What is the CVSS score of EUVD-2026-50772?

EUVD-2026-50772 has a contested CVSS base score of 6.5 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for EUVD-2026-50772?

Yes, a patch is available for EUVD-2026-50772. Update the affected software to the latest version immediately.

Google Chrome EUVD-2026-50772

| CVE-2026-17823 MEDIUM

Origin Validation Error (CWE-346)

2026-07-30 Chrome

GHSA-92f5-vrgr-rqhv

Authentication Bypass Google

Medium

Disputed · 6.5 Vendor: Chrome

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

vuln.today AI

6.5 MEDIUM

Network-delivered via crafted page (AV:N/AC:L); victim must visit it (UI:R/PR:N); SOP bypass yields high integrity impact (I:H) with no confidentiality or availability consequence and no scope change.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

7.1 HIGH

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 31, 2026 - 16:30 vuln.today

CVSS changed

Jul 31, 2026 - 16:22 NVD

6.5 (MEDIUM)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:19 cve.org

MEDIUM 6.5

CVE Published

Jul 30, 2026 - 00:19 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Insufficient policy enforcement in WebXR in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Same-origin policy bypass in Google Chrome's WebXR subsystem prior to 151.0.7922.72 allows a remote attacker to violate cross-origin integrity boundaries by luring a victim to a crafted HTML page. The flaw arises from insufficient policy enforcement (CWE-346: Origin Validation Error) in the WebXR API, enabling cross-origin write or manipulation operations that Chrome's SOP should prevent. No active exploitation is confirmed and EPSS is low at 0.18% (8th percentile), but a vendor patch is available and deployment is recommended given Chrome's ubiquitous footprint.

Technical ContextAI

WebXR is the browser API enabling augmented and virtual reality experiences on the web, exposed through JavaScript in the renderer process. CWE-346 (Origin Validation Error) identifies the root cause: Chrome's WebXR subsystem fails to adequately validate the calling page's origin when enforcing same-origin policy controls, allowing cross-origin policy to be sidestepped. The same-origin policy is a foundational browser security boundary preventing scripts at one origin from interfering with resources at another. CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* confirms this affects Google Chrome across all desktop platforms (Windows, macOS, Linux). The Chromium issue tracker reference (issues.chromium.org/issues/517628043) suggests the flaw was internally tracked and patched as part of Google's standard security release cycle, with severity rated Medium by the Chrome security team.

RemediationAI

Update Google Chrome to version 151.0.7922.72 or later, which is confirmed by vendor advisory to contain the fix for this WebXR policy enforcement flaw (https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html). Most consumer Chrome installations update automatically via the built-in update mechanism; administrators managing enterprise deployments should verify update propagation through Chrome Browser Cloud Management or Group Policy and confirm the installed version via chrome://settings/help. As a compensating control where immediate patching is not feasible, enterprise administrators can disable WebXR access via the WebXrEnabled Chrome policy (set to false), which eliminates the attack surface entirely at the cost of breaking any legitimate XR web applications in the environment. Restricting navigation to untrusted external sites via proxy or browser filtering also reduces exposure given that user interaction is required.