What is the CVSS score of EUVD-2026-50626?

EUVD-2026-50626 has a contested CVSS base score of 8.4 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by EUVD-2026-50626?

Google Chrome on Linux systems before version 151.0.7922.72 contains a privilege escalation vulnerability that exposes organizations to insider threat and account compromise scenarios.. A patch is available.

How to fix or mitigate EUVD-2026-50626?

Within 24 hours, audit Chrome deployments across Linux endpoints and notify affected users of the required update priority. Within 7 days, deploy Google Chrome 151.0.7922.72 or later through your standard patch management or browser auto-update mechanism to all Linux systems. Within 30 days, verify deployment completion via device inventory systems and establish monitoring for local privilege escalation attempts in security logs.

Google Chrome EUVD-2026-50626

| CVE-2026-17877 HIGH

Improper Privilege Management (CWE-269)

2026-07-30 Chrome

GHSA-96rv-m324-862p

Privilege Escalation Google

High

Disputed · 8.4 Vendor: Chrome

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY

8.4 HIGH

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Local vector and the need for an existing foothold to reach the Chromoting host imply PR:L; total OS-level compromise yields C:H/I:H/A:H with unchanged scope.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

8.8 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Jul 30, 2026 - 19:30 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 30, 2026 - 19:22 vuln.today

cvss_changed

CVSS changed

Jul 30, 2026 - 19:22 NVD

7.5 (HIGH) 8.4 (HIGH)

Analysis Generated

Jul 30, 2026 - 13:28 vuln.today

CVSS changed

Jul 30, 2026 - 13:22 NVD

7.5 (HIGH)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:19 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:19 cve.org

HIGH 7.5

DescriptionCVE.org

Inappropriate implementation in Chromoting in Google Chrome on Linux prior to 151.0.7922.72 allowed a local attacker to perform OS-level privilege escalation via malicious network traffic. (Chromium security severity: Medium)

AnalysisAI

Local OS-level privilege escalation in Google Chrome on Linux before 151.0.7922.72 stems from an inappropriate implementation in the Chromoting (Chrome Remote Desktop) component, letting a local attacker leverage malicious network traffic to gain elevated OS privileges. Rated CVSS 8.4 (Chromium severity Medium), the flaw carries total technical impact but no public exploit identified at time of analysis and a low EPSS of 0.11% (2nd percentile), indicating minimal current exploitation pressure. A vendor patch is available and no active exploitation has been reported.

Technical ContextAI

Chromoting is the internal codename for Google's Chrome Remote Desktop functionality, which brokers remote desktop sessions and handles network-delivered session traffic on the host. The weakness is classified as CWE-269 (Improper Privilege Management), meaning the component fails to correctly enforce or drop privileges when processing input, allowing an actor to cross a trust boundary into higher-privileged OS context. Per the CPE data (cpe:2.3:a:google:chrome), the issue is specific to the Chrome application on Linux, where the Chromoting host process interacts with OS-level privilege mechanisms; a mishandled implementation path lets crafted network traffic influence a privileged operation.

RemediationAI

Vendor-released patch: update Google Chrome on Linux to 151.0.7922.72 or later via the Stable channel update (https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html), then relaunch the browser and any Chrome Remote Desktop host to load the fix. As an interim compensating control where immediate patching is not possible, disable or uninstall the Chrome Remote Desktop host on affected Linux systems so the vulnerable Chromoting code path is not reachable - the trade-off is loss of remote desktop access to those machines. Additionally restrict network access to the Chromoting host ports and limit local user access on multi-user Linux hosts to reduce the pool of potential local attackers, accepting that this narrows legitimate remote-access workflows. Confirm the running Chrome version through chrome://settings/help after updating.