CVE-2026-121113: Buffer overflow in PDFium
Published Sep 28, 2026
·Updated
Buffer overflow in PDFium in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted PDF file. (Chromium security severity: High)
Credit
Xinyang Ge (Anthropic), assisted by Claude
Affected Software
6 affected componentsFixes available
Google Chrome<157.0.8103.38
157.0.8103.38
debian/chromium*
debian/chromium*
debian/chromium*
debian/chromium<=150.0.7871.100-1~deb12u1, <=156.0.8078.79-1~deb12u1, <=150.0.7871.181-1~deb13u1, <=156.0.8078.79-1~deb13u1, <=156.0.8078.47-1, <=156.0.8078.79-1
Google Chrome<157.0.8103.38
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 157.0.8103.38
Event History
Sep 28, 2026
CVE Published
12:00 AM
Data Sourced
12:00 AM
SeverityWeaknessAffected Software
Nov 3, 2026
CVE Published
via MITRE·08:42 PM
Data Sourced
via MITRE·08:42 PM
DescriptionWeakness
Data Sourced
via NVD·09:17 PM
DescriptionWeakness
Data Sourced
via NVD·09:17 PM
SeverityAffected Software
Data Sourced
via OSV·09:17 PM
DescriptionAffected Software
Peer vulnerabilities
Found alongside the following vulnerabilities.
- CVE-2026-121156
- CVE-2026-121229
- CVE-2026-121246
- CVE-2026-121035
- CVE-2026-121247
- CVE-2026-121203
- CVE-2026-121126
- CVE-2026-121107
- CVE-2026-121197
- CVE-2026-121112
- CVE-2026-121174
- CVE-2026-121098
- CVE-2026-121074
- CVE-2026-121173
- CVE-2026-121233
- CVE-2026-121140
- CVE-2026-121095
- CVE-2026-121071
- CVE-2026-121207
- CVE-2026-121185
- CVE-2026-121166
- CVE-2026-121047
- CVE-2026-121124
- CVE-2026-121118
- CVE-2026-121188
- CVE-2026-121082
- CVE-2026-121083
- CVE-2026-121179
- CVE-2026-121180
- CVE-2026-121181
- CVE-2026-121228
- CVE-2026-121080
- CVE-2026-121044
- CVE-2026-121051
- CVE-2026-121038
- CVE-2026-121090
- CVE-2026-121052
- CVE-2026-121037
- CVE-2026-121086
- CVE-2026-121131
- CVE-2026-121087
- CVE-2026-121178
- CVE-2026-121100
- CVE-2026-121148
- CVE-2026-121089
- CVE-2026-121250
- CVE-2026-121032
- CVE-2026-121114
- CVE-2026-121127
- CVE-2026-121210
- CVE-2026-121057
- CVE-2026-121201
- CVE-2026-121084
- CVE-2026-121094
- CVE-2026-121079
- CVE-2026-121143
- CVE-2026-121097
- CVE-2026-121214
- CVE-2026-121133
- CVE-2026-121249
- CVE-2026-121213
- CVE-2026-121241
- CVE-2026-121224
- CVE-2026-121117
- CVE-2026-121123
- CVE-2026-121182
- CVE-2026-121061
- CVE-2026-121227
- CVE-2026-121226
- CVE-2026-121068
- CVE-2026-121137
- CVE-2026-121160
- CVE-2026-121036
- CVE-2026-121104
- CVE-2026-121034
- CVE-2026-121208
- CVE-2026-121129
- CVE-2026-121211
- CVE-2026-121078
- CVE-2026-121060
- CVE-2026-121076
- CVE-2026-121221
- CVE-2026-121119
- CVE-2026-121244
- CVE-2026-121242
- CVE-2026-121105
- CVE-2026-121237
- CVE-2026-121102
- CVE-2026-121120
- CVE-2026-121161
- CVE-2026-121062
- CVE-2026-121031
- CVE-2026-121063
- CVE-2026-121108
- CVE-2026-121199
- CVE-2026-121099
- CVE-2026-121196
- CVE-2026-121066
- CVE-2026-121256
- CVE-2026-121115
- CVE-2026-121234
- CVE-2026-121177
- CVE-2026-121193
- CVE-2026-121248
- CVE-2026-121106
- CVE-2026-121200
- CVE-2026-121039
- CVE-2026-121122
- CVE-2026-121219
- CVE-2026-121255
- CVE-2026-121231
- CVE-2026-121183
- CVE-2026-121072
- CVE-2026-121103
- CVE-2026-121136
- CVE-2026-121040
- CVE-2026-121030
- CVE-2026-121075
- CVE-2026-121220
- CVE-2026-121170
- CVE-2026-121059
- CVE-2026-121163
- CVE-2026-121088
- CVE-2026-121033
- CVE-2026-121254
- CVE-2026-121065
- CVE-2026-121171
- CVE-2026-121116
- CVE-2026-121239
- CVE-2026-121187
- CVE-2026-121132
- CVE-2026-121067
- CVE-2026-121096
- CVE-2026-121184
- CVE-2026-121215
- CVE-2026-121212
- CVE-2026-121194
- CVE-2026-121202
- CVE-2026-121048
- CVE-2026-121070
- CVE-2026-121257
- CVE-2026-121218
- CVE-2026-121164
- CVE-2026-121223
- CVE-2026-121186
- CVE-2026-121176
- CVE-2026-121128
- CVE-2026-121216
- CVE-2026-121158
- CVE-2026-121110
- CVE-2026-121042
- CVE-2026-121238
- CVE-2026-121077
- CVE-2026-121245
- CVE-2026-121049
- CVE-2026-121091
- CVE-2026-121167
- CVE-2026-121135
- CVE-2026-121209
- CVE-2026-121134
- CVE-2026-121217
- CVE-2026-121109
- CVE-2026-121243
- CVE-2026-121053
- CVE-2026-121190
- CVE-2026-121125
- CVE-2026-121046
- CVE-2026-121222
- CVE-2026-121157
- CVE-2026-121235
- CVE-2026-121252
- CVE-2026-121168
- CVE-2026-121043
- CVE-2026-121111
- CVE-2026-121138
- CVE-2026-121055
- CVE-2026-121101
- CVE-2026-121236
- CVE-2026-121165
- CVE-2026-121253
- CVE-2026-121172
- CVE-2026-121206
- CVE-2026-121189
- CVE-2026-121121
- CVE-2026-121130
- CVE-2026-121251
- CVE-2026-121085
- CVE-2026-121159
- CVE-2026-121204
- CVE-2026-121205
- CVE-2026-121050
- CVE-2026-121081
- CVE-2026-121240
- CVE-2026-121198
- CVE-2026-121225
- CVE-2026-121162
- CVE-2026-121045
- CVE-2026-121029
- CVE-2026-121054
- CVE-2026-121175
- CVE-2026-121092
- CVE-2026-121073
- CVE-2026-121230
- CVE-2026-121093
- CVE-2026-121041
- CVE-2026-121232
- CVE-2026-121142
- CVE-2026-121069
- CVE-2026-121169
- CVE-2026-121064
- CVE-2026-121195
- CVE-2026-121141
Frequently Asked Questions
1
Does exploitation require an authenticated account or other privileges?
No privileges are required. The CVSS vector indicates that exploitation is network-accessible with low attack complexity, but requires user interaction.
2
Which affected product has a stated fixed version?
Google Chrome versions prior to 157.0.8103.38 are affected. Debian Chromium is listed as affected, but the provided data does not state a corresponding fixed Debian package version.