cve-2026-11670

CVE-2026-11670 is a high-severity use-after-free vulnerability in Chrome's built-in PDF handling, patched by Google on June 8, 2026, in Chrome desktop Stable channel update 149.0.7827.102/.103 for Windows and Mac and 149.0.7827.102 for Linux. The flaw allowed remote code execution inside Chrome's sandbox when a user opened a crafted PDF file. While the sandbox limits exploitation, the risk is significant because modern browsers serve as document viewers, identity brokers, password vaults, and app runtimes, making them critical client software. WindowsForum.com discussions cover the patch details, affected platforms, and the broader security implications for enterprise environments relying on Chrome.