What is the CVSS score of EUVD-2026-50849?

EUVD-2026-50849 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Google Chrome are affected by EUVD-2026-50849?

Google Chrome on Windows contains a sandbox escape vulnerability (CVE-2026-17723, CVSS 8.3) affecting versions before 151.0.7922.72 that allows attackers with renderer process compromise to escalate…. A patch is available.

How to fix or mitigate EUVD-2026-50849?

Within 24 hours, inventory Chrome instances on Windows devices and verify current version status against 151.0.7922.72 baseline; prepare patch deployment and communications. Within 7 days, deploy Chrome update to version 151.0.7922.72 or later across all Windows workstations using your standard patching process (via Google Update, MDM, or organizational deployment tools). Within 30 days, complete patch verification through automated compliance scanning and remediate any systems still running vulnerable versions, with priority for systems handling sensitive information or running in high-trust network segments.

Google Chrome EUVD-2026-50849

| CVE-2026-17723 HIGH

Use After Free (CWE-416)

2026-07-30 Chrome

GHSA-h5r7-76mx-726x

Denial Of Service Google Use After Free Memory Corruption Microsoft

8.3

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

8.3 HIGH

AC:H and UI:R reflect the required prior renderer compromise plus crafted-page interaction; S:C with C/I/A:H captures the sandbox escape from renderer to a more privileged process.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

CRITICAL

qualitative

Red Hat

9.0 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 23:34 vuln.today

CVSS changed

Jul 30, 2026 - 21:37 NVD

8.3 (HIGH)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:19 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:19 cve.org

HIGH 8.3

DescriptionCVE.org

Use after free in Media in Google Chrome on Windows prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome's Media component on Windows (versions before 151.0.7922.72) lets an attacker who has already compromised the renderer process break out of the browser sandbox through a crafted HTML page, exploiting a use-after-free (CWE-416). Rated High by Chromium and CVSS 8.3, it enables a scope-changing escalation from constrained renderer code to broader host access. There is no public exploit identified at time of analysis and it is not in CISA KEV; EPSS is low at 0.21% (11th percentile).

Technical ContextAI

The flaw lives in Chrome's Media subsystem, which handles decoding and playback of audio/video content delivered via HTML and web APIs. CWE-416 (use-after-free) means a heap object in the media pipeline is freed while a reference to it remains live, and subsequent access to that dangling pointer allows an attacker to control freed memory and corrupt browser process state. Because media parsing runs partly in the privileged browser process outside the renderer sandbox, a use-after-free reachable across that boundary can be leveraged for a sandbox escape. The CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* identifies Google Chrome as the affected application; the issue is specific to the Windows build prior to 151.0.7922.72.

RemediationAI

Vendor-released patch: update Google Chrome to 151.0.7922.72 or later on Windows via the Stable channel, per https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html - restart the browser to ensure the update is applied, since Chrome staging can leave an outdated binary running. In managed environments, push the update through your enterprise update policy and verify the effective version on endpoints. Because exploitation requires a prior renderer compromise, compensating controls that reduce initial renderer takeover help in the interim: enable the Windows/Chrome site-isolation and sandbox hardening that ship by default (do not disable them), enforce enterprise policies restricting untrusted media/plugin content, and prioritize patching internet-facing and high-risk user endpoints. These are stopgaps only - none substitute for the upgrade, and the media pipeline cannot be selectively disabled without breaking core browsing functionality.