Loading vulnerability…
Sandboxed Code Execution via PDF Use-After-Free in Google Chrome
CVE-2026-91737 is a high-severity use-after-free vulnerability in the PDF component of Google Chrome before version 153.0.8010.47. A remote attacker can trigger the vulnerability through a crafted HTML page and execute arbitrary code inside the browser sandbox. The flaw also affects Chromium-derived browsers, including Microsoft Edge and Prisma Browser. The specific vulnerable function and detailed object-lifetime failure are not publicly specified.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation permits arbitrary code execution within the affected browser's sandboxed execution context, potentially compromising the confidentiality, integrity, and availability of resources accessible to that context. This vulnerability alone does not establish sandbox escape, operating-system privilege escalation, or unrestricted host compromise.
If you can’t patch tonight, do this now.
No vulnerability-specific workaround is identified. Until updates are deployed, restrict use of affected browsers for untrusted or attacker-controlled web content and use browser isolation where available. Retain browser sandboxing and least-privilege controls; these measures reduce exposure or consequences but do not correct the use-after-free.
Patch, then assume compromise.
Update Google Chrome to 153.0.8010.47 or later on Windows and Linux, and 153.0.8010.48 or later on macOS, then relaunch the browser to activate the update. Update Microsoft Edge to 153.0.4234.46 or later. For Debian stable (trixie), install Chromium 153.0.8010.47-2~deb13u1 or later. For the listed Fedora and EPEL releases, install the applicable distribution build of Chromium 153.0.8010.52 or later and log out and back in. Prisma Browser 153.3.4.48 includes the fix for this CVE; version 155.16.5.40 or later addresses the complete October Chromium security update.
No validated public exploits yet. Hidden: 1 rejected by Mallory's analysis as not a working exploit.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.