary":"A use-after-free bug in the PDF component of Google Chrome, before version 157.0.8103.78, lets a remote attacker run code inside the browser sandbox through a crafted HTML page. The sources rate it High severity in Chromium.","audience":"everyone","category":"vendor","nicknames":[],"who_cares":["chrome","desktop","browser"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"Attacker runs code inside the browser sandbox after a victim visits a page","analyst_note":"","how_to_check":"- Open Chrome and check the version under Settings > About Chrome, or run `chrome --version` on the command line.\n- Confirm the version is at or above `157.0.8103.78`.","plain_action":"Update Google Chrome to version 157.0.8103.78 or later: Menu > Help > About Google Chrome.","product_name":"","needs_analyst":false,"not_affected_if":["chrome-updated"],"who_is_affected":"Anyone running Google Chrome before 157.0.8103.78 who opens a malicious web page, including PDF content embedded in one. Users who keep Chrome auto-updated are likely already patched. Systems that do not run Chrome are not affected by this entry.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000718,"input_tokens":4529,"output_tokens":531,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-126901':17A,20A '-2026':16A,19A '157.0.8103.78':40B,74C 'allow':75C 'arbitrari':81C 'attack':44B,78C 'browser':21B,49B 'bug':30B 'chrome':2A,22B,37B,71C 'chromium':63B,91C 'code':14A,46B,82C 'compon':34B 'craft':10A,53B,88C 'cve':15A,18A 'desktop':23B 'execut':80C 'free':7A,29B,66C 'googl':1A,36B,70C 'high':60B,94C 'html':54B,89C 'insid':47B,83C 'let':8A,41B 'page':12A,55B,90C 'pdf':3A,33B,68C 'prior':72C 'rate':58B 'remot':43B,77C 'run':13A,45B 'sandbox':50B,85C 'secur':92C 'sever':61B,93C 'sourc':57B 'use':5A,27B,64C 'use-after-fre':4A,26B 'vendor':24B 'version':39B 'via':86C 'web':11A","nicknames":[],"mitigations":[],"who_affected":"Anyone running Google Chrome before 157.0.8103.78 who opens a malicious web page, including PDF content embedded in one. Users who keep Chrome auto-updated are likely already patched. Systems that do not run Chrome are not affected by this entry.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"everyone","plain_action":"Update Google Chrome to version 157.0.8103.78 or later: Menu > Help > About Google Chrome.","pkeys":[],"ptokens":[],"labels":["browser","chrome","desktop","high","vendor"],"campaign_type":null,"search_a":"'-126901':17A,20A '-2026':16A,19A 'chrome':2A 'code':14A 'craft':10A 'cve':15A,18A 'free':7A 'googl':1A 'let':8A 'page':12A 'pdf':3A 'run':13A 'use':5A 'use-after-fre':4A 'web':11A","search_b":"'157.0.8103.78':40B 'attack':44B 'browser':21B,49B 'bug':30B 'chrome':22B,37B 'chromium':63B 'code':46B 'compon':34B 'craft':53B 'desktop':23B 'free':29B 'googl':36B 'high':60B 'html':54B 'insid':47B 'let':41B 'page':55B 'pdf':33B 'rate':58B 'remot':43B 'run':45B 'sandbox':50B 'sever':61B 'sourc':57B 'use':27B 'use-after-fre':26B 'vendor':24B 'version':39B","search_c":"'157.0.8103.78':74C 'allow':75C 'arbitrari':81C 'attack':78C 'chrome':71C 'chromium':91C 'code':82C 'craft':88C 'execut':80C 'free':66C 'googl':70C 'high':94C 'html':89C 'insid':83C 'page':90C 'pdf':68C 'prior':72C 'remot':77C 'sandbox':85C 'secur':92C 'sever':93C 'use':64C 'via':86C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T23:17:19+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126901","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126901","severity":null,"published_at":"2026-11-11T23:17:19+00:00","modified_at":"2026-11-11T23:17:19+00:00","first_seen_at":"2026-11-11T23:29:39+00:00","fetched_at":"2026-11-11T23:29:39+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}