What is the CVSS score of EUVD-2026-50839?

EUVD-2026-50839 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Google Chrome are affected by EUVD-2026-50839?

A critical vulnerability in Google Chrome for Android (CVSS 9.6) enables attackers who have compromised the browser's rendering process to escape the sandbox and achieve full browser and device…. A patch is available.

How to fix or mitigate EUVD-2026-50839?

Within 24 hours: Verify Chrome version across managed Android devices and identify systems running versions before 151.0.7922.72; notify device owners of the critical update. Within 7 days: Deploy Chrome for Android 151.0.7922.72 or later through your mobile device management solution or app store, prioritizing devices accessing sensitive applications. Within 30 days: Confirm patch deployment across 95% of managed Android estate and establish automated compliance monitoring.

Google Chrome EUVD-2026-50839

| CVE-2026-17713 CRITICAL

Improper Input Validation (CWE-20)

2026-07-30 Chrome

GHSA-96pq-v9wp-g6rr

Information Disclosure Google

9.6

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

8.3 HIGH

Requires a prior renderer compromise plus a crafted page and user interaction, raising AC to High; successful escape crosses the sandbox boundary (S:C) with total impact (C/I/A:H).

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

CRITICAL

qualitative

Red Hat

9.0 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 18:32 vuln.today

CVSS changed

Jul 30, 2026 - 16:37 NVD

9.6 (CRITICAL)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:19 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:19 cve.org

CRITICAL 9.6

DescriptionCVE.org

Insufficient validation of untrusted input in Accessibility in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome for Android before 151.0.7922.72 lets an attacker who already controls a compromised renderer process break out of the sandbox through crafted input handled by the browser's Accessibility component. Rated High by Chromium and CVSS 9.6, it is a second-stage bug typically chained after an initial renderer exploit, giving an attacker a path to full compromise of the browser/host context. There is no public exploit identified at time of analysis, EPSS risk is low (0.29%, 21st percentile), and it is not on CISA KEV.

Technical ContextAI

The flaw lives in Chrome's Accessibility subsystem, the layer that exposes the rendered accessibility tree (a11y) to assistive technologies and cross-process consumers. Because accessibility data flows from the sandboxed renderer to higher-privileged browser-process code, insufficient validation of that untrusted data (CWE-20, Improper Input Validation) at the trust boundary can be abused to corrupt state outside the sandbox. The affected component is the Chromium/Blink accessibility implementation on Android, per the single CPE cpe:2.3:a:google:chrome. Root cause is the classic Chromium pattern where a compromised renderer feeds malformed IPC/serialized structures to a browser-side handler that trusts them, enabling a sandbox escape.

RemediationAI

Vendor-released patch: update Google Chrome on Android to 151.0.7922.72 or later, which is the primary and complete fix; on Android this arrives via the Google Play Store update to the Chrome app, so ensure automatic app updates are enabled and force-update managed fleets via MDM. Consult the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html for the release notes. No standalone workaround exists for the accessibility parsing flaw itself; because exploitation requires a prior renderer compromise, compensating controls should focus on reducing initial renderer-exploit exposure - enable Chrome's Enhanced Safe Browsing (trade-off: sends more browsing metadata to Google), and for high-risk users enable Site Isolation-aware hardening and restrict installation of untrusted extensions. These are risk-reduction measures only and are not substitutes for applying the patched version.