What is the CVSS score of EUVD-2026-50785?

EUVD-2026-50785 has a contested CVSS base score of 4.2 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for EUVD-2026-50785?

Yes, a patch is available for EUVD-2026-50785. Update the affected software to the latest version immediately.

Google Chrome EUVD-2026-50785

| CVE-2026-17659 MEDIUM

Protection Mechanism Failure (CWE-693)

2026-07-30 Chrome

GHSA-hv4h-ff48-p67r

Authentication Bypass Google

Medium

Disputed · 4.2 Vendor: Chrome

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY

4.2 MEDIUM

AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N

vuln.today AI

4.7 MEDIUM

S:C assigned because site isolation bypass by definition crosses enforced security boundaries between origins; all other metrics align with the provided vector.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:H/AT:P/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

SUSE

CRITICAL

qualitative

Red Hat

8.7 HIGH

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 21:41 vuln.today

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:18 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:18 cve.org

MEDIUM 4.2

DescriptionCVE.org

Inappropriate implementation in SiteIsolation in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Site isolation bypass in Google Chrome allows a remote attacker who has already compromised the renderer process to escape cross-origin boundaries via a crafted HTML page, potentially accessing data from other open origins within the browser. All Chrome desktop versions prior to 151.0.7922.72 are affected. The CVSS 4.2 (Medium) with AC:H reflects that this is a second-stage exploitation primitive requiring prior renderer compromise, not a standalone initial access vector; no public exploit or CISA KEV listing has been identified at time of analysis.

Technical ContextAI

Site Isolation is a core Chrome security architecture that confines each website's content to a dedicated renderer process, preventing cross-origin data access even when one renderer is compromised. CWE-693 (Protection Mechanism Failure) identifies the root cause as an inappropriate implementation in the SiteIsolation subsystem - specifically a logic flaw that fails to enforce isolation boundaries correctly under adversarial conditions. The CPE string cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covers all Google Chrome desktop releases prior to 151.0.7922.72 across Windows, macOS, and Linux. The Chromium issue tracker entry (issues.chromium.org/issues/495463654) is the upstream bug reference, though its public accessibility is unconfirmed.

RemediationAI

Update Google Chrome to version 151.0.7922.72 or later, which contains the vendor-confirmed patch. Chrome typically applies updates automatically; administrators can verify or force the update via chrome://settings/help. The stable channel advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html provides the authoritative patch confirmation. Because exploitation requires a renderer pre-compromise as a prerequisite, organizations with managed Chrome deployments can reduce the broader attack chain risk by enforcing Chrome enterprise policies that restrict navigation to untrusted URLs and enable enhanced Safe Browsing, reducing the likelihood of the renderer being compromised in the first place. Disabling JavaScript is an extreme compensating control that breaks most web functionality and is not recommended as a general mitigation.