What is the CVSS score of EUVD-2026-50624?

EUVD-2026-50624 has a contested CVSS base score of 8.8 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by EUVD-2026-50624?

Google Chrome versions prior to 151.0.7922.72 contain a memory safety vulnerability in its PDF rendering engine that allows remote code execution when users open malicious PDF files.. A patch is available.

How to fix or mitigate EUVD-2026-50624?

Within 24 hours, inventory Chrome deployments across the organization and prepare a staged update plan targeting Chrome 151.0.7922.72 or later. Within 7 days, deploy the patched version to all endpoints using your standard update mechanism; prioritize employees who handle external documents and contractor-supplied PDFs. Within 30 days, verify 100% deployment completion, document the patch status in your patch management system, and monitor systems for any compromise indicators.

Google Chrome EUVD-2026-50624

| CVE-2026-17875 HIGH

Use After Free (CWE-416)

2026-07-30 Chrome

GHSA-gq67-349v-hv27

Google Use After Free RCE Denial Of Service Memory Corruption Red Hat Suse

High

Disputed · 8.8 Vendor: Chrome

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-delivered PDF (AV:N/AC:L) with no auth (PR:N) but requiring the user to open it (UI:R); in-sandbox code execution still yields high C/I/A within that scope (S:U).

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

8.8 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 17:27 vuln.today

CVSS changed

Jul 30, 2026 - 17:22 NVD

8.8 (HIGH)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:19 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:19 cve.org

HIGH 8.8

DescriptionCVE.org

Use after free in PDFium in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted PDF file. (Chromium security severity: Medium)

AnalysisAI

Remote code execution in Google Chrome's PDFium PDF rendering engine (versions prior to 151.0.7922.72) allows a remote attacker to execute arbitrary code inside the browser's renderer sandbox via a crafted PDF file. The flaw is a CWE-416 use-after-free rated CVSS 8.8 (Chromium-assessed severity: Medium) and requires the victim to open or render a malicious PDF (UI:R). …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Deliver crafted PDF via web or email

Delivery

Victim opens PDF in vulnerable Chrome

Exploit

Trigger use-after-free in PDFium

Execution

Corrupt heap and hijack control flow

Impact

Execute arbitrary code within renderer sandbox

Access

Deliver crafted PDF via web or email

Delivery

Victim opens PDF in vulnerable Chrome

Exploit

Trigger use-after-free in PDFium

Execution

Corrupt heap and hijack control flow

Impact

Execute arbitrary code within renderer sandbox

Vulnerability AssessmentAI

Exploitation	Exploitation requires the victim to open or render a crafted PDF file in a Chrome build prior to 151.0.7922.72 using the PDFium engine (UI:R - user interaction is mandatory, e.g. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS v3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H = 8.8 High) reflects a network-reachable, low-complexity, unauthenticated attack that nonetheless requires user interaction (opening/viewing a malicious PDF). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker hosts a crafted PDF on a website or sends it as an email attachment/link; when the victim opens or previews the PDF in a vulnerable Chrome build, PDFium's use-after-free is triggered, allowing the attacker to execute code within the renderer sandbox. Low attack complexity means reliable triggering, but user interaction (viewing the PDF) is required and the payload is confined to the sandbox absent a chained escape. …
Remediation	Vendor-released patch: update Google Chrome to version 151.0.7922.72 or later on all desktop platforms; Chrome typically auto-updates, so ensure the browser is restarted to apply the fix, and verify via chrome://settings/help. … Detailed patch versions, workarounds, and compensating controls in full report.