What is the CVSS score of EUVD-2026-50607?

EUVD-2026-50607 has a contested CVSS base score of 4.3 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for EUVD-2026-50607?

Yes, a patch is available for EUVD-2026-50607. Update the affected software to the latest version immediately.

Google Chrome EUVD-2026-50607

| CVE-2026-17858 MEDIUM

Use of Uninitialized Variable (CWE-457)

2026-07-30 Chrome

GHSA-9j45-6833-228p

Information Disclosure Google Microsoft

Medium

Disputed · 4.3 Vendor: Chrome

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

vuln.today AI

4.3 MEDIUM

Network-delivered via crafted HTML page requiring victim navigation (UI:R); uninitialized read leaks only partial data (C:L) with no integrity or availability impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

6.5 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 14:52 vuln.today

CVSS changed

Jul 30, 2026 - 14:37 NVD

4.3 (MEDIUM)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:19 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:19 cve.org

MEDIUM 4.3

DescriptionCVE.org

Uninitialized Use in WebNN in Google Chrome on Windows prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Cross-origin data leak in Google Chrome on Windows (prior to 151.0.7922.72) stems from uninitialized memory use in the WebNN subsystem, exposing fragments of memory that may contain data from other origins. A remote attacker can trigger this flaw by luring a victim to a crafted HTML page, requiring no authentication but necessitating user interaction. No public exploit identified at time of analysis; EPSS sits at just 0.20% (10th percentile), consistent with a medium-severity information disclosure with no code execution potential.

Technical ContextAI

WebNN (Web Neural Network API) is a browser-native API exposing hardware-accelerated ML inference to web pages, introduced in Chromium. CWE-457 (Use of Uninitialized Variable) indicates that memory is allocated but not zeroed or otherwise initialized before use, meaning the buffer retains whatever bytes previously occupied that memory region - potentially belonging to another origin's data or prior browser operations. The affected product per CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* on Windows, with the vulnerability resolved in 151.0.7922.72. The Windows-specific nature suggests platform-specific memory management or WebNN backend behavior may be the root cause, as other OS versions are not listed.

RemediationAI

Vendor-released patch: Chrome 151.0.7922.72. Update Google Chrome to version 151.0.7922.72 or later via the browser's built-in update mechanism (Settings > About Chrome) or through enterprise deployment tooling (Google Update, ADMX policies). The fix is documented in the Chrome Stable Channel update at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. If immediate patching is operationally blocked, enforcing strict Content Security Policy headers on internally controlled sites reduces attacker-controlled HTML surface, though it does not address externally hosted threats. Restricting Chrome's access to untrusted domains via enterprise browser policy is a partial compensating control but significantly impacts usability. Given the low EPSS and absence of known exploits, applying the patch during the next standard maintenance window is appropriate for most environments.