What is the CVSS score of EUVD-2026-50831?

EUVD-2026-50831 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Google Chrome are affected by EUVD-2026-50831?

Google Chrome versions prior to 151.0.7922.72 contain a remote code execution flaw that could compromise user browsers and expose organizational data or credentials when users visit malicious…. A patch is available.

How to fix or mitigate EUVD-2026-50831?

Within 24 hours, issue a security bulletin to all users communicating the availability of Chrome version 151.0.7922.72 or later and the importance of immediate installation. Within 7 days, deploy automatic updates to Chrome instances across the organization to ensure all systems are updated to Chrome 151.0.7922.72 or later, prioritizing administrative and remote-access systems. Within 30 days, conduct a full inventory audit to verify that no Chrome instances remain on vulnerable versions prior to 151.0.7922.72, and document compliance with this remediation requirement.

Google Chrome EUVD-2026-50831

| CVE-2026-17705 HIGH

Integer Overflow or Wraparound (CWE-190)

2026-07-30 Chrome

GHSA-97fj-f2h9-w8wj

RCE Google Integer Overflow

8.8

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Remote crafted page needs no privileges but requires the victim to open it (UI:R); memory-corruption RCE gives high C/I/A, but execution stays within the renderer sandbox so scope is unchanged.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 18:39 vuln.today

CVSS changed

Jul 30, 2026 - 16:37 NVD

8.8 (HIGH)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:18 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:18 cve.org

HIGH 8.8

DescriptionCVE.org

Integer overflow in libxml in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Remote code execution in Google Chrome desktop versions prior to 151.0.7922.72 lets a remote attacker run arbitrary code within the browser's renderer sandbox by luring a victim to a crafted HTML page that triggers an integer overflow in the bundled libxml component. Google rated the flaw High severity and a vendor patch is available; there is no public exploit identified at time of analysis, and the low EPSS score (0.35%) alongside CISA SSVC 'Exploitation: none' indicates no observed exploitation yet. Because the bug is contained to the sandboxed renderer, a successful attacker would still need a separate sandbox-escape to reach the host.

Technical ContextAI

libxml (libxml2) is the XML/HTML parsing library Chromium bundles and invokes when handling markup within the renderer process. CWE-190 (Integer Overflow or Wraparound) describes the root cause: an arithmetic operation on attacker-influenced sizes or offsets wraps past the integer's maximum value, producing an undersized allocation or miscalculated bounds that leads to out-of-bounds memory access and ultimately controllable memory corruption. The CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* identifies the Chrome application as the affected surface; the overflow is reached purely by parsing a crafted HTML page, so no plugin or non-default component is needed to enter the vulnerable code path.

RemediationAI

Vendor-released patch: update Google Chrome to 151.0.7922.72 or later via the Stable channel; on managed fleets, force the browser update and relaunch to ensure the running process picks up the new binary, since Chrome's background updater stages the fix but only applies it on restart. Verify current version at chrome://settings/help and consult the vendor advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Until updates propagate, compensating controls include restricting browsing to trusted sites via enterprise policy or web-proxy allowlisting to reduce exposure to attacker-controlled HTML (trade-off: breaks general web access), and keeping the renderer sandbox enabled - do not launch Chrome with --no-sandbox - since the flaw yields only in-sandbox execution and the sandbox is the primary barrier to host compromise. Also confirm Chromium-based browsers in the environment are updated to versions incorporating the same libxml fix.