What is the CVSS score of EUVD-2026-50792?

EUVD-2026-50792 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.2%.

Which versions of Google Chrome are affected by EUVD-2026-50792?

Google Chrome versions before 151.0.7922.72 contain a critical vulnerability (CVE-2026-17666) that allows network-positioned adversaries to defeat cryptographic protections and manipulate browser…. A patch is available.

How to fix or mitigate EUVD-2026-50792?

Within 24 hours, identify all Chrome desktop deployments and document version numbers to baseline exposure. Within 7 days, test and deploy Chrome version 151.0.7922.72 or later across all systems, prioritizing devices with network-facing roles or handling sensitive communications. Within 30 days, verify full deployment through automated inventory checks and confirm that no legacy versions remain in use.

Google Chrome EUVD-2026-50792

| CVE-2026-17666 CRITICAL

Missing Cryptographic Step (CWE-325)

2026-07-30 Chrome

GHSA-cqjx-gwfh-qhm2

Authentication Bypass Google

9.1

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

7.4 HIGH

Requires an attacker-in-the-middle privileged network position, so AC:H rather than the vendor's AC:L; no auth or interaction needed (PR:N/UI:N); high confidentiality and integrity impact but no availability effect (A:N).

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

8.1 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 20:00 vuln.today

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:18 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:18 cve.org

CRITICAL 9.1

DescriptionCVE.org

Cryptographic Flaw in Enterprise in Google Chrome prior to 151.0.7922.72 allowed an attacker in a privileged network position to bypass discretionary access control via malicious network traffic. (Chromium security severity: High)

AnalysisAI

Discretionary access control bypass in Google Chrome desktop before 151.0.7922.72 lets an adversary in a privileged network position defeat a cryptographic protection and manipulate protected traffic. The flaw stems from a cryptographic weakness (CWE-325) rather than a memory-safety bug, and Google rates the Chromium severity High. No public exploit has been identified, EPSS is low (0.19%), and it is not on CISA KEV, but SSVC scores Technical Impact as total and Automatable as yes.

Technical ContextAI

The affected component is the Chromium/Google Chrome browser engine (CPE cpe:2.3:a:google:chrome), specifically an enterprise-facing cryptographic control used to enforce discretionary access control over network communications. CWE-325 (Missing Required Cryptographic Step) indicates that a step in a cryptographic protocol or verification routine was omitted or implemented incompletely, which weakens the guarantee the crypto was meant to provide. Because the weakness lives in how Chrome validates or protects network traffic, an attacker who can observe or modify traffic (a privileged/on-path network position) can leverage the missing step to bypass the intended access-control decision rather than needing to break the underlying cipher.

RemediationAI

Vendor-released patch: 151.0.7922.72 - upgrade Google Chrome to 151.0.7922.72 or later on all desktop platforms; Chrome typically auto-updates, so ensure the browser is fully closed and relaunched to apply the update, and use enterprise policies (Chrome Enterprise/managed update servers) to force the rollout across fleets. Verify the running version via chrome://settings/help and confirm against the Chrome Releases advisory (https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html). Until patching completes, reduce exposure to the on-path prerequisite by restricting use to trusted networks, enforcing VPN/TLS for sensitive traffic, and avoiding untrusted Wi-Fi; these controls lower the chance an attacker can occupy the required privileged network position but do not remove the underlying flaw, so patching remains the only complete fix. Chromium-derived browsers should be updated to a build incorporating the same fix.