What is the CVSS score of EUVD-2026-50585?

EUVD-2026-50585 has a contested CVSS base score of 8.8 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by EUVD-2026-50585?

Google Chrome users in your organization face a remote code execution risk from CVE-2026-17836 when visiting crafted websites.. A patch is available.

How to fix or mitigate EUVD-2026-50585?

Within 24 hours: Communicate Chrome version requirements (151.0.7922.72 or later) to end users and device management teams. Within 7 days: Deploy Chrome 151.0.7922.72 or later to all managed endpoints and corporate desktops using your standard patch management process; verify deployment across at least 80% of user devices. Within 30 days: Complete full rollout to 100% of endpoints and validate through asset inventory; update security policies to enforce minimum Chrome version 151.0.7922.72 for all organization-managed devices.

Google Chrome EUVD-2026-50585

| CVE-2026-17836 HIGH

Use After Free (CWE-416)

2026-07-30 Chrome

GHSA-cgpw-34vx-hvv3

RCE Denial Of Service Google Use After Free Memory Corruption

High

Disputed · 8.8 Vendor: Chrome

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-reachable via a crafted page needing only a visit (UI:R, PR:N, AC:L); scope unchanged because execution stays within the sandbox, with high C/I/A on the renderer process.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

8.8 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 17:27 vuln.today

CVSS changed

Jul 30, 2026 - 17:22 NVD

8.8 (HIGH)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:19 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:19 cve.org

HIGH 8.8

DescriptionCVE.org

Use after free in V8 in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Remote code execution in Google Chrome's V8 JavaScript engine (versions prior to 151.0.7922.72) allows a remote attacker to run arbitrary code inside the renderer sandbox when a victim opens a crafted HTML page. The flaw is a CWE-416 use-after-free memory corruption issue; Google has released a fixed stable-channel build, and there is no public exploit identified at time of analysis. Despite a CVSS of 8.8, Chromium rated the security severity Medium and EPSS is low (0.21%, 12th percentile), and the impact is constrained to code execution within the sandbox rather than full host compromise.

Technical ContextAI

The vulnerability lives in V8, the C++ JavaScript and WebAssembly engine that powers Chrome and all Chromium-derived browsers. A use-after-free (CWE-416) occurs when the engine continues to reference a heap object after it has been freed, letting an attacker groom the heap so the dangling pointer resolves to attacker-controlled data, corrupting memory and hijacking control flow. Because V8 executes untrusted script from any visited web page, such bugs are directly reachable from a crafted HTML/JS payload. The affected component per CPE is cpe:2.3:a:google:chrome (all versions below the fixed build); as a V8 defect it applies to the desktop Chrome stable channel and, by extension, other Chromium-based browsers that embed the same engine version.

RemediationAI

Vendor-released patch: update Google Chrome to 151.0.7922.72 or later via the Chrome Releases stable channel update (https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html); restart the browser to complete the update since Chrome staging leaves the old binary running until relaunch. Users on Chromium-based browsers should apply their vendor's corresponding update once it ships. As interim compensating controls before patching, restrict browsing of untrusted sites, and where feasible enforce Chrome's Site Isolation and 'Strict' security settings; disabling the JavaScript JIT via the enterprise policy or the '--js-flags=--jitless' / v8-disable-optimizing-compiler hardening reduces the exploitability of V8 memory-corruption bugs at a meaningful performance cost to script-heavy sites. These controls do not remove the flaw and should be treated as stopgaps until the patched version is deployed.