CVE-2024-5846 is a use after free in PDFium, the PDF engine in Google Chrome. The record scores it High (CVSS 8.8) and says a crafted PDF file could potentially exploit heap corruption, while Chromium rated it Medium. Update to Chrome 126 or later.
What's affected
- Product: Google Chrome, with Fedora 39 and 40 in the record.
- Fixed versions: The Chrome release post says 126.0.6478.54 for Linux and 126.0.6478.56/57 for Windows and Mac, and says the 126.0.6478.56/57 build also went to the extended stable channel. The record says only "prior to 126.0.6478.54". Both are given here because the numbers differ by platform.
- Severity conflict: record High at 8.8, release post Medium.
- Sibling: CVE-2024-5847, another PDFium use after free, fixed in the same release.
- Exploitation: KEV flag false.
How to check if you're exposed
Start with the version string. PDFium is also used outside Chrome. If you ship software that embeds it, the Chrome update does not fix your product.
# Linux
google-chrome --version
# Fedora, if you use the distribution package
rpm -q chromium
# macOS
"/Applications/Google Chrome.app/Contents/MacOS/Google Chrome" --version
# Windows PowerShell
(Get-Item "C:\Program Files\Google\Chrome\Application\chrome.exe").VersionInfo.ProductVersion
For a fleet, pull the same string from your endpoint management tool and filter for anything older than the 126 build for its platform.
What to do now
- Run the browser update and relaunch. If you manage a fleet, push the 126 build through your usual software distribution channel.
- List the browsers and embedded Chromium runtimes in your estate. Desktop apps that bundle their own Chromium are not fixed by a Chrome update.
- Confirm extended stable users received 126.0.6478.56/57, which the release post says was pushed to that channel.
- Keep automatic updates on. Browser fixes are small and frequent, and delay is the main risk.
Why it matters
The record maps this to CWE-416. PDF engines parse complex, attacker supplied files, and memory safety bugs in them are common. The release post credits the same researcher, from a university security group, with this bug and CVE-2024-5847, reported two days apart.
One practical angle is the software supply chain. PDFium is an open source library that other products compile in. A browser update fixes the browser only. If your applications bundle PDFium or a Chromium derived runtime, you need the maintainer's release. A container or dependency scan helps you find those copies, which is where the container image scan demo below can help.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does this affect other software that renders PDFs?
Possibly, if it embeds PDFium. The sources I read do not list such products, so ask your vendors whether they ship PDFium and which version.
Is CVE-2024-5847 the same flaw?
No. It is a separate PDFium use after free with its own bug ID, fixed in the same release.
Sources
- Chrome Releases: Stable Channel Update for Desktop, 11 June 2024
- Safeguard Gold entry for CVE-2024-5846
Last reviewed: 19 October 2026.
