What is the CVSS score of EUVD-2026-50760?

EUVD-2026-50760 has a contested CVSS base score of 7.1 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by EUVD-2026-50760?

Google Chrome on Windows contains a use-after-free vulnerability in the ANGLE graphics layer (CVE-2026-17811, CVSS 7.1) that permits remote attackers to escape the browser sandbox and potentially…. A patch is available.

How to fix or mitigate EUVD-2026-50760?

Within 24 hours, communicate the vulnerability to Chrome users and request immediate browser updates to version 151.0.7922.72 or later; enable auto-update where policy permits and monitor security feeds for exploitation signals. Within 7 days, validate that organizational Chrome instances have updated to the patched version (151.0.7922.72+) and deploy forced updates via group policy or endpoint management systems, confirming coverage across all Windows endpoints. Within 30 days, complete a full deployment audit to verify patch coverage across the environment, disable legacy Chrome versions on corporate systems, and review endpoint access controls to limit potential blast radius should sandbox escape occur.

Google Chrome EUVD-2026-50760

| CVE-2026-17811 HIGH

Use After Free (CWE-416)

2026-07-30 Chrome

GHSA-wwmx-jr76-9vv7

Denial Of Service Google Use After Free Memory Corruption Microsoft

High

Disputed · 7.1 Vendor: Chrome

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

7.1 HIGH

Remote crafted page needs a victim visit (UI:R) but no auth (PR:N); ANGLE UAF enabling sandbox escape crosses a trust boundary (S:C) with limited demonstrated C/I/A impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L

SUSE

CRITICAL

qualitative

Red Hat

9.6 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 31, 2026 - 14:23 vuln.today

CVSS changed

Jul 31, 2026 - 14:22 NVD

7.1 (HIGH)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:19 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:19 cve.org

HIGH 7.1

DescriptionCVE.org

Use after free in ANGLE in Google Chrome on Windows prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Sandbox escape in Google Chrome's ANGLE graphics layer on Windows (versions prior to 151.0.7922.72) lets a remote attacker who lures a victim to a crafted HTML page trigger a use-after-free that can potentially break out of the renderer/GPU sandbox. Google rated the Chromium security severity Medium and has shipped a fix; there is no public exploit identified at time of analysis and the EPSS score is low (0.17%, 7th percentile), indicating limited near-term exploitation likelihood despite the serious impact class.

Technical ContextAI

The flaw lives in ANGLE (Almost Native Graphics Layer Engine), Chrome's abstraction layer that translates WebGL/OpenGL ES calls from web content into native graphics APIs - on Windows this is primarily Direct3D. ANGLE executes in the sandboxed GPU process, a well-known chaining target because a memory bug there can weaken or bypass renderer isolation. The root cause is CWE-416 (Use After Free): an object is freed while a dangling reference remains reachable, and subsequent access to that freed memory can be manipulated to corrupt state and influence control flow, here in the context of a graphics operation driven by attacker-controlled HTML/WebGL content.

RemediationAI

Vendor-released patch: update Google Chrome to 151.0.7922.72 or later on Windows via the Chrome stable channel (Settings > About Chrome triggers the update; relaunch to apply), per the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. In managed environments, push the updated build through enterprise patch management and force a browser relaunch since the fix only takes effect after restart. As an interim compensating control before patching, you can disable hardware-accelerated graphics (Settings > System > 'Use graphics acceleration when available', or the --disable-gpu flag / equivalent enterprise policy) to reduce ANGLE attack surface - trade-off: this degrades WebGL, video, and rendering performance and may break graphics-heavy web apps, so it is only a short-term stopgap until the update is deployed.