What is the CVSS score of EUVD-2026-50845?

EUVD-2026-50845 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Google Chrome are affected by EUVD-2026-50845?

A remote code execution flaw in Google Chrome could enable unauthorized access to user browsers and organizational data through malicious webpages without requiring users to be authenticated or take…. A patch is available.

How to fix or mitigate EUVD-2026-50845?

Within 24 hours, inventory all Chrome desktop deployments across the organization, communicate the vulnerability and mandatory patch deadline to affected users, and verify your current version distribution in the environment. Deploy Chrome 151.0.7922.72 or later to 100% of systems within 7 days, using your established update mechanism-whether automatic updates, mobile device management, or centralized patch deployment-and document any systems that cannot be patched immediately. By day 30, audit patch compliance across the full environment, resolve any remaining deployment gaps, and reinforce automatic browser update policies to prevent future delays on critical security updates.

Google Chrome EUVD-2026-50845

| CVE-2026-17719 HIGH

Use After Free (CWE-416)

2026-07-30 Chrome

GHSA-42w5-9cqv-wq6x

RCE Denial Of Service Google Use After Free Memory Corruption

8.8

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Remote crafted page requires the user to visit it (UI:R) with no auth (PR:N); renderer-only execution keeps scope unchanged (S:U) with high C/I/A within the sandbox.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 17:24 vuln.today

CVSS changed

Jul 30, 2026 - 17:22 NVD

8.8 (HIGH)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:19 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:19 cve.org

HIGH 8.8

DescriptionCVE.org

Use after free in Input in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Remote code execution in Google Chrome desktop before version 151.0.7922.72 stems from a use-after-free in the browser's Input component (Chromium severity High, CVSS 8.8), permitting a remote attacker to run arbitrary code inside the renderer sandbox by luring a victim to a crafted HTML page. Exploitation requires user interaction (visiting the malicious page) but no authentication or prior privileges. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS is low at 0.26% (17th percentile), consistent with a freshly patched browser bug not yet weaponized publicly.

Technical ContextAI

The flaw is a CWE-416 use-after-free in Chrome's Input subsystem, the component that dispatches and processes keyboard, mouse, touch, and pointer events between the browser and the Blink renderer. A use-after-free occurs when a heap object is freed but a dangling reference is subsequently dereferenced; an attacker who controls timing and heap layout via crafted HTML/JavaScript can reclaim the freed allocation with attacker-controlled data and hijack execution flow. Per the CPE (cpe:2.3:a:google:chrome:*), all Chrome desktop builds prior to 151.0.7922.72 are affected. Notably, the description scopes code execution to 'inside a sandbox,' meaning successful exploitation yields control of the renderer process, which is confined by Chrome's site-isolation/sandbox and would require a separate sandbox-escape bug to reach the host OS.

RemediationAI

Vendor-released patch: update Google Chrome to 151.0.7922.72 or later on all desktop platforms; Chrome typically auto-updates, so restart the browser to apply the pending update and verify via chrome://settings/help. Users of other Chromium-based browsers should update once their vendor ships the merged fix. Consult the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html and the tracking issue https://issues.chromium.org/issues/522304853. If immediate patching is not possible, compensating controls include enforcing 'Restart to update' policies via enterprise management, restricting browsing to trusted sites, and (as a heavier trade-off that degrades usability of many modern sites) disabling JavaScript for untrusted origins to hinder the heap grooming needed to exploit a use-after-free; none of these fully eliminate risk and patching remains the only complete fix.