CVE-2026-91737
Chrome PDF use-after-free allows code execution in the sandbox
CVE-2026-91737 is a use-after-free in Chrome's PDF component (PDFium) before 153.0.8010.47. A crafted HTML page can run code inside the renderer sandbox. Chromium rates it High. NVD shows CVSS 3.1 8.8 (scored by CISA-ADP). Fixed on 15 September 2026. Reporter PoC public. Not in CISA KEV.
- CVSS
- 8.8
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- Class
- RCE
- Status
- PoC Available
- KEV
- Not in CISA KEV
- 0-day
- No
- Vendor
- Products
- Google Chrome
- Affected
- Google Chrome on Windows, macOS and Linux before 153.0.8010.47. Other Chromium based browsers inherit the flaw until they ship the upstream fix.
- Fixed
- Chrome 153.0.8010.47 (Linux) and 153.0.8010.47/.48 (Windows and macOS), released in the stable channel on 15 September 2026.
- CWE
- CWE-416
- Published
- 15 Sept 2026
- Updated
- 15 Oct 2026
The status above is the claim. Links do not upgrade it.
CVE-2026-91737 is a use-after-free (CWE-416) in the PDF component of Google Chrome. Chrome's PDF viewer is built on PDFium. A remote attacker could run code inside the sandbox through a crafted HTML page.
Google fixed it in the stable channel update of 15 September 2026. Fixed builds are 153.0.8010.47 for Linux and 153.0.8010.47/.48 for Windows and macOS. Chromium rates it High.
NVD shows CVSS 3.1 8.8, from the CISA ADP entry. Google did not publish its own CVSS score. NVD marks the record Analyzed. User interaction is required.
This is code execution inside the renderer sandbox only. A separate sandbox escape would be needed for full compromise of the device. Google does not say one was chained with this bug.
Google credits SeungMyung Lee (@sm1ee) and Siung kim (@ksw9722). Their bounty is listed as TBD. The same update fixed 42 security issues.
The CVE is not in the CISA KEV catalog. CISA's SSVC entry records exploitation as none. Google reports no exploitation of this bug.
The credited reporter, SeungMyung Lee (sm1ee), published a GitHub repository on 12 October 2026. It claims a renderer code execution PoC for this CVE. ThreatWire did not run or verify it. The PoC link field points to it; the URL is not repeated here.