What is the CVSS score of EUVD-2026-50610?

EUVD-2026-50610 has a contested CVSS base score of 7.8 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by EUVD-2026-50610?

Google Chrome's update mechanism contains a local privilege escalation vulnerability affecting all desktop Chrome versions prior to 151.0.7922.72.. A patch is available.

How to fix or mitigate EUVD-2026-50610?

Within 24 hours, conduct a comprehensive inventory of Chrome installations across all organizational endpoints to assess deployment scope and identify critical systems. Over the next 7 days, deploy Chrome version 151.0.7922.72 or later to all systems, prioritizing machines handling sensitive data or critical business operations; utilize built-in Chrome auto-update functionality or your standard endpoint management distribution method. By day 30, confirm patching completion through endpoint management tools, audit deployment coverage to ensure no systems were missed, and document completion status for compliance and audit purposes.

Google Chrome EUVD-2026-50610

| CVE-2026-17861 HIGH

Improper Input Validation (CWE-20)

2026-07-30 Chrome

GHSA-m293-xcr4-f6hc

Privilege Escalation Google

High

Disputed · 7.8 Vendor: Chrome

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Local file-planting attack (AV:L) requiring an update trigger (UI:R) but no prior privileges (PR:N), yielding full OS-level compromise, so C/I/A all High.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

8.8 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 13:27 vuln.today

CVSS changed

Jul 30, 2026 - 13:22 NVD

7.8 (HIGH)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:19 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:19 cve.org

HIGH 7.8

DescriptionCVE.org

Insufficient validation of untrusted input in Updater in Google Chrome prior to 151.0.7922.72 allowed a local attacker to perform OS-level privilege escalation via a malicious file. (Chromium security severity: Medium)

AnalysisAI

Local privilege escalation in Google Chrome's Updater component allows a local attacker who can plant a malicious file to gain OS-level privileges once the update process acts on it. The flaw stems from insufficient validation of untrusted input (CWE-20) and affects all Chrome desktop builds prior to 151.0.7922.72; Google rates the Chromium security severity as Medium while the CVSS base score is 7.8 (High). There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

The vulnerability lives in the Chrome Updater, the background service (Google Update / GoogleUpdater) responsible for keeping the browser current and which typically runs with elevated/SYSTEM privileges to write into protected install directories. Because the Updater executes with higher privilege than the logged-in user, any point at which it consumes attacker-controllable input becomes a privilege boundary. The root cause is classified as CWE-20 (Improper Input Validation): the Updater insufficiently validates a file supplied by an untrusted local source, so a crafted malicious file processed by the privileged updater path can be leveraged to execute or write with the Updater's elevated rights. The affected component is identified by CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, covering the Chrome desktop application across platforms.

RemediationAI

Vendor-released patch: Chrome 151.0.7922.72 - upgrade the Chrome Stable channel to 151.0.7922.72 or later and relaunch the browser to complete the update, per the Chrome Releases advisory (https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html). In managed environments, confirm the fixed build is deployed via your update management (Google Update policies / enterprise update infrastructure) since the vulnerable component is the Updater itself. As a compensating control until patched, restrict local write access to Chrome's installation and updater working directories so unprivileged users cannot stage a malicious file consumed by the privileged updater, and limit interactive local logon on shared or multi-user hosts; the trade-off is administrative overhead and potential interference with update staging, so validate that legitimate update operations still succeed after tightening permissions.