What is the CVSS score of EUVD-2026-50718?

EUVD-2026-50718 has a contested CVSS base score of 4.3 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for EUVD-2026-50718?

Yes, a patch is available for EUVD-2026-50718. Update the affected software to the latest version immediately.

Google Chrome EUVD-2026-50718

| CVE-2026-17769 MEDIUM

Improper Input Validation (CWE-20)

2026-07-30 Chrome

GHSA-cpj5-9358-f9hq

Information Disclosure Google

Medium

Disputed · 4.3 Vendor: Chrome

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

vuln.today AI

4.3 MEDIUM

Network-delivered via crafted HTML requiring user visit (UI:R); Cast flaw leaks only limited cross-origin data (C:L); no integrity, availability, or scope change applies.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

6.5 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 14:45 vuln.today

CVSS changed

Jul 30, 2026 - 14:37 NVD

4.3 (MEDIUM)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:19 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:19 cve.org

MEDIUM 4.3

DescriptionCVE.org

Insufficient validation of untrusted input in Cast in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Cross-origin data leakage in Google Chrome's Cast component exposes sensitive information across origins to remote attackers who can induce a victim to visit a crafted HTML page. All Chrome desktop versions prior to 151.0.7922.72 are affected across Windows, macOS, and Linux. No public exploit code or CISA KEV listing exists at time of analysis, and EPSS at 0.21% (11th percentile) reflects low current exploitation probability, consistent with Google's own 'Medium' severity classification.

Technical ContextAI

The affected component is Chrome's Cast subsystem, which implements media streaming and screen-casting functionality (e.g., Chromecast integration). The root cause is CWE-20 (Improper Input Validation): the Cast feature fails to adequately validate untrusted data received via a crafted HTML page, allowing the Same-Origin Policy (SOP) - a foundational browser security boundary separating data between web origins - to be circumvented. The CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covers all desktop Chrome installations. Because Cast is enabled by default and processes content from web pages, this flaw is reachable from the web without any special runtime configuration.

RemediationAI

Update Google Chrome to version 151.0.7922.72 or later via the stable channel; details are at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Chrome's auto-update mechanism handles this silently for most users, but enterprise administrators should verify fleet compliance using Chrome Browser Cloud Management or equivalent endpoint tooling. Where immediate patching is not feasible, disabling the Cast/Chromecast feature via the Chrome enterprise policy MediaRouterEnabled=false (or EnableMediaRouter=false in older policy schemas) eliminates the Cast component's attack surface entirely, with the trade-off of removing all casting and Google Meet screen-sharing functionality for affected users.