Google Chrome: type confusion in PDFium (CVE-2026-121166)
CVE-2026-121166 has been published for PDFium, a component of Google Chrome. A remote attacker could execute arbitrary code inside the sandbox via a crafted PDF file. Chromium rates the severity as High, CVSS 8.8.
Checked in Shield: no
Who is affected
Google Chrome versions prior to 157.0.8103.38 are affected. Chromium corresponds to these versions. The risk relates to opening untrusted PDF files.
How to check
Check whether Chrome or Chromium is installed on your server (headless, rendering, screenshots) and whether it opens PDFs from others. Compare the version with 157.0.8103.38.
How to fix
A fix exists: version 157.0.8103.38. If you do not need the browser, remove it. If you do, avoid opening untrusted PDFs and install the update once your distribution (for example Debian) releases it.
What Shield checks not checked
Checked in Shield: no. This is usually not visible from outside, or the check has not been added yet; we collect such cases and add checks in batches.
Good to know
Whether the flaw is exploited in the wild is not disclosed yet. Source: NVD, CVE-2026-121166.
