What is the CVSS score of EUVD-2026-50581?

EUVD-2026-50581 has a contested CVSS base score of 9.6 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by EUVD-2026-50581?

Google Chrome versions prior to 151.0.7922.72 contain a critical sandbox escape vulnerability (CVE-2026-17832) that could enable full system compromise following an initial browser compromise.. A patch is available.

How to fix or mitigate EUVD-2026-50581?

Within 24 hours, distribute a security advisory to all personnel regarding the Chrome vulnerability and generate an inventory of all systems running Chrome versions prior to 151.0.7922.72. Within 7 days, complete patching of all organizational Chrome installations to version 151.0.7922.72 or later through automated update mechanisms or centralized deployment tools. Within 30 days, review endpoint monitoring logs for indicators of browser renderer process compromise, document patch deployment completion for compliance records, and validate the vulnerability cannot be exploited on updated Chrome versions.

Google Chrome EUVD-2026-50581

| CVE-2026-17832 CRITICAL

Use After Free (CWE-416)

2026-07-30 Chrome

GHSA-r3xh-r9mw-vh95

Google Use After Free Denial Of Service Memory Corruption Red Hat Suse

Critical

Disputed · 9.6 Vendor: Chrome

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

8.3 HIGH

AC:H because exploitation requires a pre-existing renderer compromise plus winning a UAF race; UI:R for visiting crafted content; S:C and C/I/A:H reflect full sandbox escape to a higher-privilege process.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

CRITICAL

qualitative

Red Hat

9.0 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 31, 2026 - 16:24 vuln.today

CVSS changed

Jul 31, 2026 - 16:22 NVD

9.6 (CRITICAL)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:19 cve.org

CRITICAL 9.6

CVE Published

Jul 30, 2026 - 00:19 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Use after free in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Sandbox escape in Google Chrome's ANGLE graphics layer (versions prior to 151.0.7922.72) allows an attacker who has already compromised the renderer process to break out of the sandbox via a crafted HTML page, exploiting a use-after-free (CWE-416) memory corruption. Google rated the underlying Chromium severity as Medium, and while the NVD CVSS is 9.6, exploitation is gated behind a pre-existing renderer compromise. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Compromise renderer via separate bug

Delivery

Serve crafted HTML/WebGL to ANGLE

Exploit

Trigger use-after-free in graphics layer

Execution

Corrupt GPU-process memory

Impact

Escape sandbox to higher-privilege context

Access

Compromise renderer via separate bug

Delivery

Serve crafted HTML/WebGL to ANGLE

Exploit

Trigger use-after-free in graphics layer

Execution

Corrupt GPU-process memory

Impact

Escape sandbox to higher-privilege context

Vulnerability AssessmentAI

Exploitation	Exploitation requires the attacker to have ALREADY compromised Chrome's renderer process (explicitly stated in the description) - this is a second-stage sandbox-escape primitive, not an initial-access vector. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The signals are notably in tension. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker first exploits a separate renderer vulnerability when the victim visits a malicious or compromised site, gaining code execution inside Chrome's sandboxed renderer. From that foothold, the attacker serves crafted HTML/WebGL content that drives ANGLE into the use-after-free condition, corrupting memory to escape the sandbox into the GPU/browser process. …
Remediation	Vendor-released patch: update Google Chrome to 151.0.7922.72 or later via the Stable channel; on managed fleets, force the update and relaunch since Chrome only applies pending updates on restart, and confirm rollout through chrome://settings/help. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, distribute a security advisory to all personnel regarding the Chrome vulnerability and generate an inventory of all systems running Chrome versions prior to 151.0.7922.72. …

Threat intelligence, references, and detailed analysis are available after sign-in.