What is the CVSS score of EUVD-2026-50909?

EUVD-2026-50909 has a contested CVSS base score of 4.3 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for EUVD-2026-50909?

Yes, a patch is available for EUVD-2026-50909. Update the affected software to the latest version immediately.

Google Chrome EUVD-2026-50909

| CVE-2026-17983 MEDIUM

User Interface (UI) Misrepresentation of Critical Information (CWE-451)

2026-07-30 Chrome

GHSA-8hpw-6m6f-9f87

Information Disclosure Google

Medium

Disputed · 4.3 Vendor: Chrome

Severity by source

Sources disagree (Low–Critical)

Vendor (Chrome) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

Crafted page delivers exploit over network without auth; user must visit (UI:R); only low integrity impact via UI spoofing, no confidentiality or availability loss.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

4.3 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 22:35 vuln.today

CVSS changed

Jul 30, 2026 - 20:37 NVD

4.3 (None) 4.3 (MEDIUM)

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:25 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:25 cve.org

MEDIUM 4.3

DescriptionCVE.org

Inappropriate implementation in Global Media Controls in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

UI spoofing in Google Chrome's Global Media Controls component prior to version 151.0.7922.72 enables remote attackers to misrepresent interface elements when a victim visits a crafted HTML page. The flaw is rooted in CWE-451 (misrepresentation of critical UI information), allowing attacker-controlled content to manipulate what the media controls overlay displays. No public exploit code exists and no active exploitation has been identified; EPSS at 0.17% (7th percentile) and SSVC exploitation status of 'none' both corroborate this as a low-urgency, routine-patching-priority finding.

Technical ContextAI

Google Chrome's Global Media Controls is a built-in browser feature presenting a toolbar popup for controlling audio and video playback across tabs and sites. CWE-451 (User Interface Misrepresentation of Critical Information) identifies the root cause as an 'inappropriate implementation' that fails to properly constrain or sanitize what content a crafted HTML page can cause the Global Media Controls panel to render, enabling the attacker's page to influence the appearance of this trusted-seeming overlay. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covering all Chrome builds prior to 151.0.7922.72 on all platforms. This vulnerability class is typically leveraged as a social-engineering primitive rather than a direct exploitation vector, as the attacker can make the browser's own UI lie about media provenance or controls.

RemediationAI

The primary remediation is to update Google Chrome to version 151.0.7922.72 or later, as confirmed by the Chrome stable-channel advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Chrome auto-updates by default; administrators should verify deployment has reached 151.0.7922.72 via chrome://settings/help or enterprise policy dashboards. No workaround is necessary given the available patch and low severity, but organizations unable to update immediately may reduce surface exposure by enforcing browser navigation restrictions via proxy or DNS filtering to block untrusted content, accepting the trade-off of restricting legitimate media-heavy sites. Disabling the Global Media Controls feature via Chrome enterprise policy (MediaRouterEnabled or similar) could also neutralize the attack surface, though this removes media playback controls for end users.