What is the CVSS score of EUVD-2026-50603?

EUVD-2026-50603 has a contested CVSS base score of 6.5 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for EUVD-2026-50603?

Yes, a patch is available for EUVD-2026-50603. Update the affected software to the latest version immediately.

Google Chrome EUVD-2026-50603

| CVE-2026-17854 MEDIUM

Origin Validation Error (CWE-346)

2026-07-30 Chrome

GHSA-8487-52vc-ggw6

Authentication Bypass Google

Medium

Disputed · 6.5 Vendor: Chrome

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

vuln.today AI

6.5 MEDIUM

Network delivery via crafted page requires user visit (UI:R); no auth needed; SOP bypass yields high integrity impact with no confidentiality or availability effect.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

6.5 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 31, 2026 - 19:35 vuln.today

CVSS changed

Jul 31, 2026 - 19:22 NVD

6.5 (MEDIUM)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:19 cve.org

MEDIUM 6.5

CVE Published

Jul 30, 2026 - 00:19 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Insufficient policy enforcement in WebMCP in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Same-origin policy bypass in Google Chrome's WebMCP component (prior to 151.0.7922.72) enables a remote attacker to violate cross-origin integrity boundaries through a crafted HTML page, requiring only that a victim visit the malicious page. The root cause is insufficient policy enforcement in the WebMCP subsystem, classified by Chromium's security team as Medium severity (CWE-346: Origin Validation Error). No public exploit code or active exploitation has been identified at time of analysis, and the low EPSS score of 0.19% (9th percentile) corroborates low current threat activity.

Technical ContextAI

WebMCP is Google Chrome's integration layer for the Model Context Protocol (MCP), a relatively new browser feature appearing in Chrome 151.x. CWE-346 (Origin Validation Error) identifies the root cause: the browser fails to adequately validate origin when enforcing cross-origin policies within this subsystem, permitting a crafted page to interact with or influence resources it should be barred from accessing. The affected CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covers all Chrome desktop releases prior to the fixed build 151.0.7922.72. The same-origin policy is a foundational browser security primitive; bypassing it through WebMCP's policy enforcement gap allows cross-origin integrity violations that would ordinarily be blocked.

RemediationAI

Upgrade Google Chrome to version 151.0.7922.72 or later, which is confirmed as the vendor-patched release via the stable channel update advisory at http://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Chrome's auto-update mechanism will deliver the patch automatically on supported platforms; administrators managing enterprise fleets should verify rollout via Chrome Browser Cloud Management or Group Policy. If immediate upgrade is not possible, disabling or restricting access to the WebMCP feature via enterprise policy would reduce exposure, though this may impair MCP-dependent browser functionality. Users should also apply standard browser hygiene - avoiding untrusted or unsolicited links - to reduce the likelihood of being directed to a crafted HTML page while unpatched.