What is the CVSS score of EUVD-2026-50830?

EUVD-2026-50830 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Google Chrome are affected by EUVD-2026-50830?

Google Chrome versions prior to 151.0.7922.72 contain a critical sandbox escape vulnerability in the ANGLE graphics layer that could allow attackers who have compromised the renderer process to break…. A patch is available.

How to fix or mitigate EUVD-2026-50830?

Within 24 hours, inventory all Chrome installations and identify versions prior to 151.0.7922.72. Within 7 days, deploy Chrome 151.0.7922.72 or later across all affected systems via your standard update mechanism. Within 30 days, verify patch deployment completion, confirm version compliance, and document any systems unable to update with associated remediation plans.

Google Chrome EUVD-2026-50830

| CVE-2026-17704 CRITICAL

Use After Free (CWE-416)

2026-07-30 Chrome

GHSA-r445-3fv9-v4hx

Denial Of Service Google Use After Free Memory Corruption

9.6

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

7.6 HIGH

Requires a prior renderer compromise (PR:H) and chaining a second bug plus a heap grooming primitive (AC:H); once achieved the sandbox escape changes scope with full impact.

3.1 AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:H/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

CRITICAL

qualitative

Red Hat

9.0 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 18:31 vuln.today

CVSS changed

Jul 30, 2026 - 16:37 NVD

9.6 (None) 9.6 (CRITICAL)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:18 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:18 cve.org

CRITICAL 9.6

DescriptionCVE.org

Use after free in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome's ANGLE graphics layer (versions prior to 151.0.7922.72) lets a remote attacker who has already compromised the renderer process break out of the browser sandbox via a crafted HTML page. Rated Chromium severity High with a CVSS 9.6, the flaw is a use-after-free (CWE-416) reported by Google's own Chrome team; a vendor patch is available. There is no public exploit identified at time of analysis and EPSS is low (0.29%), consistent with SSVC showing no known exploitation.

Technical ContextAI

The vulnerability lives in ANGLE (Almost Native Graphics Layer Engine), the translation layer Chromium uses to map WebGL/OpenGL ES calls onto the host platform's native graphics backend (Direct3D, Metal, Vulkan, or OpenGL). Because ANGLE handles GPU-facing commands originating from untrusted web content, memory-safety bugs here are prime sandbox-escape primitives. The root cause is CWE-416 (use-after-free): a heap object is freed while a dangling reference remains, and subsequent access to that stale pointer allows an attacker to corrupt memory. The single affected product per CPE is cpe:2.3:a:google:chrome, exploited through GPU-related code paths reachable from a crafted HTML page.

RemediationAI

Vendor-released patch: update Google Chrome to 151.0.7922.72 or later, per the Chrome Stable channel update (https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html); Chrome's auto-update will apply this on relaunch, so ensure users fully restart the browser to load the new binary. As an interim compensating control before updating, you can reduce the attack surface by disabling hardware/GPU acceleration (chrome://settings 'Use graphics acceleration when available' off, or the --disable-gpu / disable-accelerated-2d-canvas flags), which limits the ANGLE code paths reachable from web content - with the trade-off of degraded rendering performance and potential breakage of WebGL/GPU-dependent sites. Enterprises can also enforce update via the ChromeVersion/relaunch-notification management policies to guarantee the fixed build is deployed.