What is the CVSS score of EUVD-2026-50729?

EUVD-2026-50729 has a contested CVSS base score of 6.3 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for EUVD-2026-50729?

Yes, a patch is available for EUVD-2026-50729. Update the affected software to the latest version immediately.

Google Chrome EUVD-2026-50729

| CVE-2026-17780 MEDIUM

Improper Access Control (CWE-284)

2026-07-30 Chrome

GHSA-pv4w-f6r6-3qcw

Authentication Bypass Google

Medium

Disputed · 6.3 Vendor: Chrome

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY

6.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

vuln.today AI

5.4 MEDIUM

Navigation bypass enables limited cross-origin access supporting C:L and I:L; no mechanism for availability impact is described, so A:N is assessed rather than A:L.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

6.5 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 31, 2026 - 20:36 vuln.today

CVSS changed

Jul 31, 2026 - 18:37 NVD

6.3 (MEDIUM)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:19 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:19 cve.org

MEDIUM 6.3

DescriptionCVE.org

Inappropriate implementation in Isolated Web Apps in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Navigation restriction bypass in Google Chrome's Isolated Web Apps (IWA) subsystem allows remote unauthenticated attackers to circumvent sandboxing controls by luring a user to a crafted HTML page. Versions prior to 151.0.7922.72 are affected. No public exploit exists and SSVC confirms no active exploitation; with an EPSS of 0.22% at the 13th percentile, this is a medium-priority defect addressed by Chrome's stable-channel update released in July 2026.

Technical ContextAI

Isolated Web Apps is a Chrome security feature that enforces strict navigation restrictions, origin isolation, and content policies for installable web applications, analogous to a stricter Content Security Policy sandbox. The root cause is classified as CWE-284 (Improper Access Control): the Chrome engine does not correctly enforce navigation policy boundaries within the IWA context, allowing a crafted page to navigate to restricted origins or endpoints that should be inaccessible. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covering all Chrome variants on all platforms prior to the fixed release.

RemediationAI

Vendor-released patch: Chrome 151.0.7922.72. Update Chrome to version 151.0.7922.72 or later via the browser's built-in update mechanism (Help > About Google Chrome) or via enterprise MDM/GPO deployment; the update is documented in the stable channel advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. For organizations that cannot immediately patch, a practical interim control is to restrict or disable Isolated Web App installations via Chrome enterprise policy (IsolatedWebAppsEnabled set to false) - this eliminates the vulnerable attack surface but also disables IWA functionality for users. No alternative network-level workaround effectively mitigates this class of client-side navigation bypass.