What is the CVSS score of EUVD-2026-50701?

EUVD-2026-50701 has a contested CVSS base score of 8.8 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by EUVD-2026-50701?

Google Chrome versions prior to 151.0.7922.72 on desktop contain an unauthenticated vulnerability enabling arbitrary code execution within the browser's sandbox when users visit malicious websites.. A patch is available.

How to fix or mitigate EUVD-2026-50701?

Within 24 hours, communicate patch availability (Chrome 151.0.7922.72) to end users and verify automatic update policies are enabled in your environment. Within 7 days, use your endpoint management system to confirm all Chrome instances have updated to version 151.0.7922.72 or later, prioritizing business-critical roles and internet-facing devices. Within 30 days, conduct a comprehensive audit of Chrome deployment across all endpoints to achieve 100% patch compliance and document any legacy systems unable to update for risk acceptance.

Google Chrome EUVD-2026-50701

| CVE-2026-17751 HIGH

Improper Privilege Management (CWE-269)

2026-07-30 Chrome

GHSA-775j-7vvx-3xm5

Privilege Escalation RCE Google

High

Disputed · 8.8 Vendor: Chrome

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Remote crafted page needs no auth but requires the user to visit it (UI:R); high renderer-context C/I/A with scope unchanged since impact is sandbox-contained.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

6.3 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 17:24 vuln.today

CVSS changed

Jul 30, 2026 - 17:22 NVD

8.8 (HIGH)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:19 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:19 cve.org

HIGH 8.8

DescriptionCVE.org

Inappropriate implementation in AdFilter in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Sandboxed arbitrary code execution in Google Chrome's AdFilter component (versions prior to 151.0.7922.72 on desktop) allows a remote attacker to run code inside the renderer sandbox by luring a victim to a crafted HTML page. Rated Medium by Chromium and CVSS 8.8 by NVD, the flaw requires user interaction (visiting a malicious site) but no authentication; execution is confined to the sandbox rather than achieving full host compromise. There is no public exploit identified at time of analysis, and EPSS is low at 0.26% (17th percentile).

Technical ContextAI

The vulnerability lives in Chrome's AdFilter subsystem, part of the browser's content/ad-blocking and filtering logic that parses and acts on attacker-influenced HTML/DOM content within the renderer process. It is classified as CWE-269 (Improper Privilege Management), meaning the component mishandles a privilege or trust boundary such that attacker-controlled page content can drive code execution within the renderer's security context. The affected component runs inside Chrome's multi-process sandbox, so the described 'arbitrary code execution inside a sandbox' means the attacker gains code execution in the constrained renderer rather than in the higher-privileged browser or OS context - a meaningful limitation that aligns with Chromium's 'Medium' internal severity despite the high NVD CVSS.

RemediationAI

Vendor-released patch: update Google Chrome to 151.0.7922.72 or later on the desktop Stable channel, per the Chrome Releases advisory (https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html); relaunch the browser to complete the update since Chrome staging does not apply until restart. In managed fleets, push the update via enterprise policy or your patch-management tooling and force a browser relaunch to ensure the patched binary is loaded. No standalone workaround is provided by the vendor for the AdFilter defect itself; as interim compensating controls until the update is deployed, restrict browsing to trusted sites and use web/DNS filtering to block untrusted or newly-registered domains (trade-off: does not stop malicious content on otherwise-trusted or compromised sites), and ensure OS-level and site-isolation sandbox protections remain enabled since the flaw is sandbox-contained and site isolation raises the bar for a full escape. Verify Chromium-based derivatives against their own vendor advisories and update them accordingly.