CVE-2026-93381

CVE-2026-93381 is a buffer overflow (CWE-122) in the PDFium PDF rendering engine of Google Chrome on Windows. To trigger it, an attacker must use social engineering to convince a user to open a specially crafted PDF file, which causes the overflow in Chrome's PDF renderer. Successful exploitation could allow a remote attacker to execute arbitrary code, though only inside Chrome's sandbox, which constrains the impact of the compromise. All Chrome users on Windows running versions prior to 153.0.8010.52 are affected; users on other operating systems are not impacted by this specific flaw. There is currently no CVSS score, no entry in the CISA KEV catalog, no known public proof-of-concept, and no confirmed exploitation in the wild, and the fix shipped in Chrome 153.0.8010.52 alongside roughly 15 other security fixes, including two rated critical.

What to do: Update Google Chrome on Windows to 153.0.8010.52 or later (Help > About Google Chrome, or enforce via endpoint management) and verify deployed versions with your fleet inventory tools. Until patched, caution users against opening PDFs from untrusted or unexpected sources, since exploitation depends on social engineering. Prioritize the update, as the same Chrome 153 release also addresses two critical vulnerabilities.