What is the CVSS score of EUVD-2026-50586?

EUVD-2026-50586 has a contested CVSS base score of 9.6 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by EUVD-2026-50586?

Google Chrome DevTools sandbox escape (affecting versions before 151.0.7922.72) poses an escalation risk by allowing compromised renderer processes to gain host-level system access.. A patch is available.

How to fix or mitigate EUVD-2026-50586?

Within 24 hours, deploy Google Chrome 151.0.7922.72 or later to all user endpoints via MDM or patch management, prioritizing systems accessing sensitive applications. Within 7 days, verify deployment completion to at least 95% of Chrome-using devices and document any exceptions requiring alternative controls. Within 30 days, monitor security logs and endpoint telemetry for any exploitation attempts targeting DevTools, particularly correlated with renderer process compromise indicators.

Google Chrome EUVD-2026-50586

| CVE-2026-17837 CRITICAL

Improper Input Validation (CWE-20)

2026-07-30 Chrome

GHSA-5563-95wf-5c3x

Information Disclosure Google

Critical

Disputed · 9.6 Vendor: Chrome

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

8.3 HIGH

AC:H because exploitation depends on a prior renderer compromise and crafted content; UI:R and S:C reflect victim interaction and the sandbox-boundary escape; full C/I/A impact on escape.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

CRITICAL

qualitative

Red Hat

8.2 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 31, 2026 - 16:25 vuln.today

CVSS changed

Jul 31, 2026 - 16:22 NVD

9.6 (CRITICAL)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:19 cve.org

CRITICAL 9.6

CVE Published

Jul 30, 2026 - 00:19 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Insufficient validation of untrusted input in DevTools in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Sandbox escape in Google Chrome's DevTools (versions prior to 151.0.7922.72) lets an attacker who has already compromised the renderer process break out of the sandbox and gain broader host access via a crafted HTML page. It stems from insufficient validation of untrusted input (CWE-20) and requires user interaction plus a pre-existing renderer foothold, so it functions as a second-stage exploit rather than a standalone entry point. There is no public exploit identified at time of analysis, and EPSS is low (0.17%), consistent with Chromium's internal 'Medium' severity rating despite the high NVD CVSS score.

Technical ContextAI

The flaw resides in Chrome DevTools, the built-in debugging and inspection subsystem of the Chromium browser engine (cpe:2.3:a:google:chrome). Chromium uses a multi-process architecture in which untrusted web content runs inside a heavily sandboxed renderer process, while higher-privilege operations are handled by the browser/broker process; the sandbox boundary is the core defense that contains renderer compromises. This vulnerability is a CWE-20 Improper Input Validation issue in which DevTools fails to properly validate untrusted input crossing that trust boundary, enabling a scope change (S:C) where a compromised renderer can influence resources outside its sandbox. Sandbox-escape bugs are impactful because they convert a contained renderer exploit into full-browser or host-level compromise.

RemediationAI

Vendor-released patch: update Google Chrome to 151.0.7922.72 or later via the stable channel, as announced at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html; restart the browser to ensure the update is applied since Chrome staging can leave older processes running. In managed fleets, push the update through your enterprise browser management (Google Admin console / group policy) and confirm minimum-version enforcement. Because this is a sandbox-escape that only matters after a renderer compromise, defense-in-depth measures such as enabling the enhanced/strict site-isolation and 'Enhanced Protection' Safe Browsing settings reduce the likelihood of the preceding renderer exploit; there is no need for a feature-specific workaround since patching is straightforward and widely available.