What is the CVSS score of EUVD-2026-50821?

EUVD-2026-50821 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Google Chrome are affected by EUVD-2026-50821?

A critical privilege escalation flaw in Chrome's graphics rendering on macOS exposes any employee browsing the web to complete device compromise from a single malicious webpage.. A patch is available.

How to fix or mitigate EUVD-2026-50821?

Within 24 hours, communicate the vulnerability to all macOS users and advise immediate Chrome updates. Within 7 days, deploy mandatory Chrome version 151.0.7922.72 or later across all macOS endpoints using your device management system (MDM, Intune, or Jamf), prioritizing any systems currently running versions prior to 151.0.7922.72. Within 30 days, verify 100% compliance through endpoint telemetry and document patch deployment records; audit for any suspicious activity on updated systems and review browser history for potential exploitation indicators on systems that delayed patching.

Google Chrome EUVD-2026-50821

| CVE-2026-17695 CRITICAL

Protection Mechanism Failure (CWE-693)

2026-07-30 Chrome

GHSA-rhr6-p3mg-3gqm

Information Disclosure Google

9.6

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

9.6 CRITICAL

Remote crafted page needs only a user visit (UI:R, PR:N, AC:L); sandbox escape crosses the security boundary (S:C) yielding full host C/I/A impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

CRITICAL

qualitative

Red Hat

9.6 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 16:37 vuln.today

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:18 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:18 cve.org

CRITICAL 9.6

DescriptionCVE.org

Inappropriate implementation in ANGLE in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

Articles & Coverage 1

News 12 New Chrome Vulnerabilities - 8 Critical, 4 High Severity Jul 30, 2026

AnalysisAI

Sandbox escape in Google Chrome on macOS (versions prior to 151.0.7922.72) stems from an inappropriate implementation in ANGLE, Chrome's graphics abstraction layer, allowing a remote attacker to break out of the renderer sandbox via a crafted HTML page after the victim loads it. Rated High by Chromium and carrying a CVSS 9.6 (scope-changed), it enables an attacker to escalate from web content into higher-privilege execution on the host. No public exploit identified at time of analysis, and EPSS exploitation probability is low (0.29%, 21st percentile).

Technical ContextAI

ANGLE (Almost Native Graphics Layer Engine) is Chrome's cross-platform graphics engine that translates OpenGL ES / WebGL calls made by web content into the host platform's native graphics API - on macOS this is Metal (historically OpenGL). Because ANGLE processes attacker-influenced GPU commands sourced from WebGL/WebGPU content, an 'inappropriate implementation' bug in this layer can allow rendered web content to violate the boundaries the browser relies on, here manifesting as a sandbox escape. No CWE was assigned in the source data, but the 'inappropriate implementation' phrasing and sandbox-escape impact point to a logic/security-boundary flaw in the graphics command handling rather than a classic memory-corruption class, though Chrome does not disclose exact root cause pre-patch. The affected component is confined to the macOS build per the CPE (cpe:2.3:a:google:chrome) and the description's explicit 'on Mac' qualifier.

RemediationAI

Vendor-released patch: update Google Chrome to 151.0.7922.72 or later on macOS via the Stable channel (https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html); Chrome typically auto-updates, so ensure the update is applied and fully relaunch the browser to load the patched binary, then verify via chrome://version. In managed fleets, push the update through your enterprise management/MDM channel and confirm the minimum version policy. Until the update is applied, compensating controls include disabling hardware-accelerated graphics/WebGL to reduce ANGLE's attack surface (Settings > System > 'Use graphics acceleration when available' off, or the #ignore-gpu-blocklist / WebGL flags) - with the trade-off of degraded rendering performance and broken WebGL/WebGPU sites - and restricting users to trusted sites since exploitation requires loading attacker-controlled HTML. These are stopgaps only; the update is the definitive fix.