What is the CVSS score of EUVD-2026-50893?

EUVD-2026-50893 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Chrome for iOS are affected by EUVD-2026-50893?

Google Chrome for iOS (versions prior to 151.0.7922.72) contains a heap corruption vulnerability allowing remote attackers to corrupt device memory and potentially compromise confidentiality,…. A patch is available.

How to fix or mitigate EUVD-2026-50893?

Within 24 hours, distribute a security alert to all iOS device users and administrators directing immediate update of Google Chrome through the App Store to version 151.0.7922.72 or later. Within 7 days, use mobile device management systems to verify patch deployment status on managed devices and send reminder notifications to BYOD users with a compliance deadline. Within 30 days, generate patch deployment compliance reports from MDM tools, audit device logs for Chrome crashes or exploitation indicators occurring before patch deployment, and confirm at least 95% of devices are running the patched version; document findings for security governance records.

Chrome for iOS EUVD-2026-50893

| CVE-2026-17967 HIGH

Use After Free (CWE-416)

2026-07-30 Chrome

GHSA-pgp5-m32w-57xp

Denial Of Service Google Use After Free Memory Corruption Apple

8.8

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

5.0 MEDIUM

Remote crafted page requires user interaction and reliable UAF grooming (AC:H); vendor Low severity and 'potentially exploit' justify partial C/I/A rather than full impact.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L

4.0 AV:N/AC:H/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 18:39 vuln.today

CVSS changed

Jul 30, 2026 - 16:37 NVD

8.8 (HIGH)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:25 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:25 cve.org

HIGH 8.8

DescriptionCVE.org

Use after free in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Heap corruption via a use-after-free in Google Chrome for iOS (versions prior to 151.0.7922.72) lets a remote attacker potentially corrupt memory when a victim opens a crafted HTML page, with the CVSS 8.8 vector modeling full confidentiality, integrity, and availability loss. Google reported it internally and Chromium rated the security severity as Low; there is no public exploit identified at time of analysis, EPSS is low at 0.21% (11th percentile), and SSVC records exploitation status as none.

Technical ContextAI

The flaw is a CWE-416 use-after-free, a memory-safety defect in which code continues to reference heap memory after it has been freed, letting an attacker reclaim that allocation with attacker-influenced data and steer subsequent dereferences toward heap corruption or control-flow hijack. It resides in the Chrome for iOS browser codebase (cpe:2.3:a:google:chrome), triggered while processing HTML/web content from a crafted page. Notably, Chrome on iOS is layered on Apple's WebKit/WKWebView rather than Blink, so the affected logic is Chrome's own iOS browser code; the exploitation path is the classic browser sequence of loading untrusted web content that manipulates object lifetimes to reach a freed-then-reused object.

RemediationAI

Vendor-released patch: update Google Chrome for iOS to 151.0.7922.72 or later via the Apple App Store; because iOS Chrome updates ship through the App Store, ensure automatic app updates are enabled or push the update through MDM so devices do not lag behind the stable channel. Verify the running version and confirm remediation against the Chrome Releases advisory (https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html) and the Chromium issue (https://issues.chromium.org/issues/518243858). No separate configuration workaround is documented; as an interim compensating control while updates roll out, advise users to avoid opening untrusted links in Chrome on iOS and route higher-risk browsing through a patched or alternative browser, accepting the usability trade-off of restricting the primary browser until the update is applied.