What is the CVSS score of EUVD-2026-50884?

EUVD-2026-50884 has a contested CVSS base score of 4.3 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for EUVD-2026-50884?

Yes, a patch is available for EUVD-2026-50884. Update the affected software to the latest version immediately.

Google Chrome EUVD-2026-50884

| CVE-2026-17958 MEDIUM

User Interface (UI) Misrepresentation of Critical Information (CWE-451)

2026-07-30 Chrome

GHSA-5cwh-r5g5-jv7g

Information Disclosure Google

Medium

Disputed · 4.3 Vendor: Chrome

Severity by source

Sources disagree (Low–Critical)

Vendor (Chrome) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

Network-delivered via crafted HTML (AV:N), no special conditions (AC:L), no auth needed (PR:N), requires victim to visit page (UI:R), only UI integrity affected (I:L), no data exposure or availability impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

0.0 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 22:34 vuln.today

CVSS changed

Jul 30, 2026 - 20:37 NVD

4.3 (None) 4.3 (MEDIUM)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:25 cve.org

MEDIUM 4.3

CVE Published

Jul 30, 2026 - 00:25 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Inappropriate implementation in Views in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

UI spoofing in Google Chrome's Views component (prior to 151.0.7922.72) enables a remote unauthenticated attacker to deceive a victim about browser UI state or page origin by serving a crafted HTML page that triggers CWE-451 misrepresentation of critical interface elements. The CVSS vector (PR:N/UI:R) confirms the attack requires no authentication but does require the victim to visit the attacker-controlled page, limiting automated mass exploitation. No public exploit exists and SSVC rates current exploitation as none, with EPSS at only 0.17% (7th percentile), consistent with a low-severity, user-interaction-dependent flaw.

Technical ContextAI

The vulnerability originates in Chrome's Views framework, the cross-platform UI toolkit responsible for rendering browser chrome elements such as dialogs, permission prompts, the omnibox, and security indicators across Windows, macOS, and Linux. An 'inappropriate implementation' (CWE-451: User Interface Misrepresentation of Critical Information) in this layer allows a crafted HTML document to produce visual artifacts or overlay elements that mimic trusted browser UI, potentially masking the true origin or security state of a page. The affected CPE (cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*) covers all Chrome desktop builds prior to the fixed release 151.0.7922.72. This class of flaw is distinct from content-injection; it abuses the rendering boundary between web content and browser-owned UI.

RemediationAI

Vendor-released patch: Chrome 151.0.7922.72. Update immediately via Chrome's built-in update mechanism (Settings → Help → About Google Chrome) or through enterprise deployment tools (Google Update, Omaha). The advisory is published at chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. If immediate patching is not feasible in managed environments, restricting user access to untrusted external websites reduces exposure, though this has significant usability trade-offs. Browser isolation technologies (e.g., Chrome's Site Isolation) do not mitigate Views-layer spoofing. No workaround is documented that addresses the root cause - patching is the only confirmed fix.