What is the CVSS score of EUVD-2026-50772?

EUVD-2026-50772 has a contested CVSS base score of 6.5 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for EUVD-2026-50772?

Yes, a patch is available for EUVD-2026-50772. Update the affected software to the latest version immediately.

Google Chrome EUVD-2026-50772

| CVE-2026-17823 MEDIUM

Origin Validation Error (CWE-346)

2026-07-30 Chrome

GHSA-92f5-vrgr-rqhv

Google Authentication Bypass Red Hat Suse

Medium

Disputed · 6.5 Vendor: Chrome

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

vuln.today AI

6.5 MEDIUM

Network-delivered via crafted page (AV:N/AC:L); victim must visit it (UI:R/PR:N); SOP bypass yields high integrity impact (I:H) with no confidentiality or availability consequence and no scope change.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

7.1 HIGH

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 31, 2026 - 16:30 vuln.today

CVSS changed

Jul 31, 2026 - 16:22 NVD

6.5 (MEDIUM)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:19 cve.org

MEDIUM 6.5

CVE Published

Jul 30, 2026 - 00:19 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Insufficient policy enforcement in WebXR in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Same-origin policy bypass in Google Chrome's WebXR subsystem prior to 151.0.7922.72 allows a remote attacker to violate cross-origin integrity boundaries by luring a victim to a crafted HTML page. The flaw arises from insufficient policy enforcement (CWE-346: Origin Validation Error) in the WebXR API, enabling cross-origin write or manipulation operations that Chrome's SOP should prevent. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Deliver phishing link to victim

Delivery

Victim opens crafted HTML page in vulnerable Chrome

Exploit

Crafted page invokes WebXR API with malicious parameters

Execution

WebXR subsystem fails to enforce origin validation

Persist

Same-origin policy boundary bypassed

Impact

Attacker script performs unauthorized cross-origin integrity violation

Access

Deliver phishing link to victim

Delivery

Victim opens crafted HTML page in vulnerable Chrome

Exploit

Crafted page invokes WebXR API with malicious parameters

Execution

WebXR subsystem fails to enforce origin validation

Persist

Same-origin policy boundary bypassed

Impact

Attacker script performs unauthorized cross-origin integrity violation

Vulnerability AssessmentAI

Exploitation	Exploitation requires the victim to actively visit a crafted HTML page using a vulnerable version of Google Chrome (prior to 151.0.7922.72), confirmed by the CVSS UI:R metric. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) characterizes a network-reachable, low-complexity attack that requires no attacker privileges but does require the victim to interact with a crafted page (UI:R). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker crafts a malicious HTML page that invokes the WebXR API in a manner that triggers the origin validation failure, then delivers the page URL to a victim via phishing email or compromised advertisement. When the victim opens the link in a vulnerable version of Chrome, the attacker's script bypasses the same-origin policy and performs cross-origin write or manipulation operations against another origin's content or state. …
Remediation	Update Google Chrome to version 151.0.7922.72 or later, which is confirmed by vendor advisory to contain the fix for this WebXR policy enforcement flaw (https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html). … Detailed patch versions, workarounds, and compensating controls in full report.