What is the CVSS score of EUVD-2026-50633?

EUVD-2026-50633 has a contested CVSS base score of 8.8 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by EUVD-2026-50633?

A heap corruption vulnerability in Google Chrome's WebRTC component (CVE-2026-17884) enables remote code execution when users visit a malicious webpage, directly compromising Chrome instances across…. A patch is available.

How to fix or mitigate EUVD-2026-50633?

Within 24 hours, confirm Chrome deployment scope and test Google Chrome 151.0.7922.72 patch in a lab environment for compatibility with critical applications and plugins. Over the next 7 days, deploy to high-risk populations (finance, engineering, senior staff) using endpoint management tools and monitor deployment success rates. Complete organization-wide rollout by day 30, ensuring all Chrome instances reach version 151.0.7922.72, with web content filtering and browser sandboxing policies active as compensating controls during transition.

Google Chrome EUVD-2026-50633

| CVE-2026-17884 HIGH

Use After Free (CWE-416)

2026-07-30 Chrome

GHSA-g442-2whp-xfm3

Information Disclosure Google Use After Free Memory Corruption

High

Disputed · 8.8 Vendor: Chrome

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

7.5 HIGH

Network-reachable via a web page with no auth, but reliable UAF exploitation needs heap grooming (AC:H) and victim must visit the page (UI:R).

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

7.6 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 17:28 vuln.today

CVSS changed

Jul 30, 2026 - 17:22 NVD

8.8 (HIGH)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:19 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:19 cve.org

HIGH 8.8

DescriptionCVE.org

Object lifecycle issue in WebRTC in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Heap corruption in Google Chrome's WebRTC component (versions prior to 151.0.7922.72) allows a remote attacker to exploit a use-after-free by luring a victim to a crafted HTML page, potentially leading to arbitrary code execution in the renderer process. The flaw is a CWE-416 object-lifecycle error rated CVSS 8.8 with user interaction required. There is no public exploit identified at time of analysis, and EPSS is low at 0.18% (8th percentile), indicating no observed weaponization despite the high CVSS.

Technical ContextAI

The vulnerability lives in WebRTC, the real-time peer-to-peer audio/video/data-channel stack built into Chromium and exposed to any web page via JavaScript APIs (RTCPeerConnection, data channels, media negotiation). The root cause is CWE-416 (Use-After-Free): an object's lifecycle is mishandled so that memory is freed while a dangling reference remains, and subsequent access corrupts the heap. Because WebRTC processing runs in the sandboxed renderer, a crafted HTML/JS page can drive the vulnerable code path without any plugin. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* (desktop Stable channel), and the vendor tags (Memory Corruption, Use After Free, Information Disclosure) align with the classic UAF-to-info-leak/RCE primitive.

RemediationAI

Vendor-released patch: update Google Chrome to 151.0.7922.72 or later on the Stable desktop channel; the fix is delivered via Chrome's automatic updater, so verify at chrome://settings/help and relaunch to apply, since the update is inert until restart. Reference the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. In managed environments, push the update through your enterprise policy/MDM to force the relaunch. If patching must be delayed, compensating controls include disabling or restricting WebRTC via enterprise policy (which breaks legitimate video-conferencing/RTC apps that rely on it) and limiting browsing to trusted sites through web filtering to reduce exposure to attacker-controlled HTML; both are stopgaps only. Users of other Chromium-based browsers should apply their vendor's build that incorporates the equivalent Chromium fix.