What is the CVSS score of EUVD-2026-50645?

EUVD-2026-50645 has a contested CVSS base score of 7.5 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by EUVD-2026-50645?

Google Chrome versions prior to 151.0.7922.72 contain a remote code execution vulnerability in DevTools that allows attackers to execute arbitrary code within the browser sandbox when users visit a…. A patch is available.

How to fix or mitigate EUVD-2026-50645?

Within 24 hours, notify all Chrome users and administrators to prioritize updating to version 151.0.7922.72 or later. Within 7 days, implement automated Chrome update enforcement for enterprise devices and verify that vulnerable versions are no longer present in the environment; monitor update compliance metrics. Within 30 days, conduct a post-patch audit to confirm patch adoption rates exceed 95% and establish a patch deployment cadence to address Chrome updates within 14 days of vendor release.

Google Chrome EUVD-2026-50645

| CVE-2026-17896 HIGH

Use After Free (CWE-416)

2026-07-30 Chrome

GHSA-fgwx-rxh3-crgv

RCE Denial Of Service Google Use After Free Memory Corruption

High

Disputed · 7.5 Vendor: Chrome

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY

7.5 HIGH

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

7.5 HIGH

Network-delivered crafted page with no auth (PR:N) but a UAF race needing UI:R and AC:H; scope unchanged as code runs in the renderer sandbox, with high renderer C/I/A impact.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

7.6 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 17:29 vuln.today

CVSS changed

Jul 30, 2026 - 17:22 NVD

7.5 (HIGH)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:19 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:19 cve.org

HIGH 7.5

DescriptionCVE.org

Use after free in DevTools in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Sandboxed remote code execution in Google Chrome's DevTools component (versions prior to 151.0.7922.72) lets a remote attacker run arbitrary code within the renderer sandbox when a victim opens a crafted HTML page. The flaw is a use-after-free (CWE-416) rated Medium by Chromium; no public exploit has been identified and EPSS estimates only a 0.27% exploitation probability, indicating low near-term likelihood despite the high CVSS base score. Critically, code execution is confined to the sandbox and does not by itself constitute a full host compromise.

Technical ContextAI

The vulnerability resides in Chrome DevTools, the built-in developer/debugging surface of the Chromium engine that powers Google Chrome (CPE cpe:2.3:a:google:chrome). The root cause is CWE-416 (Use After Free): an object in DevTools is freed while a reference to it remains live, and a crafted page can then cause that dangling pointer to be reused, corrupting memory and steering control flow. Because Chromium isolates renderer/DevTools processes, the resulting code execution occurs inside the browser sandbox rather than at OS privilege - the description explicitly states 'execute arbitrary code inside a sandbox,' meaning this is not a standalone sandbox escape.

RemediationAI

Vendor-released patch: 151.0.7922.72 - update Google Chrome to 151.0.7922.72 or later via the Chrome Releases advisory (https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html); Chrome normally auto-updates, so ensure the browser is fully closed and relaunched to apply the update and confirm the version under chrome://settings/help. In managed fleets, push the updated build through your enterprise update policy. As an interim compensating measure while updates roll out, restrict use of DevTools on untrusted pages and avoid opening developer tooling on unknown sites; note that fully disabling DevTools via the DeveloperToolsAvailability enterprise policy reduces exposure to this DevTools-specific bug but breaks legitimate developer workflows, so scope it to non-developer user groups.