What is the CVSS score of EUVD-2026-50780?

EUVD-2026-50780 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by EUVD-2026-50780?

Google Chrome's Updater on macOS versions before 151.0.7922.72 can be exploited by attackers with local system access to gain administrative privileges, potentially taking over affected machines.. A patch is available.

How to fix or mitigate EUVD-2026-50780?

Within 24 hours, inventory all macOS systems to identify those running Google Chrome versions prior to 151.0.7922.72. Within 7 days, deploy Chrome version 151.0.7922.72 or later across all affected macOS systems using your standard patch management process, prioritizing high-risk and client-facing systems. Within 30 days, conduct a security assessment of systems that experienced prolonged exposure to identify any indicators of compromise, and implement automated Chrome version monitoring to prevent future exposure gaps.

Google Chrome EUVD-2026-50780

| CVE-2026-17654 HIGH

Race Condition (CWE-362)

2026-07-30 Chrome

GHSA-vmw9-hq9j-9x52

Google Privilege Escalation Race Condition Red Hat Suse

7.8

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

7.0 HIGH

Local attack requiring a malicious file and user interaction, with AC:H because winning the CWE-362 race is a timing-dependent condition; full CIA impact via privilege escalation.

3.1 AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

8.8 CRITICAL

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 13:24 vuln.today

CVSS changed

Jul 30, 2026 - 13:22 NVD

7.8 (HIGH)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:18 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:18 cve.org

HIGH 7.8

DescriptionCVE.org

Race in Updater in Google Chrome on Mac prior to 151.0.7922.72 allowed a local attacker to perform OS-level privilege escalation via a malicious file. (Chromium security severity: Critical)

AnalysisAI

Local OS-level privilege escalation in Google Chrome's Updater on macOS (versions prior to 151.0.7922.72) allows a local attacker who can plant a malicious file to exploit a race condition and elevate privileges on the host. Google rated the underlying Chromium bug Critical, though the CVSS base score is 7.8 (High) reflecting the local attack vector and required user interaction. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Gain local unprivileged access on macOS

Delivery

Plant malicious file in updater path

Exploit

Trigger privileged Chrome update

Execution

Win race in Updater (CWE-362)

Persist

Privileged updater acts on malicious file

Impact

OS-level privilege escalation

Access

Gain local unprivileged access on macOS

Delivery

Plant malicious file in updater path

Exploit

Trigger privileged Chrome update

Execution

Win race in Updater (CWE-362)

Persist

Privileged updater acts on malicious file

Impact

OS-level privilege escalation

Vulnerability AssessmentAI

Exploitation	Exploitation requires local access to the macOS host and the ability to plant a malicious file that the Google Chrome Updater processes, then to win the CWE-362 race condition timing window during a privileged update operation. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (7.8 High) indicates local access (AV:L) with low complexity, no privileges required, but mandatory user interaction (UI:R), and high impact to confidentiality, integrity, and availability - consistent with a local EoP rather than a remote compromise. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	A local, unprivileged user (or malware already running at user level) plants a crafted malicious file in a location the Chrome Updater processes, then races the privileged update operation to win the timing window between validation and use. Winning the race causes the elevated updater to act on the attacker's file, granting OS-level privileges. …
Remediation	Vendor-released patch: update Google Chrome to 151.0.7922.72 or later on macOS via the Chrome Stable channel; the fix is documented at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. … Detailed patch versions, workarounds, and compensating controls in full report.