What is the CVSS score of EUVD-2026-50800?

EUVD-2026-50800 has a contested CVSS base score of 6.5 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for EUVD-2026-50800?

Yes, a patch is available for EUVD-2026-50800. Update the affected software to the latest version immediately.

Google Chrome EUVD-2026-50800

| CVE-2026-17674 MEDIUM

Protection Mechanism Failure (CWE-693)

2026-07-30 Chrome

GHSA-g2wc-g6r3-6429

Google Authentication Bypass Red Hat Suse

Medium

Disputed · 6.5 Vendor: Chrome

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

vuln.today AI

6.5 MEDIUM

Network-delivered via crafted page, no attacker privileges needed, active user visit required (UI:R), integrity-only impact as CSP bypass enables unauthorized script execution with no confidentiality or availability consequence.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

8.8 HIGH

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 31, 2026 - 16:28 vuln.today

CVSS changed

Jul 31, 2026 - 16:22 NVD

6.5 (MEDIUM)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:18 cve.org

MEDIUM 6.5

CVE Published

Jul 30, 2026 - 00:18 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Inappropriate implementation in HTML in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass content security policy via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Content Security Policy bypass in Google Chrome prior to 151.0.7922.72 enables remote attackers to circumvent site-level script execution restrictions via a specially crafted HTML page. The flaw stems from an inappropriate implementation in Chrome's HTML handling (CWE-693, Protection Mechanism Failure), allowing injected or unauthorized scripts to execute despite CSP directives that should block them. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Recon

Attacker crafts malicious HTML page

Delivery

Hosts page on attacker-controlled or compromised site

Exploit

Lures victim via phishing or malvertising

Install

Victim opens page in unpatched Chrome

HTML engine fails to enforce CSP directives

Execute

Unauthorized scripts execute in browser context

Impact

Integrity violation or data exfiltration within session

Recon

Attacker crafts malicious HTML page

Delivery

Hosts page on attacker-controlled or compromised site

Exploit

Lures victim via phishing or malvertising

Install

Victim opens page in unpatched Chrome

HTML engine fails to enforce CSP directives

Execute

Unauthorized scripts execute in browser context

Impact

Integrity violation or data exfiltration within session

Vulnerability AssessmentAI

Exploitation	The victim must use Google Chrome prior to version 151.0.7922.72 and actively visit a crafted HTML page - user interaction (UI:R) is a hard prerequisite that rules out fully automated mass exploitation or server-side attack paths. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The NVD CVSS 3.1 score of 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) reflects a network-accessible, low-complexity attack requiring only user interaction - consistent with a browser-based drive-by exploitation model. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker crafts a malicious HTML page containing specific HTML constructs that trigger Chrome's CSP enforcement failure, then lures a victim to visit the page via phishing, malvertising, or a compromised third-party website. Once Chrome renders the page, the CSP policy intended to block unauthorized script sources is silently bypassed, allowing attacker-controlled scripts to execute within the page context. …
Remediation	The vendor-released patch is Chrome 151.0.7922.72, available via Chrome's built-in auto-update mechanism or through the Chrome menu under Help > About Google Chrome. … Detailed patch versions, workarounds, and compensating controls in full report.