What is the CVSS score of EUVD-2026-50632?

EUVD-2026-50632 has a contested CVSS base score of 6.5 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for EUVD-2026-50632?

Yes, a patch is available for EUVD-2026-50632. Update the affected software to the latest version immediately.

Google Chrome EUVD-2026-50632

| CVE-2026-17883 MEDIUM

Origin Validation Error (CWE-346)

2026-07-30 Chrome

GHSA-gf76-8fvr-h9hj

Google Authentication Bypass Suse

Medium

Disputed · 6.5 Vendor: Chrome

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

vuln.today AI

6.5 MEDIUM

SOP bypass via crafted HTML requires user or pipeline-triggered page load (UI:R, PR:N); impact is integrity-only (I:H) with no confidentiality, availability, or scope-change consequence.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 31, 2026 - 19:37 vuln.today

CVSS changed

Jul 31, 2026 - 19:22 NVD

6.5 (MEDIUM)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:19 cve.org

MEDIUM 6.5

CVE Published

Jul 30, 2026 - 00:19 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Inappropriate implementation in Headless in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Same-Origin Policy bypass in Google Chrome's Headless component prior to version 151.0.7922.72 allows remote attackers to perform unauthorized cross-origin integrity violations via a specially crafted HTML page. The flaw (CWE-346, Origin Validation Error) is specific to Chrome's Headless rendering mode and requires the victim to interact with attacker-controlled HTML (UI:R per CVSS). …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Attacker crafts malicious HTML page

Delivery

Victim or automated pipeline loads page in Headless Chrome

Exploit

Headless SOP validation logic bypassed (CWE-346)

Execution

Attacker script reads or modifies cross-origin resource

Impact

Integrity of target origin compromised

Access

Attacker crafts malicious HTML page

Delivery

Victim or automated pipeline loads page in Headless Chrome

Exploit

Headless SOP validation logic bypassed (CWE-346)

Execution

Attacker script reads or modifies cross-origin resource

Impact

Integrity of target origin compromised

Vulnerability AssessmentAI

Exploitation	Exploitation specifically requires that the target application is running Google Chrome in Headless mode - the vulnerable code path exists in the Headless component and is not confirmed to affect standard interactive Chrome. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 base score of 6.5 (Medium) reflects AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N: the attack is network-reachable with low complexity and no required privileges, constrained only by the need for user or pipeline interaction (UI:R) and limited to an integrity-only impact with no scope change. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker hosting a crafted HTML page directs a CI/CD pipeline or automated testing harness running unpatched Headless Chrome to load that page - satisfying the UI:R requirement without human involvement. Once loaded, the page exploits the SOP bypass to interact with or modify cross-origin resources accessible in that browser context, such as session state from an adjacent authenticated web service. …
Remediation	Upgrade Google Chrome to version 151.0.7922.72 or later, as detailed in the Google Chrome stable channel advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. … Detailed patch versions, workarounds, and compensating controls in full report.