What is the CVSS score of EUVD-2026-50678?

EUVD-2026-50678 has a contested CVSS base score of 9.6 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by EUVD-2026-50678?

Google Chrome versions prior to 151.0.7922.72 contain a critical sandbox escape vulnerability in the WebGPU implementation; no public exploit identified at time of analysis, though successful…. A patch is available.

How to fix or mitigate EUVD-2026-50678?

Within 24 hours, communicate the advisory to IT and affected teams, and create an inventory of Chrome deployments to identify systems running versions prior to 151.0.7922.72. Within 7 days, push patches to systems with the highest user risk exposure (those accessing untrusted content). Complete deployment of Chrome 151.0.7922.72 or later across the entire organization within 30 days.

Google Chrome EUVD-2026-50678

| CVE-2026-17758 CRITICAL

Heap-based Buffer Overflow (CWE-122)

2026-07-30 Chrome

GHSA-ffm3-9wph-xpfx

Buffer Overflow Google Heap Overflow Red Hat Suse

Critical

Disputed · 9.6 Vendor: Chrome

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

8.3 HIGH

Remote crafted page needs only user visit (PR:N/UI:R), but reliable heap-overflow sandbox escape requires exploit sophistication so AC:H; scope changes (S:C) on escape with full host impact.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

CRITICAL

qualitative

Red Hat

9.6 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 17:25 vuln.today

CVSS changed

Jul 30, 2026 - 17:22 NVD

9.6 (CRITICAL)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:19 cve.org

CRITICAL 9.6

CVE Published

Jul 30, 2026 - 00:19 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Heap buffer overflow in Dawn in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Sandbox escape in Google Chrome's Dawn WebGPU implementation (versions prior to 151.0.7922.72) lets a remote attacker corrupt heap memory in the GPU process via a crafted HTML page, potentially breaking out of the renderer sandbox to compromise the host. The CVSS 3.1 vector (AV:N/UI:R/S:C, base 9.6) reflects that exploitation only needs a victim to visit a malicious site but crosses a security boundary; Google rates the Chromium severity as Medium. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Lure victim to crafted HTML page

Delivery

Malicious JavaScript issues WebGPU calls

Exploit

Trigger heap buffer overflow in Dawn

Execution

Corrupt GPU-process memory

Persist

Escape renderer sandbox

Impact

Execute code on host

Access

Lure victim to crafted HTML page

Delivery

Malicious JavaScript issues WebGPU calls

Exploit

Trigger heap buffer overflow in Dawn

Execution

Corrupt GPU-process memory

Persist

Escape renderer sandbox

Impact

Execute code on host

Vulnerability AssessmentAI

Exploitation	Exploitation requires the victim to load an attacker-controlled HTML page in a vulnerable Chrome (prior to 151.0.7922.72) with WebGPU/Dawn enabled - WebGPU is enabled by default on supported platforms and GPUs, so most default desktop installs are exposed. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	Signals conflict and should be weighed together. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker hosts a malicious web page containing crafted WebGPU/JavaScript that drives Dawn into an out-of-bounds heap write, then lures a victim into visiting it (link, ad, or compromised site). Given UI:R and low attack complexity, a single page load in a vulnerable Chrome could corrupt GPU-process memory and, if chained successfully, escape the sandbox to run code on the host. …
Remediation	Vendor-released patch: update Google Chrome to 151.0.7922.72 or later on the Stable channel, which contains the Dawn fix; verify via chrome://settings/help and relaunch to complete the update, as Chrome staged rollouts can delay automatic delivery. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, communicate the advisory to IT and affected teams, and create an inventory of Chrome deployments to identify systems running versions prior to 151.0.7922.72. …

Threat intelligence, references, and detailed analysis are available after sign-in.