What is the CVSS score of EUVD-2026-50609?

EUVD-2026-50609 has a CVSS 3.1 base score of 3.3 (Low). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.1%.

Is there a patch available for EUVD-2026-50609?

Yes, a patch is available for EUVD-2026-50609. Update the affected software to the latest version immediately.

Chrome Android EUVD-2026-50609

| CVE-2026-17860 LOW

Improper Input Validation (CWE-20)

2026-07-30 Chrome

GHSA-7fp3-mxp6-94w2

Information Disclosure Google

3.3

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

3.3 LOW

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

vuln.today AI

3.3 LOW

Local vector confirmed by file-delivery precondition; no privileges required but user must open the file; impact confined to low integrity (Omnibox display only).

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 31, 2026 - 19:36 vuln.today

CVSS changed

Jul 31, 2026 - 19:22 NVD

3.3 (LOW)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:19 cve.org

LOW 3.3

CVE Published

Jul 30, 2026 - 00:19 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Insufficient validation of untrusted input in Mobile in Google Chrome on Android prior to 151.0.7922.72 allowed a local attacker to spoof the contents of the Omnibox (URL bar) via a malicious file. (Chromium security severity: Medium)

AnalysisAI

Omnibox spoofing in Google Chrome for Android prior to 151.0.7922.72 allows a local attacker to display falsified URLs in the browser's address bar by delivering a malicious file to the target device. The flaw stems from insufficient validation of untrusted input in the Mobile component, classified under CWE-20. With EPSS at 0.11% (2nd percentile) and no CISA KEV listing, real-world exploitation risk is low, though successful exploitation could undermine user trust in the displayed URL and facilitate phishing on compromised or shared devices.

Technical ContextAI

The affected component is the Mobile browser interface of Google Chrome on Android, specifically the Omnibox (address bar) input handling subsystem. CWE-20 (Improper Input Validation) identifies the root cause: the browser fails to sufficiently sanitize or validate content sourced from a local file before rendering it in the Omnibox, permitting the displayed URL to diverge from the actual navigation target. The CPE string cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covers all Chrome versions; the vulnerability is scoped to Android/Mobile by the description. This class of Omnibox spoofing flaw is a known attack surface in mobile browsers where local file schemes (e.g., file://) or crafted intent URIs can manipulate address bar rendering.

RemediationAI

Update Google Chrome on Android to version 151.0.7922.72 or later, which includes the vendor-released patch per the Chrome Releases advisory at http://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. On managed Android fleets, enforce the update via mobile device management (MDM) policies targeting the Chrome app. If immediate patching is not possible, consider restricting the ability of untrusted users to place files on shared devices, as the attack requires delivery of a malicious file to the local filesystem - removing that local write access eliminates the precondition. No significant functional side effects are expected from upgrading Chrome to 151.0.7922.72.