What is the CVSS score of EUVD-2026-50900?

EUVD-2026-50900 has a contested CVSS base score of 6.5 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for EUVD-2026-50900?

Yes, a patch is available for EUVD-2026-50900. Update the affected software to the latest version immediately.

Google Chrome EUVD-2026-50900

| CVE-2026-17974 MEDIUM

Client-Side Enforcement of Server-Side Security (CWE-602)

2026-07-30 Chrome

GHSA-p25h-4wcw-9pr8

Authentication Bypass Google

Medium

Disputed · 6.5 Vendor: Chrome

Severity by source

Sources disagree (Low–Critical)

Vendor (Chrome) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

vuln.today AI

5.5 MEDIUM

Description explicitly names a local attacker, warranting AV:L over the provided AV:N; user must open crafted HTML (UI:R); only integrity is impacted via navigation bypass.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

4.0 AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

0.0 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 20:32 vuln.today

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:25 cve.org

MEDIUM 6.5

CVE Published

Jul 30, 2026 - 00:25 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Insufficient policy enforcement in DevTools in Google Chrome prior to 151.0.7922.72 allowed a local attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Navigation restriction bypass in Google Chrome's DevTools component (versions prior to 151.0.7922.72) allows a local attacker to circumvent browser navigation policies via a crafted HTML page. The insufficient policy enforcement within DevTools produces an integrity-high impact (CVSS I:H) without requiring attacker privileges. No public exploit code or CISA KEV listing exists; an EPSS score of 0.12% (2nd percentile) and Google's internal 'Low' Chromium severity rating together confirm this as a low immediate exploitation priority.

Technical ContextAI

The vulnerability resides in the DevTools component of Google Chrome (CPE: cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*), the Chromium-based browser deployed at global scale. Chrome DevTools is an embedded suite of debugging and inspection tools that operates with elevated browser-internal trust. The flaw represents insufficient enforcement of navigation policies within the DevTools context, meaning security controls that restrict or govern page navigation - such as browser-internal navigation guards - are not properly applied when DevTools is involved. No CWE is assigned in the available data, but the behavior is consistent with CWE-358 (Improperly Implemented Security Check for Standard) or CWE-693 (Protection Mechanism Failure). The attack vector involves a crafted HTML page, indicating the policy bypass is triggered through DevTools' interaction with attacker-controlled page content. The Chromium issue tracker entry (https://issues.chromium.org/issues/519232592) is cited as a reference but internal details are not confirmed accessible.

RemediationAI

Update Google Chrome to version 151.0.7922.72 or later, which is confirmed as the vendor-released patch per the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Chrome's automatic update mechanism typically handles this without manual intervention; verify the installed version by navigating to chrome://settings/help. As a compensating control prior to patching, enterprise administrators can restrict DevTools access via the DeveloperToolsAvailability enterprise policy (set to 2 to disable DevTools entirely), which eliminates the vulnerable surface; note this trade-off is significant as it breaks all developer workflows and browser debugging capabilities for managed users. No additional workarounds are identified in the available advisory data.