What is the CVSS score of EUVD-2026-50614?

EUVD-2026-50614 has a contested CVSS base score of 9.6 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by EUVD-2026-50614?

Chrome for macOS versions prior to 151.0.7922.72 contain a critical sandbox escape (CVE-2026-17865) allowing renderer-compromised processes to escalate to full device control.. A patch is available.

How to fix or mitigate EUVD-2026-50614?

Within 24 hours, scan macOS endpoints to identify Chrome installations below version 151.0.7922.72 and assess affected user count. Within 7 days, deploy Chrome 151.0.7922.72 or later to all affected macOS systems through your standard update mechanism, prioritizing administrative users and systems with sensitive data access. Within 30 days, confirm deployment completion across your macOS fleet and establish continuous version monitoring to prevent regression.

Google Chrome EUVD-2026-50614

| CVE-2026-17865 CRITICAL

Protection Mechanism Failure (CWE-693)

2026-07-30 Chrome

GHSA-w27c-274j-76rc

Google Information Disclosure Red Hat Suse

Critical

Disputed · 9.6 Vendor: Chrome

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

8.3 HIGH

Network-delivered via crafted page (AV:N, UI:R) but requires chaining a prior renderer compromise, raising complexity to AC:H; sandbox escape crosses trust boundary (S:C) with full host impact.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

CRITICAL

qualitative

Red Hat

8.8 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 31, 2026 - 19:26 vuln.today

CVSS changed

Jul 31, 2026 - 19:22 NVD

9.6 (CRITICAL)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:19 cve.org

CRITICAL 9.6

CVE Published

Jul 30, 2026 - 00:19 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Inappropriate implementation in Crypto in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Sandbox escape in Google Chrome for macOS before 151.0.7922.72 lets an attacker who has already compromised the renderer process break out of the browser sandbox using a crafted HTML page, escalating a contained renderer foothold toward the host. The flaw sits in Chrome's Crypto component and is a second-stage bug that must be chained with an initial renderer compromise. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Lure macOS user to malicious site

Delivery

Compromise sandboxed renderer via prior bug

Exploit

Serve crafted HTML to Crypto component

Execution

Trigger inappropriate implementation flaw

Persist

Escape renderer sandbox (scope change)

Impact

Gain higher-privilege host context

Access

Lure macOS user to malicious site

Delivery

Compromise sandboxed renderer via prior bug

Exploit

Serve crafted HTML to Crypto component

Execution

Trigger inappropriate implementation flaw

Persist

Escape renderer sandbox (scope change)

Impact

Gain higher-privilege host context

Vulnerability AssessmentAI

Exploitation	Exploitation requires that the attacker has ALREADY compromised the Chrome renderer process - this is a chained, second-stage sandbox escape, not a standalone remote bug, and that precondition is the single biggest limiting factor. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	Signals conflict and must be weighed rather than taken at face value. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker first lands a separate renderer-level bug by luring a macOS Chrome user to a malicious site, gaining code execution inside the sandboxed renderer. They then serve crafted HTML that triggers the Crypto implementation flaw to escape the sandbox and reach higher-privilege browser/host context. …
Remediation	Vendor-released patch: Chrome 151.0.7922.72 - update the macOS Stable channel to that build or later (Chrome menu > About Google Chrome forces the update check and applies the fix on relaunch). … Detailed patch versions, workarounds, and compensating controls in full report.