CVE-2024-5847 is the second PDFium use after free fixed in Chrome 126, scored High (CVSS 8.8) in the record and Medium by Chromium. A crafted PDF file could potentially exploit heap corruption. Update to Chrome 126 or later and relaunch the browser.
What's affected
- Product: Google Chrome, with Fedora 39 and 40 in the record.
- Fixed versions: The Chrome release post says 126.0.6478.54 for Linux and 126.0.6478.56/57 for Windows and Mac, and says the 126.0.6478.56/57 build also went to the extended stable channel. The record says only "prior to 126.0.6478.54". Both are given here because the numbers differ by platform.
- Severity conflict: record High at 8.8, release post Medium.
- Sibling: CVE-2024-5846, fixed in the same release.
- Exploitation: KEV flag false.
How to check if you're exposed
The quickest check is the About page, chrome://settings/help, which also triggers an update. For scripted checks use one of these:
# Linux
google-chrome --version
# Fedora, if you use the distribution package
rpm -q chromium
# macOS
"/Applications/Google Chrome.app/Contents/MacOS/Google Chrome" --version
# Windows PowerShell
(Get-Item "C:\Program Files\Google\Chrome\Application\chrome.exe").VersionInfo.ProductVersion
If a user opens PDFs in the browser tab, they are in the path of both PDFium bugs.
What to do now
- Apply the Chrome 126 stable update and restart the browser.
- Fedora users on the distribution package should update chromium through the package manager. The record lists Fedora 39 and 40 among affected platforms.
- Audit Chromium-based browsers separately and check each vendor's own security notes for the matching fix.
- After rollout, sample a few machines with the version commands above and confirm the build number.
Why it matters
The record maps this to CWE-416. It follows CVE-2024-5846 almost word for word, and the release post lists both as reported by the same researcher, two days apart, with rewards still to be determined at publication.
A pair like this is a signal about where fuzzing is paying off. For a defender, the signal is to keep PDF handling on the shortlist when you review untrusted file exposure: email attachments, downloads and in browser viewing. Keep the update policy tight and consider whether untrusted PDFs need to open in the browser at all on your most sensitive machines.
Quick check
If I already patched for CVE-2024-5846, am I covered?
Yes. Both fixes shipped in the same Chrome 126 stable release, so one update covers both.
Can I avoid the risk by not using the built in viewer?
That may reduce exposure, but the sources do not describe it as a mitigation. Update the browser.
Sources
- Chrome Releases: Stable Channel Update for Desktop, 11 June 2024
- Safeguard Gold entry for CVE-2024-5847
Last reviewed: 19 October 2026.
