What is the CVSS score of EUVD-2026-50746?

EUVD-2026-50746 has a contested CVSS base score of 6.1 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for EUVD-2026-50746?

Yes, a patch is available for EUVD-2026-50746. Update the affected software to the latest version immediately.

Google Chrome EUVD-2026-50746

| CVE-2026-17797 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-07-30 Chrome

GHSA-q345-5hjq-5q84

XSS Google

Medium

Disputed · 6.1 Vendor: Chrome

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

vuln.today AI

6.1 MEDIUM

Network delivery via crafted page requires passive victim navigation (UI:R); UXSS cross-origin boundary crossing warrants scope change (S:C); no privileges or special config needed; no availability impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

SUSE

CRITICAL

qualitative

Red Hat

8.1 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 31, 2026 - 15:31 vuln.today

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:19 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:19 cve.org

MEDIUM 6.1

DescriptionCVE.org

Inappropriate implementation in CSS in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Universal Cross-Site Scripting (UXSS) in Google Chrome's CSS implementation enables a remote attacker to inject arbitrary scripts or HTML across origin boundaries by directing a victim to a crafted HTML page. All Chrome desktop versions prior to 151.0.7922.72 are affected. No public exploit has been identified at time of analysis and CISA SSVC rates exploitation as none, but the cross-origin scope change makes this meaningfully more impactful than a standard reflected XSS, warranting timely patching given Chrome's ubiquitous deployment footprint.

Technical ContextAI

The flaw (CWE-79, Improper Neutralization of Input During Web Page Generation) resides in Chrome's CSS processing engine, where an inappropriate implementation allows attacker-controlled style data to escape normal origin isolation constraints. CSS-based UXSS attacks typically manipulate how the browser processes and applies stylesheet rules in ways that break the Same-Origin Policy, enabling injection of scripts into contexts belonging to other origins. The CVSS scope change (S:C) formally encodes this cross-origin boundary crossing. The affected product is identified via CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, covering all desktop Chrome builds prior to the 151.0.7922.72 stable release. Chromium's security severity is rated Medium, consistent with the CVSS 6.1 base score.

RemediationAI

Update Google Chrome to version 151.0.7922.72 or later, available via Chrome's built-in automatic update mechanism or the Chrome Releases blog at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Enterprise administrators managing Chrome through group policy or fleet management tools should deploy this version through their standard update pipeline. If immediate patching is not operationally feasible, restricting end-user navigation to untrusted or unknown web pages reduces exposure, though this imposes significant usability trade-offs and is not a substitute for patching. Enabling Chrome's Enhanced Safe Browsing mode provides partial protection against known malicious pages but does not remediate the underlying CSS implementation flaw. No configuration-level workaround that fully mitigates the vulnerability has been identified in available references.