What is the CVSS score of EUVD-2026-50815?

EUVD-2026-50815 has a contested CVSS base score of 4.3 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for EUVD-2026-50815?

Yes, a patch is available for EUVD-2026-50815. Update the affected software to the latest version immediately.

Google Chrome EUVD-2026-50815

| CVE-2026-17689 MEDIUM

Use of Uninitialized Variable (CWE-457)

2026-07-30 Chrome

GHSA-9pfc-5g23-v3x7

Google Information Disclosure Red Hat Suse

Medium

Disputed · 4.3 Vendor: Chrome

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

vuln.today AI

4.3 MEDIUM

AV:N for web-delivered attack, UI:R for mandatory victim navigation, C:L for bounded cross-origin data leak only; no integrity or availability impact applies.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

7.4 HIGH

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 14:40 vuln.today

CVSS changed

Jul 30, 2026 - 14:37 NVD

4.3 (MEDIUM)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:18 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:18 cve.org

MEDIUM 4.3

DescriptionCVE.org

Uninitialized Use in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Uninitialized memory use in ANGLE, Chrome's graphics translation layer, exposes cross-origin data to remote attackers who can direct users to a crafted HTML page. Affected are all Google Chrome desktop releases prior to 151.0.7922.72 across supported platforms. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Host crafted HTML page with malicious graphics payload

Delivery

Lure or redirect victim to page

Exploit

Trigger ANGLE uninitialized memory read via WebGL/canvas API

Execution

Access stale cross-origin memory contents

Impact

Exfiltrate leaked data to attacker-controlled endpoint

Access

Host crafted HTML page with malicious graphics payload

Delivery

Lure or redirect victim to page

Exploit

Trigger ANGLE uninitialized memory read via WebGL/canvas API

Execution

Access stale cross-origin memory contents

Impact

Exfiltrate leaked data to attacker-controlled endpoint

Vulnerability AssessmentAI

Exploitation	User interaction is mandatory - the victim must actively navigate to or be redirected to the attacker-controlled HTML page (UI:R per CVSS vector). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 base score of 4.3 (Medium) reflects a network-reachable, low-complexity flaw requiring no privileges but mandatory user interaction (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker hosts a crafted HTML page containing JavaScript that triggers a specific ANGLE graphics code path - likely via WebGL draw calls or canvas operations - causing Chrome to read uninitialized memory within the graphics pipeline. When a victim visits the page, stale memory contents potentially belonging to a different web origin are exposed to the attacker's page context, enabling extraction of cross-origin data. …
Remediation	Update Google Chrome to version 151.0.7922.72 or later, which is confirmed as the vendor-released patch per the Chrome stable channel advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. … Detailed patch versions, workarounds, and compensating controls in full report.