What is the CVSS score of EUVD-2026-50862?

EUVD-2026-50862 has a contested CVSS base score of 6.5 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for EUVD-2026-50862?

Yes, a patch is available for EUVD-2026-50862. Update the affected software to the latest version immediately.

Google Chrome EUVD-2026-50862

| CVE-2026-17936 MEDIUM

Protection Mechanism Failure (CWE-693)

2026-07-30 Chrome

GHSA-cjp3-gfw6-86qf

Authentication Bypass Google

Medium

Disputed · 6.5 Vendor: Chrome

Severity by source

Sources disagree (Low–Critical)

Vendor (Chrome) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

vuln.today AI

6.5 MEDIUM

Network delivery via crafted page with no privileges needed; mandatory active user UI gestures (UI:R); navigation restriction bypass justifies I:H; no confidentiality or availability impact applies.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

0.0 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 20:33 vuln.today

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:25 cve.org

MEDIUM 6.5

CVE Published

Jul 30, 2026 - 00:25 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Inappropriate implementation in DevTools in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who convinced a user to engage in specific UI gestures to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Navigation restriction bypass in Google Chrome's DevTools component (all versions prior to 151.0.7922.72) permits remote attackers to circumvent browser navigation controls when a user is socially engineered into performing specific UI gestures on a crafted HTML page. Despite a CVSS integrity impact of High, the Chromium team internally classifies this as Low severity - a meaningful signal that real-world exploitability is more constrained than the base score implies. No public exploit code or active exploitation has been identified (EPSS: 0.18%, 8th percentile), and a vendor-released patch is available in Chrome 151.0.7922.72.

Technical ContextAI

The vulnerability resides in Chrome's DevTools - the built-in browser tooling suite used for debugging, inspecting, and profiling web applications. The root cause is described as 'inappropriate implementation,' indicating a logic or design flaw rather than a memory safety issue; no CWE has been assigned. The flaw allows browser-enforced navigation restrictions - policies controlling where pages may navigate - to be bypassed through attacker-controlled interaction with the DevTools subsystem. The affected product is identified by CPE as cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, covering all Chrome desktop releases prior to 151.0.7922.72 across Windows, macOS, and Linux. The Chromium issue tracker entry (https://issues.chromium.org/issues/513864014) is likely access-restricted, consistent with standard Chrome security disclosure practice.

RemediationAI

Update Google Chrome to version 151.0.7922.72 or later - this is the vendor-released patched version that addresses this vulnerability, confirmed by the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Chrome applies updates automatically via its built-in update mechanism; enterprise administrators should verify that auto-update is enabled or push the update through Chrome Browser Cloud Management or Group Policy. As a compensating control prior to patching in high-risk environments, administrators can restrict DevTools access via the DeveloperToolsAvailability enterprise policy (set to 2 to disable), which eliminates the attack surface but also disables all legitimate developer tooling for affected users - a trade-off appropriate only for non-developer endpoints.