What is the CVSS score of EUVD-2026-50870?

EUVD-2026-50870 has a contested CVSS base score of 4.3 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for EUVD-2026-50870?

Yes, a patch is available for EUVD-2026-50870. Update the affected software to the latest version immediately.

Chrome for iOS EUVD-2026-50870

| CVE-2026-17944 MEDIUM

Improper Access Control (CWE-284)

2026-07-30 Chrome

GHSA-hhv2-wccr-hr37

Authentication Bypass Google Apple

Medium

Disputed · 4.3 Vendor: Chrome

Severity by source

Sources disagree (Medium–Critical)

Vendor (Chrome) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

AV:N and PR:N because attacker serves a webpage; UI:R required as victim must visit; I:L for navigation bypass; C:N and A:N as no data or availability impact applies.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 22:36 vuln.today

CVSS changed

Jul 30, 2026 - 20:37 NVD

4.3 (None) 4.3 (MEDIUM)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:25 cve.org

MEDIUM 4.3

CVE Published

Jul 30, 2026 - 00:25 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Navigation restriction bypass in Google Chrome for iOS prior to 151.0.7922.72 allows a remote attacker to serve a crafted HTML page that circumvents the browser's navigation controls, resulting in limited integrity impact. The flaw is confined to Chrome's iOS-specific implementation layer (CWE-284: Improper Access Control) and is not present in Chrome on other platforms. No public exploit code has been identified at time of analysis, and EPSS exploitation probability is very low at 0.18% (8th percentile), consistent with SSVC's 'exploitation: none' determination.

Technical ContextAI

Chrome for iOS does not use the Blink rendering engine and instead relies on Apple's WKWebView framework, meaning Google must re-implement certain navigation control logic outside its standard cross-platform codebase. CWE-284 (Improper Access Control) in this context indicates that the iOS-specific code path for enforcing navigation restrictions - such as cross-origin navigation policies, URL bar integrity, or content loading controls - contains an inappropriate implementation that fails to apply the intended security boundary when processing a specially crafted HTML page. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* for versions prior to 151.0.7922.72, specifically on iOS. The Chromium issue tracker entry (issues.chromium.org/issues/514510853) is the canonical bug reference, though it is likely access-restricted per standard Chrome security disclosure policy.

RemediationAI

Update Google Chrome for iOS to version 151.0.7922.72 or later via the Apple App Store; this is the vendor-confirmed fixed release per the Chrome stable channel advisory at http://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. No workaround eliminates the underlying implementation flaw. As a compensating control prior to patching in high-sensitivity environments, administrators can restrict Chrome iOS usage on managed devices via MDM policy or direct users to Safari while the update is deployed; however, this is operationally disruptive and unnecessary for most organizations given the low EPSS and limited impact scope. Enabling automatic app updates on iOS devices is the most practical defense.