What is the CVSS score of EUVD-2026-50617?

EUVD-2026-50617 has a contested CVSS base score of 8.8 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by EUVD-2026-50617?

A privilege escalation vulnerability in Google Chrome versions prior to 151.0.7922.72 enables attackers to escalate permissions within the browser through a crafted webpage, affecting all employees…. A patch is available.

How to fix or mitigate EUVD-2026-50617?

Within 24 hours: Notify the IT and desktop security teams to assess Chrome deployment scope across the enterprise and verify your browser update mechanism is operational. Within 7 days: Deploy Chrome 151.0.7922.72 or later organization-wide using your standard update process or mobile device management, prioritizing systems handling financial data or with elevated access privileges. Within 30 days: Confirm full deployment completion across all endpoints via vulnerability scanning, verify zero systems remain on affected versions, and review browser security logs for exploitation indicators.

Google Chrome EUVD-2026-50617

| CVE-2026-17868 HIGH

Improper Privilege Management (CWE-269)

2026-07-30 Chrome

GHSA-m5f9-xcc3-c2pj

Privilege Escalation Google

High

Disputed · 8.8 Vendor: Chrome

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Remote crafted page needs no auth (PR:N) but requires the victim to open it (UI:R); browser-scoped privilege escalation yields high C/I/A with unchanged scope, though vendor rates it Medium.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

6.5 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 13:28 vuln.today

CVSS changed

Jul 30, 2026 - 13:22 NVD

8.8 (HIGH)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:19 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:19 cve.org

HIGH 8.8

DescriptionCVE.org

Insufficient policy enforcement in USB in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to perform privilege escalation via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Privilege escalation in Google Chrome's USB subsystem prior to 151.0.7922.72 allows a remote attacker who lures a victim to a crafted HTML page to escalate privileges within the browser through insufficient policy enforcement. Google rates the Chromium security severity as Medium, though the associated CVSS 3.1 score of 8.8 reflects high confidentiality, integrity, and availability impact contingent on user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but Google confirms a fixed build is available.

Technical ContextAI

The flaw resides in Chrome's implementation of the WebUSB / USB device access policy layer, the browser component that gates web-origin access to connected USB peripherals under the Permissions and Enterprise policy model. CWE-269 (Improper Privilege Management) is the root-cause class: the code fails to correctly enforce the privilege boundary that should confine a web page's USB-related capabilities, letting a page operate with privileges it should not hold. Because this is browser-internal policy enforcement rather than an OS-level bug, the affected surface is the Chromium USB backend shared across Chrome desktop builds identified by cpe:2.3:a:google:chrome:*.

RemediationAI

Vendor-released patch: 151.0.7922.72 - upgrade Google Chrome to 151.0.7922.72 or later via the Stable channel update (https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html); Chrome's built-in auto-update will apply this after a browser restart, so instruct users to relaunch and verify the version under chrome://settings/help. In managed environments, push the updated build through your enterprise deployment tooling and confirm auto-update is not disabled by policy. As an interim compensating control until the update lands, restrict WebUSB via enterprise policy (for example the DefaultWebUsbGuardSetting / WebUsbAllowDevicesForUrls policies) to block or tightly allowlist USB device access from web origins, accepting the trade-off that legitimate WebUSB-dependent web apps will stop working; also reinforce user awareness against opening untrusted pages given the required user interaction.