What is the CVSS score of EUVD-2026-50637?

EUVD-2026-50637 has a contested CVSS base score of 7.1 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by EUVD-2026-50637?

Google Chrome desktop versions before 151.0.7922.72 contain a sandbox escape vulnerability (CVE-2026-17888, CVSS 7.1) exploitable by network-adjacent attackers to achieve remote code execution…. A patch is available.

How to fix or mitigate EUVD-2026-50637?

Within 24 hours, notify IT and end-user groups of the required patch and audit Chrome desktop deployment scope across the organization. Within 7 days, deploy Chrome 151.0.7922.72 or later to all affected systems using standard patch management procedures; prioritize systems on networks where external attackers may be present. Within 30 days, validate patch compliance across all endpoints and investigate any systems that failed to update automatically to ensure complete coverage.

Google Chrome EUVD-2026-50637

| CVE-2026-17888 HIGH

Improper Input Validation (CWE-20)

2026-07-30 Chrome

GHSA-4g93-9mx8-6qjj

Information Disclosure Google

High

Disputed · 7.1 Vendor: Chrome

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY

7.1 HIGH

AV:A/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L

vuln.today AI

7.1 HIGH

Description states adjacent malicious network traffic (AV:A) with no auth or interaction (PR:N/UI:N); a sandbox escape crosses a trust boundary (S:C) with partial, not total, impact (C/I/A:L).

3.1 AV:A/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L

4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L

SUSE

CRITICAL

qualitative

Red Hat

7.1 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 20:36 vuln.today

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:19 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:19 cve.org

HIGH 7.1

DescriptionCVE.org

Insufficient validation of untrusted input in WebUI in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via malicious network traffic. (Chromium security severity: Medium)

AnalysisAI

Sandbox escape in Google Chrome desktop before 151.0.7922.72 stems from insufficient validation of untrusted input in a WebUI component, letting a remote attacker on the same network segment potentially break out of the renderer sandbox via malicious network traffic. Google rates the Chromium severity as Medium and vendor-tagged intelligence flags it as 'Potential RCE'; a vendor patch is available, but no public exploit identified at time of analysis and EPSS is low (0.17%, 6th percentile). CISA SSVC records no observed exploitation and only partial technical impact.

Technical ContextAI

Chrome's WebUI is the internal chrome:// interface layer (settings, downloads, new-tab, etc.) implemented with privileged HTML/JS bindings that bridge the sandboxed renderer to higher-privilege browser-process functionality. The root cause is CWE-20 (Improper Input Validation): a WebUI surface accepts network-sourced data without adequately validating it, and because WebUI pages hold Mojo/browser-process bindings, a validation gap there can be leveraged to cross the renderer sandbox boundary. The single affected CPE is cpe:2.3:a:google:chrome:*, i.e. the Chrome desktop browser application across affected builds prior to 151.0.7922.72.

RemediationAI

Vendor-released patch: Chrome 151.0.7922.72 - upgrade to that Stable channel build or later on all desktop platforms, then fully relaunch the browser so the new binary loads (Chrome staged updates do not take effect until restart). Verify via chrome://settings/help and, in managed fleets, confirm the auto-update policy is enabled and not pinned to an older version. Details are in the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Because exploitation is network-adjacent, an interim compensating control is to keep untrusted devices off the same LAN segment as sensitive workstations and restrict/monitor local network traffic to browsers; this reduces the adjacent-attacker surface but does not fix the underlying WebUI validation flaw, so patching remains the durable remedy.