Index

Search

Search the public record. Drafts and scheduled notes are not included.

news

Chrome PDF flaw CVE-2026-91737 runs code in the sandbox, PoC public

Chrome 153.0.8010.47 fixed CVE-2026-91737, a PDFium use-after-free that lets a crafted page run code inside the renderer sandbox. Chromium rates it High. NVD shows CVSS 3.1 8.8. The reporter published a PoC. A sandbox escape is needed for full compromise. Not in CISA KEV.

Published 5h ago

HighPoC Available

CVE-2026-91737

Chrome PDF use-after-free allows code execution in the sandbox

RCE

Published 15 Sept 2026