What is the CVSS score of EUVD-2026-50824?

EUVD-2026-50824 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Which versions of Google Chrome are affected by EUVD-2026-50824?

Google Chrome for Android contains a high-severity vulnerability (CVE-2026-17698) that exposes sensitive user data across websites through malicious pages.. A patch is available.

How to fix or mitigate EUVD-2026-50824?

Within 24 hours, identify Chrome on Android deployment across your organization, including corporate-managed and BYOD devices. Within 7 days, deploy Chrome version 151.0.7922.72 or later to all managed Android devices via MDM; simultaneously send guidance to BYOD users to update Chrome from the Google Play Store with communication emphasizing the data exposure risk. Within 30 days, verify 100% of managed devices have updated to version 151.0.7922.72 or later through MDM telemetry and document deployment for compliance records.

Google Chrome EUVD-2026-50824

| CVE-2026-17698 HIGH

Improper Input Validation (CWE-20)

2026-07-30 Chrome

GHSA-4v89-64wc-c622

Google Information Disclosure Red Hat Suse

7.5

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

Network-delivered crafted page with low complexity and no privileges, but the victim must load the malicious page so UI:R; impact is cross-origin data leak only, hence C:H/I:N/A:N.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

5.5 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 16:36 vuln.today

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:18 cve.org

HIGH 7.5

CVE Published

Jul 30, 2026 - 00:18 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Insufficient validation of untrusted input in UI in Google Chrome on Android prior to 151.0.7922.72 allowed a local attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)

Articles & Coverage 1

News 12 New Chrome Vulnerabilities - 8 Critical, 4 High Severity Jul 30, 2026

AnalysisAI

Cross-origin data disclosure in Google Chrome for Android before 151.0.7922.72 lets a remote attacker leak data from other origins by luring a victim to a crafted HTML page that abuses insufficient input validation in the browser UI. Rated High by Chromium and CVSS 7.5 (confidentiality-only). …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Lure victim to crafted HTML page

Delivery

Page abuses UI input-validation gap

Exploit

Bypass same-origin restriction

Execution

Read cross-origin data

Impact

Exfiltrate leaked data to attacker

Access

Lure victim to crafted HTML page

Delivery

Page abuses UI input-validation gap

Exploit

Bypass same-origin restriction

Execution

Read cross-origin data

Impact

Exfiltrate leaked data to attacker

Vulnerability AssessmentAI

Exploitation	Exploitation requires the victim to open a crafted HTML page in Google Chrome for Android on a version prior to 151.0.7922.72 - that page-visit is the concrete prerequisite (the CVSS UI:N rating understates this, since a victim must load attacker-controlled content). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	Signals are moderately consistent but point to a real-but-not-emergency issue. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker hosts a crafted HTML page and lures an Android Chrome user to it via a link in a message, ad, or compromised site. When the page loads, it abuses the UI input-validation gap to read or infer data belonging to another origin the victim is authenticated to, leaking cross-origin information back to the attacker. …
Remediation	Update Google Chrome on Android to 151.0.7922.72 or later - Vendor-released patch: 151.0.7922.72 (Patch available per vendor advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html). … Detailed patch versions, workarounds, and compensating controls in full report.