What is the CVSS score of EUVD-2026-50819?

EUVD-2026-50819 has a contested CVSS base score of 4.3 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for EUVD-2026-50819?

Yes, a patch is available for EUVD-2026-50819. Update the affected software to the latest version immediately.

Google Chrome EUVD-2026-50819

| CVE-2026-17693 MEDIUM

Origin Validation Error (CWE-346)

2026-07-30 Chrome

GHSA-9xqg-8hc3-vfpq

Google Information Disclosure Red Hat Suse

Medium

Disputed · 4.3 Vendor: Chrome

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

vuln.today AI

4.3 MEDIUM

Network-delivered via crafted page (AV:N, AC:L, PR:N); victim must visit attacker URL (UI:R); limited to partial cross-origin data read with no integrity or availability impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

6.5 HIGH

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 14:40 vuln.today

CVSS changed

Jul 30, 2026 - 14:37 NVD

4.3 (MEDIUM)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:18 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:18 cve.org

MEDIUM 4.3

DescriptionCVE.org

Insufficient policy enforcement in FileSystem in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Cross-origin data leakage in Google Chrome's FileSystem component prior to version 151.0.7922.72 enables a remote attacker to read data across origin boundaries by luring a victim to a crafted HTML page. The root cause is insufficient policy enforcement (CWE-346 Origin Validation Error) in Chrome's FileSystem API, which fails to enforce same-origin policy checks correctly, exposing data that should be sandboxed to its originating origin. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Attacker hosts crafted HTML page on controlled domain

Delivery

Victim navigates to malicious URL in unpatched Chrome

Exploit

Page invokes FileSystem API with insufficient origin enforcement

Execution

Cross-origin data boundary bypassed

Persist

Sensitive origin-scoped data read by attacker page

Impact

Exfiltrated to attacker-controlled server

Access

Attacker hosts crafted HTML page on controlled domain

Delivery

Victim navigates to malicious URL in unpatched Chrome

Exploit

Page invokes FileSystem API with insufficient origin enforcement

Execution

Cross-origin data boundary bypassed

Persist

Sensitive origin-scoped data read by attacker page

Impact

Exfiltrated to attacker-controlled server

Vulnerability AssessmentAI

Exploitation	The victim must be running Google Chrome on desktop at any version prior to 151.0.7922.72, and must visit an attacker-crafted HTML page - no download or file execution is required beyond normal browser navigation. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 base score of 4.3 (Medium) reflects the constrained impact profile: AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker registers a domain and hosts a crafted HTML page that exploits the FileSystem origin-validation gap in Chrome. A victim running an unpatched Chrome version is directed to the page via a phishing email or malicious advertisement; upon loading, the page reads FileSystem-stored data belonging to a different origin - such as credentials or tokens cached by a web application - and transmits it to an attacker-controlled server. …
Remediation	Update Google Chrome to version 151.0.7922.72 or later via the built-in auto-update mechanism or the Chrome stable channel advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. … Detailed patch versions, workarounds, and compensating controls in full report.