What is the CVSS score of EUVD-2026-50838?

EUVD-2026-50838 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Google Chrome are affected by EUVD-2026-50838?

Google Chrome on macOS versions before 151.0.7922.72 contains a high-severity remote code execution vulnerability in the Skia graphics library that can be triggered through crafted web pages.. A patch is available.

How to fix or mitigate EUVD-2026-50838?

Within 24 hours, identify all macOS systems running Chrome versions prior to 151.0.7922.72 through endpoint management or browser telemetry. Within 7 days, deploy Chrome 151.0.7922.72 or later to all affected macOS systems via your standard patching workflow; enable or verify auto-update settings are functioning to accelerate deployment. Within 30 days, validate 100% patch deployment compliance across all inventoried systems and review access logs for any suspicious activity from the vulnerability exposure period.

Google Chrome EUVD-2026-50838

| CVE-2026-17712 HIGH

Race Condition (CWE-362)

2026-07-30 Chrome

GHSA-w8rv-f4mw-5237

Google Race Condition RCE Red Hat Suse

8.8

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

7.5 HIGH

Network-reachable via a malicious page (AV:N, UI:R, PR:N); AC:H because winning a Skia race is timing-dependent and non-deterministic; S:U since code stays inside the sandbox.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

9.6 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 18:36 vuln.today

CVSS changed

Jul 30, 2026 - 16:37 NVD

8.8 (HIGH)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:19 cve.org

HIGH 8.8

CVE Published

Jul 30, 2026 - 00:19 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Race in Skia in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandboxed remote code execution in Google Chrome for macOS before 151.0.7922.72 stems from a race condition in the Skia graphics library that a crafted HTML page can trigger to run arbitrary code within the renderer sandbox. Google (Chrome team) reported the flaw and rated it High severity; a stable-channel patch is available. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Lure user to crafted HTML page

Delivery

Page drives Skia concurrent rendering path

Exploit

Win race condition (CWE-362)

Execution

Corrupt memory in renderer

Impact

Execute arbitrary code within sandbox

Access

Lure user to crafted HTML page

Delivery

Page drives Skia concurrent rendering path

Exploit

Win race condition (CWE-362)

Execution

Corrupt memory in renderer

Impact

Execute arbitrary code within sandbox

Vulnerability AssessmentAI

Exploitation	Exploitation requires the victim to load attacker-controlled HTML in Google Chrome on macOS prior to 151.0.7922.72 (user interaction is mandatory per UI:R - the attacker cannot trigger it without the user visiting or rendering the malicious page). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) reflects network-reachable, unauthenticated exploitation requiring user interaction (visiting a malicious page) with high impact but no scope change - consistent with code execution confined to the sandbox. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker hosts or injects a crafted HTML page that drives Skia into the vulnerable concurrent code path; a macOS user who visits the page triggers the race and the attacker gains arbitrary code execution inside the Chrome renderer sandbox. No public exploit is identified at time of analysis, and winning the race plus the sandbox boundary raises the bar for reliable weaponization; a full compromise would additionally require chaining a separate sandbox-escape bug.
Remediation	Vendor-released patch: update Google Chrome to 151.0.7922.72 or later on macOS via the stable channel (Chrome Releases advisory: https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html); restart the browser to complete the update since Chrome applies fixes only after relaunch. … Detailed patch versions, workarounds, and compensating controls in full report.