What is the CVSS score of EUVD-2026-47575?

EUVD-2026-47575 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.1%.

Which versions of Google are affected by EUVD-2026-47575?

Google Chrome on Linux versions prior to 150.0.7871.182 contain a domain spoofing vulnerability enabling attackers in privileged network positions to impersonate trusted domains, facilitating…. A patch is available.

How to fix or mitigate EUVD-2026-47575?

Within 24 hours, identify all Chrome deployments on Linux systems and document current versions. Within 7 days, deploy Google Chrome version 150.0.7871.182 or later through your standard patch management process to all affected Linux endpoints. Within 30 days, confirm successful deployment across all systems using endpoint management tools; for any systems unable to patch immediately due to compatibility issues, restrict network access to trusted internal endpoints only until remediation is complete.

Google EUVD-2026-47575

| CVE-2026-16422 HIGH

Improper Input Validation (CWE-20)

2026-07-21 chrome-cve-admin@google.com

GHSA-3jw8-qrmv-j8pj

Information Disclosure Google

7.5

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

SUSE

MEDIUM

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 14:23 vuln.today

CVSS changed

Jul 22, 2026 - 14:22 NVD

7.5 (HIGH)

CVE Published

Jul 21, 2026 - 23:16 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 21, 2026 - 23:16 cve.org

HIGH 7.5

DescriptionCVE.org

Insufficient validation of untrusted input in Certificate in Google Chrome on Linux prior to 150.0.7871.182 allowed an attacker in a privileged network position to perform domain spoofing via malicious network traffic. (Chromium security severity: High)

AnalysisAI

Domain spoofing in Google Chrome on Linux prior to 150.0.7871.182 lets an attacker in a privileged network position present a malicious site under a trusted domain identity by exploiting insufficient validation of untrusted certificate input. The flaw carries a High Chromium severity and a CVSS of 7.5 driven entirely by integrity impact (I:H, C:N, A:N); Google's release notes confirm a fix is available. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.