What is the CVSS score of EUVD-2026-50665?

EUVD-2026-50665 has a contested CVSS base score of 7.5 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by EUVD-2026-50665?

Google Chrome versions prior to 151.0.7922.72 contain a privilege escalation vulnerability allowing attackers to exceed security controls once the browser is compromised.. A patch is available.

How to fix or mitigate EUVD-2026-50665?

Within 24 hours, inventory Chrome deployments across the organization to identify systems running versions prior to 151.0.7922.72. Within 7 days, deploy Chrome 151.0.7922.72 or later through your standard patch management process-prioritizing systems with elevated risk or access to sensitive data. Within 30 days, verify patch deployment completion across all systems and monitor Chrome usage reporting to confirm vulnerable versions have been eliminated from your environment.

Google Chrome EUVD-2026-50665

| CVE-2026-17916 HIGH

Origin Validation Error (CWE-346)

2026-07-30 Chrome

GHSA-52f6-xjj9-9jr4

Privilege Escalation Google

High

Disputed · 7.5 Vendor: Chrome

Severity by source

Sources disagree (Low–Critical)

Vendor (Chrome) PRIMARY

7.5 HIGH

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

4.2 MEDIUM

Requires a prior renderer compromise plus user interaction and high complexity; impact limited (Chromium rated Low), so C:L/I:L/A:N rather than the input's H/H/H.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N

4.0 AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

3.3 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 13:29 vuln.today

CVSS changed

Jul 30, 2026 - 13:22 NVD

7.5 (HIGH)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:25 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:25 cve.org

HIGH 7.5

DescriptionCVE.org

Insufficient policy enforcement in Settings in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to perform privilege escalation via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Privilege escalation in Google Chrome desktop versions prior to 151.0.7922.72 allows a remote attacker who has already compromised the renderer process to escape its intended privilege boundary through insufficient policy enforcement in the Settings component, using a crafted HTML page. Chromium rated the security severity as Low, and there is no public exploit identified at time of analysis. The vulnerability is a second-stage flaw: it presumes a prior renderer compromise, so it is not directly exploitable against a fully intact browser.

Technical ContextAI

The flaw lives in Chrome's Settings component, where policy enforcement checks are insufficient to prevent a compromised renderer from performing actions above its intended privilege level. Chromium's multi-process architecture sandboxes the renderer (which parses untrusted web content) away from more privileged browser-process functionality; this bug weakens that boundary at the Settings surface. No CWE was assigned in the input, but the behavior maps to the improper-privilege-management / insufficient-policy-enforcement class of weaknesses. The affected surface is the Chrome desktop application, identified by CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, tracked upstream at Chromium issue 510808598.

RemediationAI

Vendor-released patch: Chrome 151.0.7922.72 - upgrade to this Stable-channel version or later on all desktop platforms (Windows, macOS, Linux) via the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Chrome auto-updates for most users, so ensure the browser has been fully relaunched to apply the update, and in managed fleets confirm the enterprise update policy is not pinning an older version. Because exploitation requires a prior renderer compromise, keeping Chrome fully current (which closes the upstream renderer bugs this would chain from) is itself the most effective compensating control; there is no product-specific standalone workaround, so the trade-off of delaying the update is leaving the privilege-escalation link in an exploit chain open.