What is the CVSS score of EUVD-2026-50789?

EUVD-2026-50789 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Google Chrome are affected by EUVD-2026-50789?

Google Chrome for Android before version 151.0.7922.72 contains a sandbox escape vulnerability that could enable attackers to access system resources and user data with full device privileges…. A patch is available.

How to fix or mitigate EUVD-2026-50789?

Within 24 hours, notify infrastructure and security teams and verify inventory of all Android devices running Chrome to establish baseline deployment scope. Within 7 days, begin staged deployment of Chrome version 151.0.7922.72 or later to test devices and validate functionality before wider rollout. Within 30 days, complete deployment to production devices and confirm 95%+ update compliance through mobile device management console or security audit controls.

Google Chrome EUVD-2026-50789

| CVE-2026-17663 HIGH

Improper Input Validation (CWE-20)

2026-07-30 Chrome

GHSA-hj3x-vvv3-2vj4

Information Disclosure Google

8.3

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

8.3 HIGH

AC:H and UI:R capture the required prior renderer compromise plus victim loading crafted content; S:C reflects the GPU-process escape, with total C/I/A impact per Chromium's assessment.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

CRITICAL

qualitative

Red Hat

9.0 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 23:33 vuln.today

CVSS changed

Jul 30, 2026 - 21:37 NVD

8.3 (HIGH)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:18 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:18 cve.org

HIGH 8.3

DescriptionCVE.org

Insufficient validation of untrusted input in GPU in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome for Android before 151.0.7922.72 lets an attacker who has already compromised the renderer process break out of the browser sandbox through crafted input to the GPU component. This is a second-stage vulnerability (CWE-20, improper input validation) that Google rates High severity and CVSS 8.3 with a scope change; it is chained after an initial renderer bug rather than exploited alone. No public exploit has been identified at time of analysis, EPSS is low (0.29%, 21st percentile), and CISA SSVC records exploitation as none, though technical impact is rated total.

Technical ContextAI

The flaw lives in Chrome's GPU process, which handles graphics/compositing work passed from the sandboxed renderer via Chromium's IPC/Mojo command interfaces. Chrome's multi-process architecture isolates web content in a low-privilege renderer sandbox; the GPU process runs at higher privilege and trusts messages it receives across the IPC boundary. The root cause is CWE-20 (improper input validation): the GPU code insufficiently validates untrusted data supplied by a compromised renderer, so maliciously crafted input crosses the trust boundary and corrupts GPU-process state. The CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* identifies the affected product generically; the description narrows real-world impact to the Android platform build. Because a successful exploit executes in the more privileged GPU process, CVSS marks a scope change (S:C).

RemediationAI

Vendor-released patch: 151.0.7922.72 - update Google Chrome for Android to 151.0.7922.72 or later via the Chrome Releases advisory (https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html); on Android this typically arrives through Google Play, so ensure automatic app updates are enabled and force-update managed fleets via MDM. No standalone workaround neutralizes the GPU-process flaw itself, but because exploitation requires a prior renderer compromise, defenders can raise the bar by keeping the whole browser current so the first-stage renderer bug needed to reach this code is also closed, and by using enterprise policies to restrict untrusted browsing; note that disabling GPU acceleration is not a documented or supported mitigation here and may degrade rendering without reliably preventing the flaw. Verify the running version at chrome://version after updating.