What is the CVSS score of EUVD-2026-50823?

EUVD-2026-50823 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Google Chrome are affected by EUVD-2026-50823?

Google Chrome versions before 151.0.7922.72 contain a critical sandbox escape vulnerability (CVE-2026-17697) capable of compromising employee systems through malicious web pages.. A patch is available.

How to fix or mitigate EUVD-2026-50823?

Within 24 hours, enable automatic updates for Chrome and notify all employees to update to version 151.0.7922.72 or later; verify that auto-update is not blocked by security software or policies. Within 7 days, use endpoint management tools or browser telemetry to inventory all Chrome installations and confirm that 100% have been updated to version 151.0.7922.72 or later. Within 30 days, audit Chrome deployment policies across the organization to ensure automatic patching is enabled and establish escalation procedures for future critical browser vulnerabilities.

Google Chrome EUVD-2026-50823

| CVE-2026-17697 CRITICAL

Access of Resource Using Incompatible Type (Type Confusion) (CWE-843)

2026-07-30 Chrome

GHSA-g9r6-47g2-3cpc

Google Memory Corruption Information Disclosure Red Hat Suse

9.6

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

9.6 CRITICAL

Remote crafted page needs no auth (PR:N) but requires the victim to open it (UI:R); a sandbox escape crosses a trust boundary (S:C) with total memory-corruption impact (C/I/A:H).

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

CRITICAL

qualitative

Red Hat

9.6 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 16:37 vuln.today

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:18 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:18 cve.org

CRITICAL 9.6

DescriptionCVE.org

Type Confusion in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

Articles & Coverage 1

News 12 New Chrome Vulnerabilities - 8 Critical, 4 High Severity Jul 30, 2026

AnalysisAI

Sandbox escape in Google Chrome's ANGLE graphics layer prior to version 151.0.7922.72 lets a remote attacker who lures a victim to a crafted HTML page trigger a type confusion (CWE-843) and potentially break out of the renderer sandbox. Google rates the Chromium severity High, and the CVSS 9.6 reflects a scope-changing bug requiring only that the victim open a page. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Lure victim to crafted HTML page

Delivery

Page drives malicious WebGL/ANGLE content

Exploit

Trigger type confusion in ANGLE

Execution

Corrupt GPU-process memory

Persist

Escape renderer sandbox

Impact

Execute attacker code in privileged context

Access

Lure victim to crafted HTML page

Delivery

Page drives malicious WebGL/ANGLE content

Exploit

Trigger type confusion in ANGLE

Execution

Corrupt GPU-process memory

Persist

Escape renderer sandbox

Impact

Execute attacker code in privileged context

Vulnerability AssessmentAI

Exploitation	Exploitation requires the victim to actively open a crafted HTML page in a vulnerable Chrome build (< 151.0.7922.72) that exercises the ANGLE graphics path (typically WebGL/GPU-backed content) - this is the UI:R limiting factor: there is no purely passive, zero-click vector implied. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	Signals conflict in an instructive way. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker hosts a malicious web page containing crafted WebGL/shader content and lures a victim (via phishing link, malvertising, or a compromised site) to open it in an unpatched Chrome. The page triggers the ANGLE type confusion to corrupt memory and attempt escape from the renderer sandbox into the more-privileged GPU/browser process. …
Remediation	Update Chrome to 151.0.7922.72 or later (Vendor-released patch: 151.0.7922.72); patch is available per the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, enable automatic updates for Chrome and notify all employees to update to version 151.0.7922.72 or later; verify that auto-update is not blocked by security software or policies. …

Threat intelligence, references, and detailed analysis are available after sign-in.