What is the CVSS score of EUVD-2026-50694?

EUVD-2026-50694 has a contested CVSS base score of 7.1 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by EUVD-2026-50694?

Google Chrome on Linux versions before 151.0.7922.72 contains a sandbox escape vulnerability in the File Input component that allows code execution at elevated privilege levels when users visit a…. A patch is available.

How to fix or mitigate EUVD-2026-50694?

Within 24 hours, conduct an inventory of all Linux systems running Google Chrome to determine the scope of potentially vulnerable deployments. Within 7 days, deploy Chrome version 151.0.7922.72 or later across all affected Linux systems; enable automatic updates to prevent future patching delays. Within 30 days, verify complete patch coverage through endpoint management telemetry and review system logs for any unusual crash patterns or signs of exploitation.

Google Chrome EUVD-2026-50694

| CVE-2026-17744 HIGH

Improper Privilege Management (CWE-269)

2026-07-30 Chrome

GHSA-9j67-5g46-g34m

Privilege Escalation Google

High

Disputed · 7.1 Vendor: Chrome

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

7.1 HIGH

Remote crafted page needs no auth (PR:N) but requires the user to open it (UI:R); sandbox escape crosses a trust boundary (S:C) with Medium-rated Low impacts.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L

SUSE

CRITICAL

qualitative

Red Hat

9.6 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 19:23 vuln.today

CVSS changed

Jul 30, 2026 - 19:22 NVD

7.1 (HIGH)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:19 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:19 cve.org

HIGH 7.1

DescriptionCVE.org

Inappropriate implementation in File Input in Google Chrome on Linux prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Sandbox escape in Google Chrome on Linux before 151.0.7922.72 lets a remote attacker break out of the renderer sandbox when a victim opens a crafted HTML page, abusing an inappropriate implementation in the File Input component (CWE-269, improper privilege management). Rated Medium by Chromium and scored CVSS 7.1 with a scope change, it requires user interaction (visiting a malicious page) but no authentication; there is no public exploit identified and EPSS exploitation probability is low at 0.21% (11th percentile).

Technical ContextAI

The flaw resides in Chrome's File Input handling, the browser subsystem that mediates <input type="file"> file-picker interactions between untrusted web content and the local system. Chrome's multi-process security model confines web page rendering inside a sandboxed renderer process; a 'sandbox escape' means untrusted page-controlled code can cross that trust boundary and gain the privileges of a higher-privileged process. The root cause is classified as CWE-269 (Improper Privilege Management), indicating the File Input implementation did not correctly enforce the privilege separation the sandbox is designed to guarantee. The affected component is identified by CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, specifically the Linux desktop build.

RemediationAI

Update Google Chrome on Linux to version 151.0.7922.72 or later, which contains the vendor fix (Vendor-released patch: 151.0.7922.72) as announced in the Chrome stable channel update (https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html); restart the browser after updating so the new build loads, since Chrome applies updates only on relaunch. In managed fleets, push the update via your enterprise update policy or package manager and verify the running version reflects 151.0.7922.72+. As an interim compensating control before patching, limit exposure by restricting untrusted browsing (enforce SafeSites/URL allowlisting or route traffic through a web filter to reduce the chance of loading attacker-crafted pages), accepting the trade-off of reduced browsing flexibility; because exploitation hinges on rendering a malicious page, this lowers but does not eliminate risk. No effective per-feature toggle for File Input is documented, so patching is the definitive remedy.