What is the CVSS score of EUVD-2026-50779?

EUVD-2026-50779 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Google Chrome are affected by EUVD-2026-50779?

Google Chrome versions prior to 151.0.7922.72 contain a sandbox escape vulnerability in the Skia graphics library (CVSS 8.3) that permits attackers with renderer-process access to escalate to…. A patch is available.

How to fix or mitigate EUVD-2026-50779?

Within 24 hours, inventory Chrome versions across all endpoints and alert users to the critical update requirement. Within 7 days, deploy Google Chrome 151.0.7922.72 or later organization-wide using group policy, software distribution, or auto-update enforcement. Within 30 days, verify rollout completion through endpoint audit and confirm zero instances of vulnerable versions remain in the environment.

Google Chrome EUVD-2026-50779

| CVE-2026-17653 HIGH

Use After Free (CWE-416)

2026-07-30 Chrome

GHSA-vg76-cfgp-x25q

Denial Of Service Google Use After Free Memory Corruption

8.3

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

8.0 HIGH

Requires a pre-compromised renderer (PR:L) and reliable heap grooming plus user interaction (AC:H, UI:R); sandbox escape crosses a trust boundary (S:C) with full host impact.

3.1 AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

CRITICAL

qualitative

Red Hat

9.0 CRITICAL

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 23:32 vuln.today

CVSS changed

Jul 30, 2026 - 21:37 NVD

8.3 (HIGH)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:18 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:18 cve.org

HIGH 8.3

DescriptionCVE.org

Use after free in Skia in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

AnalysisAI

Sandbox escape in Google Chrome's Skia graphics library (versions prior to 151.0.7922.72) allows a remote attacker who has already compromised the renderer process to break out of the sandbox and gain broader access on the host via a crafted HTML page. Google rates the Chromium severity as Critical, and CVSS is 8.3 due to the scope change (S:C) reflecting the sandbox boundary crossing. No public exploit identified at time of analysis, and EPSS probability is low (0.31%), consistent with an exploit that requires chaining from a prior renderer compromise.

Technical ContextAI

The flaw is a CWE-416 use-after-free in Skia, the open-source 2D graphics rendering engine that Chrome (and Chromium-derived browsers) uses to rasterize web content, canvas, and compositing operations. A use-after-free occurs when memory is freed but a dangling pointer to it is subsequently dereferenced, allowing an attacker who controls heap allocations to reclaim the freed region and manipulate program flow. Because Skia code executes across process boundaries in Chrome's multi-process architecture, a UAF here can be leveraged from a compromised renderer to corrupt memory in a more privileged context, enabling a sandbox escape. The single affected CPE is cpe:2.3:a:google:chrome:*, i.e. the Chrome desktop browser.

RemediationAI

Vendor-released patch: Google Chrome 151.0.7922.72. Update Chrome to 151.0.7922.72 or later via Help > About Google Chrome (which triggers the update and requires a browser restart to apply) or through managed enterprise deployment channels; see the advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html and the tracking bug at https://issues.chromium.org/issues/520514458. Users of Chromium-based browsers (Edge, Brave, Opera, Vivaldi) should apply the equivalent vendor update once their maintainers pick up the patched Skia. As an interim compensating control before patching, restrict browsing to trusted sites and avoid untrusted HTML content, since exploitation requires rendering a crafted page; because this is a sandbox-escape stage that depends on a prior renderer compromise, keeping the renderer itself patched and enabling site isolation reduces the chance an attacker reaches this primitive, though neither fully substitutes for the fix.