CVE-2018-20072 is an insufficient data validation flaw in the PDF component of Google Chrome before 73.0.3683.75. NVD scores it 7.8 High, while Chromium rates it Low. Update Chrome to 73.0.3683.75 or any later release, and check managed machines that delay browser updates.
What's affected
- Product: Google Chrome (PDF component).
- Affected: versions before 73.0.3683.75, per the NVD record.
- Fixed: 73.0.3683.75, the first version outside the affected range in the record.
- Severity: NVD scores it 7.8 High (vector AV:L/AC:L/PR:N/UI:R). The record text carries Chromium's own rating of Low. Both numbers are in the source, so both are quoted here.
- Weakness tag: the record has no CWE assigned. The cause is described as insufficient data validation, which led to out-of-bounds memory access.
How to check if you're exposed
- Open chrome://settings/help. Chrome shows its version and checks for an update at the same time.
- In an enterprise fleet, use your endpoint management tool or the Chrome Browser Cloud Management reports to list versions and find anything below 73.0.3683.75.
- On Linux and macOS the same version string is shown on the About Google Chrome screen.
- Remember that other Chromium based browsers and embedded runtimes carry their own copies of the PDF component. Check each vendor for its fix version.
What to do now
- Update Chrome on every managed device to 73.0.3683.75 or later. In practice, current Chrome releases are far newer than that.
- Find stragglers: kiosks, virtual desktop images and locked down machines often miss browser updates.
- Check Chromium based browsers and Electron apps that open PDFs, and confirm their vendors have shipped fixes.
- Until patched, treat PDFs from unknown senders with caution. The record says a user has to open a crafted file.
Why it matters
The record describes insufficient data validation in the PDF viewer, and a remote attacker supplying a crafted PDF file to cause out-of-bounds memory access. Out-of-bounds access in a file parser is a long standing way for a document to turn into a memory safety problem.
The two ratings are worth understanding. Chromium rates the issue Low, which reflects its view of practical impact given browser protections. NVD scores the raw weakness at 7.8, with local access and user interaction. Neither is exploitation evidence. The record's KEV flag is false.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which rating should I use, Low or High?
Use the higher number when you decide how fast to patch, and cite both when you explain it. Chromium Low reflects its judgement of practical impact. NVD 7.8 High reflects the scoring rules applied to the record.
Sources
- Chromium issue tracker entry referenced by the record: The Chromium issue tracker link in the record. It did not render without a signed in browser, so the version and ratings above come from the NVD record.
Last reviewed: 19 October 2026.
