What is the CVSS score of EUVD-2026-50706?

EUVD-2026-50706 has a contested CVSS base score of 6.5 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for EUVD-2026-50706?

Yes, a patch is available for EUVD-2026-50706. Update the affected software to the latest version immediately.

Google Chrome EUVD-2026-50706

| CVE-2026-17756 MEDIUM

Client-Side Enforcement of Server-Side Security (CWE-602)

2026-07-30 Chrome

GHSA-hxg8-fjxp-xf59

Authentication Bypass Google Red Hat Suse

Medium

Disputed · 6.5 Vendor: Chrome

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

vuln.today AI

6.5 MEDIUM

Network delivery via crafted page, no attacker privileges, mandatory victim click; integrity fully compromised via navigation bypass, no confidentiality or availability impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

4.3 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 03, 2026 - 19:44 vuln.today

CVSS changed

Aug 03, 2026 - 17:37 NVD

6.5 (None) 6.5 (MEDIUM)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:19 cve.org

MEDIUM 6.5

CVE Published

Jul 30, 2026 - 00:19 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Insufficient policy enforcement in Presentation in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Navigation restriction bypass in Google Chrome's Presentation component (all versions prior to 151.0.7922.72) enables a remote attacker to circumvent enforced browser navigation policies via a specially crafted HTML page. The flaw carries a high integrity impact (I:H) with no privilege requirement on the attacker's side, though victim interaction is mandatory. EPSS sits at 0.22% (13th percentile) and SSVC classifies exploitation as 'none' with a non-automatable profile, placing this in the patch-but-not-emergency tier for most organizations. No public exploit code identified at time of analysis.

Technical ContextAI

CWE-602 ('Client-Side Enforcement of Server-Side Security') describes a root cause where security decisions that should be enforced at a trusted policy layer are instead implemented client-side and are therefore bypassable by attacker-controlled content. In Chrome, the Presentation component (governing the Presentation API, which manages content display on secondary or remote screens) enforces navigation restrictions through browser policy. Because that enforcement occurs on the client in a context reachable by page-supplied HTML, a crafted page can subvert the policy gate. CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* confirms all Chrome variants across all platforms are within scope - no platform-specific constraint is indicated by available data.

RemediationAI

Upgrade Google Chrome to version 151.0.7922.72 or later; this is the vendor-released patch confirmed via the Chrome Releases stable channel advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. In managed enterprise environments, push the update immediately via Chrome Browser Cloud Management or Group Policy (GPO) rather than relying on auto-update, to ensure fleet-wide coverage. If immediate patching is operationally blocked, consider disabling the Presentation API for managed Chrome instances via enterprise policy (PresentationReceiverForRequestedUrlsAllowlist set to an empty list), which prevents the affected component from processing untrusted page-supplied presentation requests - note this will break legitimate use of the Presentation API for secondary-screen workflows. No workaround eliminates risk as effectively as the patch.