Introduction
A heap buffer overflow in Google Chrome's built-in PDF rendering engine allows a remote attacker to execute arbitrary code inside the browser sandbox on Windows systems. The attacker only needs a user to open a crafted PDF and perform certain UI gestures. Chrome holds roughly 69 percent of the global browser market, so CVE-2026-6361 exposes a significant attack surface, even though exploitation stays contained within the sandbox boundary.
Technical Information
The vulnerability is in PDFium, the PDF rendering engine embedded in Google Chrome. It is classified as CWE-122: Heap-based Buffer Overflow. A heap buffer overflow occurs when a program writes data beyond the boundaries of a dynamically allocated memory region on the heap. The extra data can corrupt adjacent memory structures such as heap metadata, object pointers, or vtable entries.
Root Cause
When PDFium processes a specially crafted PDF file, it writes more data to a heap-allocated buffer than the buffer was sized to hold. The specific code path and triggering condition are not public. Google restricts access to the Chromium issue tracker entry (Issue 500036290) until a majority of users have updated to the patched version.
Attack Flow
The exploitation chain has four steps:
-
Delivery: A remote attacker crafts a malicious PDF file designed to trigger the heap buffer overflow in PDFium. The attacker can deliver it as an email attachment, as a link to a web-hosted PDF, or by any other route that gets Chrome to render the document.
-
User Interaction: The target user opens the PDF in Google Chrome on a Windows system and then performs specific UI gestures. The exact gestures have not been disclosed, but they are required to trigger the overflow.
-
Memory Corruption: The crafted PDF causes PDFium to write beyond the allocated heap buffer and corrupt adjacent heap memory. Depending on the heap layout, this can overwrite function pointers, object metadata, or other control structures.
-
Code Execution: The attacker uses the corrupted memory state to redirect execution flow and run arbitrary code within the Chrome renderer process sandbox.
CVSS Vector Inconsistency
Security teams doing risk assessments should be aware of a conflict in the scoring. The CVSS 3.1 vector string provided by CISA ADP (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) lists User Interaction as None. The NVD's narrative description, by contrast, explicitly states that the attacker must convince a user to engage in specific UI gestures. We recommend treating user interaction as a required part of the attack chain, based on the primary vulnerability description.
Sandbox Containment
Successful exploitation gives the attacker arbitrary code execution, but only inside the Chrome sandbox. The CVSS score reflects this containment with a Changed Scope (S:C) designation, Low impact to both Confidentiality and Integrity, and no impact to Availability. Full system compromise would likely require chaining this vulnerability with a separate sandbox escape flaw. Even so, in-sandbox code execution gives an attacker meaningful capabilities, including reading renderer process memory and interacting with web content in the context of the compromised tab.
Affected Systems and Versions
The vulnerability affects the following configurations:
| Operating System | Vulnerable Versions | Patched Version |
|---|---|---|
| Windows | Google Chrome prior to 147.0.7727.101 | 147.0.7727.101 or 147.0.7727.102 |
| Mac | Google Chrome prior to 147.0.7727.101 | 147.0.7727.101 or 147.0.7727.102 |
| Linux | Google Chrome prior to 147.0.7727.101 | 147.0.7727.101 |
The description of CVE-2026-6361 explicitly names Chrome on Windows. The Mac and Linux stable channel updates released alongside this fix still contain other critical and high-severity patches, so deploy those promptly as well.
The fix is bundled with 30 other security patches in the April 15, 2026 stable channel update.
Vendor Security History
Google maintains one of the more mature vulnerability management programs in the industry. The Chromium security team works to find and fix security bugs and runs a Vulnerability Rewards Program to reward external researchers. The update that addresses CVE-2026-6361 includes 31 security fixes in total, which is typical of the high volume of continuous security maintenance on the Chromium codebase.
Google uses a coordinated disclosure process and keeps bug details private until fixes are widely distributed. Access to the issue tracker entry for this vulnerability (Issue 500036290) is still restricted, which prevents threat actors from reverse engineering the patch before organizations have time to deploy it.
Because Chrome holds approximately 69 percent of the global market, its vulnerabilities have an outsized security impact. The table below shows browser market share as of early 2026:
| Web Browser | Global Market Share (2026) |
|---|---|
| Google Chrome | ~69% |
| Safari | ~16% |
| Microsoft Edge | ~5% |
| Firefox | ~2% |
