What is the CVSS score of EUVD-2026-50808?

EUVD-2026-50808 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Google Chrome are affected by EUVD-2026-50808?

Google Chrome's ANGLE graphics library contains a critical sandbox escape vulnerability (CVE-2026-17682) affecting versions before 151.0.7922.72 that enables attackers with compromised browser…. A patch is available.

How to fix or mitigate EUVD-2026-50808?

Within 24 hours, inventory all Chrome deployments and identify systems running versions prior to 151.0.7922.72. Within 7 days, deploy Chrome 151.0.7922.72 or later via managed updates or auto-update mechanisms across all systems. Within 30 days, verify 100% patch deployment completion through endpoint management tools and confirm no systems remain on vulnerable versions.

Google Chrome EUVD-2026-50808

| CVE-2026-17682 CRITICAL

Integer Overflow or Wraparound (CWE-190)

2026-07-30 Chrome

GHSA-9vq8-3c74-6rf6

Buffer Overflow Google Integer Overflow

9.6

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

8.3 HIGH

Delivered via a crafted page (AV:N, UI:R) but requires a prior renderer compromise plus overflow grooming, so AC:H; the sandbox escape crosses a trust boundary (S:C) with full host impact (C/I/A:H).

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

CRITICAL

qualitative

Red Hat

9.0 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 16:43 vuln.today

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:18 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:18 cve.org

CRITICAL 9.6

DescriptionCVE.org

Integer overflow in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

Articles & Coverage 1

News 12 New Chrome Vulnerabilities - 8 Critical, 4 High Severity Jul 30, 2026

AnalysisAI

Sandbox escape in Google Chrome's ANGLE graphics layer (versions prior to 151.0.7922.72) lets an attacker who has already compromised the renderer process break out of the browser sandbox via a crafted HTML page, gaining high confidentiality, integrity, and availability impact on the host. Rated High by Chromium and CVSS 9.6 due to scope change, it is a second-stage exploitation primitive rather than a standalone initial-access flaw. No public exploit is identified at time of analysis, and EPSS exploitation probability is low at 0.29% (21st percentile).

Technical ContextAI

ANGLE (Almost Native Graphics Layer Engine) is Chrome's graphics abstraction library that translates OpenGL ES / WebGL calls into the platform's native GPU API (Direct3D, Metal, Vulkan, or desktop GL). The root cause is CWE-190, an integer overflow: an arithmetic operation on attacker-influenced values such as buffer sizes or vertex/texture dimensions supplied through WebGL wraps around, producing an undersized allocation or out-of-bounds index that corrupts memory. Because ANGLE code runs at the boundary between the sandboxed renderer and the more privileged GPU process, memory corruption here can be leveraged to escape the renderer sandbox. The affected component is identified by CPE cpe:2.3:a:google:chrome:*, and the tags (Integer Overflow, Buffer Overflow) confirm the overflow manifests as a buffer memory-safety violation.

RemediationAI

Vendor-released patch: Chrome 151.0.7922.72 - upgrade to 151.0.7922.72 or later on all desktop platforms, which is the primary and complete fix (see the Stable Channel advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html). Chrome typically auto-updates on relaunch, so ensure endpoints are restarted to apply the update and verify the running build via chrome://version. Where immediate patching is not possible, compensating controls include disabling hardware-accelerated GPU/WebGL by turning off 'Use graphics acceleration when available' in chrome://settings or via the --disable-gpu / --disable-webgl launch flags, or blocking WebGL through enterprise policy, which reduces reachability of the vulnerable ANGLE code path; the trade-off is degraded rendering performance and broken WebGL-dependent web applications. Because exploitation also requires a prior renderer compromise, keeping Chrome's site isolation enabled and restricting installation of untrusted extensions further limits the practical attack chain.