What is the CVSS score of EUVD-2026-50837?

EUVD-2026-50837 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Google Chrome are affected by EUVD-2026-50837?

Google Chrome on macOS versions prior to 151.0.7922.72 contains a critical vulnerability that could enable attackers to escape the browser sandbox and gain unrestricted system access, creating…. A patch is available.

How to fix or mitigate EUVD-2026-50837?

Within 24 hours, notify all macOS users with Chrome installations of the available patch and create communication emphasizing the urgency of updating to version 151.0.7922.72. Within 7 days, deploy Chrome 151.0.7922.72 across the organization through managed deployment tools (Google Admin Console for enterprise deployments), verify installation success on at least 95% of devices, and document patch deployment completion. Within 30 days, conduct a final compliance audit to confirm all macOS-based Chrome installations have been updated, monitor browser telemetry for any indicators of exploitation attempts, and establish a process to reduce update deployment timelines for future critical browser patches.

Google Chrome EUVD-2026-50837

| CVE-2026-17711 CRITICAL

Race Condition (CWE-362)

2026-07-30 Chrome

GHSA-37xg-v5ff-wmh2

Google Race Condition Information Disclosure Red Hat Suse

9.6

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

8.3 HIGH

AV:N and UI:R for the drive-by page; AC:H because success needs a pre-compromised renderer plus winning a non-deterministic race; S:C with C/I/A:H reflects a full sandbox escape into the browser process.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

CRITICAL

qualitative

Red Hat

7.5 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 18:30 vuln.today

CVSS changed

Jul 30, 2026 - 16:37 NVD

9.6 (CRITICAL)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:19 cve.org

CRITICAL 9.6

CVE Published

Jul 30, 2026 - 00:19 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Race in Downloads in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome on macOS prior to 151.0.7922.72 lets a remote attacker who has already compromised the renderer process break out of the browser sandbox by exploiting a race condition in the Downloads component through a crafted HTML page. Rated High by Chromium and carrying a CVSS 9.6 due to the scope-changing total impact, it is patched in the July 2026 Stable channel update. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Compromise Chrome renderer via prior bug

Delivery

Serve crafted HTML triggering downloads

Exploit

Race Downloads component (CWE-362)

Execution

Manipulate shared state mid-operation

Persist

Escape sandbox into browser process

Impact

Execute code with browser privileges

Access

Compromise Chrome renderer via prior bug

Delivery

Serve crafted HTML triggering downloads

Exploit

Race Downloads component (CWE-362)

Execution

Manipulate shared state mid-operation

Persist

Escape sandbox into browser process

Impact

Execute code with browser privileges

Vulnerability AssessmentAI

Exploitation	Exploitation requires the attacker to have ALREADY compromised Chrome's renderer process (this is a sandbox-escape/second-stage bug, not an initial entry point) and the victim to be running Chrome on macOS at a version below 151.0.7922.72. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	Signals are mixed and should be read together. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker first gains code execution in Chrome's renderer via a separate bug, then serves a crafted HTML page that repeatedly triggers download operations to win a timing race in the Downloads component. By manipulating shared state at the right moment, the renderer-level code escapes the sandbox and gains code execution in the more privileged browser process on the victim's Mac. …
Remediation	Vendor-released patch: update Google Chrome to 151.0.7922.72 or later on macOS via the Stable channel (https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html); restart the browser to complete the update since Chrome staged updates only take effect after relaunch. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, notify all macOS users with Chrome installations of the available patch and create communication emphasizing the urgency of updating to version 151.0.7922.72. …

Threat intelligence, references, and detailed analysis are available after sign-in.