CVE-2026-87585: Double Free
Chromium CVE-2026-87585: Double free in PDFium
Other sources
Double free in PDFium in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted PDF file. (Chromium security severity: High)
— NVD
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 153.0.4234.32 - Upgrade
Upgrade
Chromium (Google Chrome/Edge Chromium-based)to a version that resolves this vulnerability.Fixed in 153.0.8010.36 - Compensating control
Treat untrusted PDFs as hostile: restrict or sandbox PDF rendering/preview features, since exploitation requires a crafted PDF file to trigger the PDFium double free.
Event History
Frequently Asked Questions
Which systems are affected?
The issue affects Google Chrome on Windows before version 153.0.8010.36. The vulnerable component is PDFium.
What does an attacker need to exploit this?
An attacker would need to get a user to process a crafted PDF file in the affected Chrome environment. Successful exploitation could potentially execute arbitrary code inside Chrome's sandbox.
Is code execution outside the browser sandbox described?
No. The available information describes potential arbitrary code execution inside the sandbox only.