What is the CVSS score of EUVD-2026-50726?

EUVD-2026-50726 has a contested CVSS base score of 4.3 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for EUVD-2026-50726?

Yes, a patch is available for EUVD-2026-50726. Update the affected software to the latest version immediately.

Google Chrome EUVD-2026-50726

| CVE-2026-17777 MEDIUM

Origin Validation Error (CWE-346)

2026-07-30 Chrome

GHSA-f4q8-p5r9-h46m

Information Disclosure Google

Medium

Disputed · 4.3 Vendor: Chrome

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

vuln.today AI

4.3 MEDIUM

Network delivery via crafted page, no attacker privileges, mandatory victim navigation; impact limited to partial confidentiality with no integrity or availability effect.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

6.5 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 14:47 vuln.today

CVSS changed

Jul 30, 2026 - 14:37 NVD

4.3 (MEDIUM)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:19 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:19 cve.org

MEDIUM 4.3

DescriptionCVE.org

Inappropriate implementation in Autofill in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Cross-origin data leakage in Google Chrome's Autofill component (versions prior to 151.0.7922.72) allows remote attackers to read data from a different origin than the page being visited. Exploitation requires the victim to interact with a specially crafted HTML page, placing this firmly in the social-engineering/phishing threat model. No public exploit code has been identified and EPSS sits at 0.21% (11th percentile), indicating negligible observed exploitation activity; this is not currently listed in CISA KEV.

Technical ContextAI

CWE-346 (Origin Validation Error) identifies the root cause: Chrome's Autofill subsystem fails to correctly enforce the Same-Origin Policy when deciding which origin is permitted to access or trigger autofill data. Autofill manages stored form data including addresses, credentials, and payment card details. An improper origin check in this pipeline can cause the browser to surface data associated with Origin A while processing a page from Origin B, effectively bypassing a core browser security boundary. The affected scope per CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covering all Chrome desktop stable builds before 151.0.7922.72 across platforms.

RemediationAI

Upgrade Google Chrome to stable channel version 151.0.7922.72 or later, as released by Google and documented at http://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Chrome's auto-update mechanism handles consumer devices automatically, but enterprise administrators managing Chrome via policies should verify deployment of 151.0.7922.72 through their MDM or Chrome Browser Cloud Management console. As a compensating control before patching, administrators can disable Autofill entirely via Chrome enterprise policies AutofillAddressEnabled=false and AutofillCreditCardEnabled=false - note this removes form-fill convenience for users and may increase help-desk load. Web filtering to block access to untrusted or newly registered domains reduces the phishing surface that enables delivery of the crafted page required for exploitation.