What is the CVSS score of EUVD-2026-50667?

EUVD-2026-50667 has a contested CVSS base score of 8.8 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by EUVD-2026-50667?

Google Chrome versions prior to 151.0.7922.72 contain a remote code execution vulnerability (CVE-2026-17918) that could compromise user browser sessions when employees visit malicious websites.. A patch is available.

How to fix or mitigate EUVD-2026-50667?

Within 24 hours, inventory Chrome versions across the organization to determine current compliance with version 151.0.7922.72 and notify stakeholders of the patch timeline. Within 7 days, begin staged deployment of Chrome 151.0.7922.72 to pilot user groups while testing compatibility with critical business applications. Complete organization-wide patching to version 151.0.7922.72 within 30 days, verify deployment through endpoint management tools, and maintain audit logs of patch compliance.

Google Chrome EUVD-2026-50667

| CVE-2026-17918 HIGH

Use After Free (CWE-416)

2026-07-30 Chrome

GHSA-qj3x-9f7x-j3vf

RCE Denial Of Service Google Use After Free Memory Corruption

High

Disputed · 8.8 Vendor: Chrome

Severity by source

Sources disagree (Low–Critical)

Vendor (Chrome) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-reachable crafted page (AV:N), no auth (PR:N), user must open the page (UI:R), low complexity (AC:L); high renderer impact but no scope change since execution stays in the sandbox (S:U).

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

8.8 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 19:24 vuln.today

CVSS changed

Jul 30, 2026 - 19:22 NVD

8.8 (HIGH)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:25 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:25 cve.org

HIGH 8.8

DescriptionCVE.org

Use after free in Sync in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Remote code execution in Google Chrome's Sync component (versions prior to 151.0.7922.72) allows a remote attacker to run arbitrary code within the renderer sandbox when a victim visits a crafted HTML page. The flaw is a CWE-416 use-after-free reported internally by the Chrome team; it carries a CVSS 8.8 but Chromium rated the security severity as Low, and code execution is confined to the sandbox rather than the host OS. No public exploit has been identified at time of analysis, and EPSS is low at 0.21% (12th percentile).

Technical ContextAI

The vulnerability resides in Chrome's Sync feature, the subsystem that reconciles bookmarks, history, passwords, tabs and settings across a user's signed-in devices. The root cause is CWE-416 (use-after-free): an object is freed while a dangling pointer to it is still reachable, allowing an attacker to reallocate the freed memory with controlled data and hijack subsequent dereferences to corrupt memory and gain execution. Because this lives in the renderer/browser process code path exercised by page content, an attacker-controlled HTML page can drive the freed-then-reused object into a state that yields arbitrary code execution within Chrome's sandbox. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, covering the Chrome desktop stable channel.

RemediationAI

Vendor-released patch: update Google Chrome to 151.0.7922.72 or later; the fix ships via the stable channel update documented at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. In managed environments, verify auto-update is enabled and force a relaunch to apply the new binary, since the patch only takes effect after Chrome restarts. Where immediate patching is not possible, the practical compensating control is to ensure the sandbox is not disabled (do not run with --no-sandbox), which contains the arbitrary code execution to the renderer; you may also reduce exposure by restricting browsing to trusted sites via policy or web filtering, at the cost of user friction. Disabling the Chrome Sync feature is a plausible targeted mitigation given the flaw is in the Sync component, though the crafted-HTML trigger means page rendering is the exposure surface, so patching remains the only complete fix. Additional tracking reference: https://issues.chromium.org/issues/513127137.