What is the CVSS score of EUVD-2026-50842?

EUVD-2026-50842 has a CVSS 3.1 base score of 8.4 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Google Chrome are affected by EUVD-2026-50842?

Google Chrome's Updater component on macOS (versions before 151.0.7922.72) contains a use-after-free vulnerability (CVSS 8.4) enabling privilege escalation and code execution in the privileged…. A patch is available.

How to fix or mitigate EUVD-2026-50842?

Within 24 hours: inventory Chrome versions across all macOS endpoints to identify systems running builds before 151.0.7922.72, flagging administrative and high-risk users for priority attention. Within 7 days: deploy Chrome 151.0.7922.72 or later to all macOS systems via your device management platform, prioritizing systems in sensitive security zones and administrative roles. Within 30 days: verify patch deployment compliance across 100% of macOS Chrome installations and document remediation timeline for audit purposes.

Google Chrome EUVD-2026-50842

| CVE-2026-17716 HIGH

Use After Free (CWE-416)

2026-07-30 Chrome

GHSA-qh6m-vhx2-qh42

Privilege Escalation Denial Of Service Google Use After Free Memory Corruption

8.4

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

8.4 HIGH

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.4 HIGH

Local attacker feeds crafted traffic to the privileged updater (AV:L, PR:N, UI:N); use-after-free yields full control of that component, so C/I/A all High with unchanged scope.

3.1 AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Jul 30, 2026 - 19:32 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 30, 2026 - 19:22 vuln.today

cvss_changed

CVSS changed

Jul 30, 2026 - 19:22 NVD

7.5 (HIGH) 8.4 (HIGH)

Analysis Generated

Jul 30, 2026 - 13:24 vuln.today

CVSS changed

Jul 30, 2026 - 13:22 NVD

7.5 (HIGH)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:19 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:19 cve.org

HIGH 7.5

DescriptionCVE.org

Use after free in Updater in Google Chrome on Mac prior to 151.0.7922.72 allowed a local attacker to perform privilege escalation via malicious network traffic. (Chromium security severity: High)

AnalysisAI

Privilege escalation in Google Chrome's Updater component on macOS (versions before 151.0.7922.72) stems from a use-after-free (CWE-416) that a local attacker can trigger via malicious network traffic, letting them execute code in the context of the privileged updater process. Google rated the Chromium severity as High and has shipped a fixed stable-channel build; there is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.18%, 7th percentile). CISA's SSVC framework records no observed exploitation and marks the flaw as not automatable but with total technical impact.

Technical ContextAI

The vulnerability lives in Google Chrome's auto-update mechanism (the GoogleUpdater/Keystone service that keeps Chrome current on macOS), which typically runs with elevated privileges to write into protected application directories. CWE-416 (use-after-free) means the code continues to reference a heap object after it has been freed; an attacker who influences the timing or content of data the updater processes - here characterized as malicious network traffic reaching the updater - can cause the dangling pointer to be reused, corrupting memory and enabling controlled behavior in the privileged process. The CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* identifies the affected product as the Google Chrome application; the exposure is specific to the macOS build of the updater rather than the browser renderer sandbox.

RemediationAI

Vendor-released patch: update Google Chrome to 151.0.7922.72 or later on macOS, per Google's stable-channel advisory (https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html). Chrome normally auto-updates, so ensure the browser is fully relaunched to complete installation and confirm the running version under chrome://settings/help; in managed fleets, push the updated build through your MDM or software-distribution tooling and verify the updater service itself is on the current release. Because the flaw is in the updater rather than page-rendering, disabling browser features does not mitigate it - the compensating control until patching is to restrict local access to the affected macOS hosts and monitor for anomalous updater process behavior, accepting that blocking or crippling the auto-updater would itself leave systems unpatched and is not advised.