What is the CVSS score of EUVD-2026-50794?

EUVD-2026-50794 has a contested CVSS base score of 6.5 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for EUVD-2026-50794?

Yes, a patch is available for EUVD-2026-50794. Update the affected software to the latest version immediately.

Google Chrome EUVD-2026-50794

| CVE-2026-17668 MEDIUM

Use of Uninitialized Variable (CWE-457)

2026-07-30 Chrome

GHSA-jmrw-c58m-5h7j

Google Information Disclosure Red Hat Suse

Medium

Disputed · 6.5 Vendor: Chrome

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

Network-delivered via crafted page with no privileges; UI:R because victim must load the page; confidentiality-only impact, no integrity or availability loss.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

7.4 HIGH

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 19:59 vuln.today

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:18 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:18 cve.org

MEDIUM 6.5

DescriptionCVE.org

Uninitialized Use in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Cross-origin data leakage in Google Chrome's ANGLE graphics engine (versions prior to 151.0.7922.72) allows a remote attacker to read memory from other origins by enticing a victim to visit a specially crafted HTML page. The root cause is use of an uninitialized variable in ANGLE, Chrome's OpenGL ES translation layer, which can expose residual memory contents tied to cross-origin rendering contexts. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Host crafted HTML page with malicious WebGL

Delivery

Lure victim via phishing or malicious ad

Exploit

Victim loads page in vulnerable Chrome

Execution

ANGLE processes graphics call with uninitialized memory

Persist

Residual cross-origin data exposed to attacker-controlled script

Impact

Attacker exfiltrates leaked data

Access

Host crafted HTML page with malicious WebGL

Delivery

Lure victim via phishing or malicious ad

Exploit

Victim loads page in vulnerable Chrome

Execution

ANGLE processes graphics call with uninitialized memory

Persist

Residual cross-origin data exposed to attacker-controlled script

Impact

Attacker exfiltrates leaked data

Vulnerability AssessmentAI

Exploitation	The victim must actively visit a crafted HTML page using a vulnerable version of Chrome (prior to 151.0.7922.72), making UI:R the primary limiting condition. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 score of 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) reflects a meaningful confidentiality risk: no privileges or special configuration needed, exploitable over the network, but requiring a user to visit a crafted page. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker registers or compromises a website and embeds crafted WebGL or canvas-rendering JavaScript that triggers ANGLE's uninitialized memory path. A victim is lured to the page via phishing or a malicious ad, and upon rendering, the browser leaks memory contents that may include data from a co-rendered cross-origin context - such as an authentication cookie value or token from a banking site open in another tab. …
Remediation	Update Google Chrome to version 151.0.7922.72 or later, which contains the vendor-released patch for this issue. … Detailed patch versions, workarounds, and compensating controls in full report.