sm1ee/cve-2026-91737Proof-of-concept for CVE-2026-91737, a PDFium use-after-free in Chrome's PDF renderer enabling ASLR bypass and ARM64 payload execution inside the sandbox.
A reentrant PDF JavaScript action unloads CPDF_Page while Chromium's PopulateAnnotationLinks() holds its raw page handle. This PoC reclaims the allocation, recovers ASLR, and executes an attacker-supplied 40-byte ARM64 payload in the sandboxed PDF renderer. The payload writes a sentinel and returns to PDF scripting.
Chromium issue 558036280 · Public exploit update and attachments
Tested on unmodified Chrome Beta 154.0.8037.0, macOS 26.2 arm64. The Chrome Framework SHA-256 was 280c15c95811fcf799c91e7c307fc941cc61be1f156247d86d9856ead0e06062. The issue is fixed; this PoC uses offsets for the tested build. It requires PDF accessibility. The flag below makes that entry deterministic and leaves the renderer sandbox enabled.
python3 oracle_server.py --port 8000 --root serve --events ./rce-events.jsonl
In another terminal:
"/Applications/Google Chrome Beta.app/Contents/MacOS/Google Chrome Beta" \
--user-data-dir="$(mktemp -d /tmp/plc01-rce.XXXXXX)" \
--no-first-run --no-default-browser-check \
--disable-background-networking --disable-component-update --disable-sync \
--force-renderer-accessibility --enable-logging=stderr --v=1 \
http://127.0.0.1:8000/quick/poc.html
Success ends with SELFCONTAINED_MAPJIT_NATIVE_PAYLOAD_SENTINEL_COMPLETE. The verified run took about 21 minutes. Failed ASLR probes intentionally crash PDF renderer instances.
Scope: native code execution in the sandboxed PDF renderer. No browser-process compromise or sandbox escape is claimed.