What is the CVSS score of EUVD-2026-50919?

EUVD-2026-50919 has a contested CVSS base score of 7.0 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

How to fix or mitigate EUVD-2026-50919?

Within 24 hours, identify Windows systems running Chrome versions prior to 151.0.7922.72 using endpoint management tools or Chrome sync data. Within 7 days, deploy Chrome version 151.0.7922.72 or later via Group Policy, mobile device management, or Chrome Enterprise policies to ensure automatic updates are enabled and targeted. Within 30 days, verify deployment completion across all Windows endpoints and confirm all systems have reached the patched version through compliance reporting.

Google Chrome EUVD-2026-50919

| CVE-2026-17993 HIGH

Race Condition (CWE-362)

2026-07-30 Chrome

GHSA-8854-j33c-jpcf

Privilege Escalation Google Race Condition Microsoft

High

Disputed · 7.0 Vendor: Chrome

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Gain local low-privileged access on Windows host
Delivery

Stage malicious file in updater path
Exploit

Race the elevated Chrome Updater operation
Execution

Updater consumes attacker file
Impact

Execute code with elevated privileges

Vulnerability Assessment

Weakness	CWE CWE-362 OWASP Top 10:2025 A06:2025 - Insecure Design ASVS 5.0 V15 - Secure Coding and Architecture Concurrency control, locking MITRE ATT&CK 1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Exploitation requires local access to the Windows host and the ability to run code as a low-privileged user, plus winning a race condition in the Chrome Updater by planting a malicious file during the update operation. The CVSS vector's UI:R indicates user interaction (e.g., an update being triggered/running) is needed, and AC:H reflects the tight timing window that must be won - both are significant limiting factors. It is Windows-specific and applies to Chrome builds prior to 151.0.7922.72; no network vector exists (AV:L), so remote or unauthenticated exploitation is not possible.
Impact	Signals are mixed and point to a genuine-but-not-urgent issue. The CVSS 3.1 vector (AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H = 7.0 High) requires local access, high attack complexity (winning a race), and user interaction, which tempers real-world exploitability despite the full CIA impact. This aligns with the SSVC framework: Exploitation 'none', Automatable 'no', but Technical Impact 'total' - meaning successful exploitation is high-impact but not currently observed or easily scaled. Chromium's own severity rating is Low, and there is no KEV listing and no known POC, so this is a real defense-in-depth priority for endpoint hardening rather than an emergency patch. No EPSS score was provided in the input, so exploitation probability cannot be quantified here.
Exploit ScenarioDerived	A standard (non-admin) user on a shared Windows machine runs a program that races the Chrome Updater, replacing a file the updater consumes during an elevated update operation at just the right moment, causing attacker-controlled code or content to be executed with the updater's elevated privileges. Because success depends on winning a timing race (AC:H) and coincides with update-related user interaction (UI:R), reliable exploitation is difficult. No public exploit code has been identified for this specific issue.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 30, 2026

Local privilege escalation in the Google Chrome Updater on Windows (versions prior to 151.0.7922.72) lets a low-privileged local attacker win a race condition and substitute a malicious file to elevate privileges. The flaw carries a CVSS 7.0 score, and while Chromium rates its security severity as Low, the SSVC technical impact is Total. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.

RemediationAI

Vendor-released patch: 151.0.7922.72 - update Google Chrome on Windows to 151.0.7922.72 or later via the stable channel; most managed environments should confirm Chrome's automatic updates are enabled and have applied this build (advisory: https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html). As a compensating control until the patched build is confirmed deployed, restrict local (interactive) access on multi-user Windows hosts and monitor the Chrome update directories for unexpected file writes, since the race requires a local attacker to place a malicious file during the update window; note this does not fully close the window and adds monitoring overhead. Avoid granting standard users write access to Chrome's installation or update staging paths.

Affected VersionsENISA

Chrome 151.0.7922.72 <151.0.7922.72

Affected Packages

euvd chrome fix: 151.0.7922.72

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The vulnerability resides in Chrome's auto-update mechanism on Windows, which typically runs with elevated (SYSTEM/service) privileges to write to protected program directories. Rooted in CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization, a race condition), the flaw creates a time-of-check to time-of-use (TOCTOU) style window between when the updater validates a file and when it acts on it, allowing a local attacker to swap in a malicious file. The affected CPE is cpe:2.3:a:google:chrome, and the tags (Race Condition, Privilege Escalation, Microsoft/Windows) confirm this is a Windows-specific updater weakness rather than a browser-engine or renderer bug.

Know when the next one hits your stack

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Sources disagree (Low–Critical)

Vendor (Chrome) PRIMARY 7.0 HIGH

AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI 6.7 MEDIUM

Local attacker must already run code as a user (PR:L) and win a timing race during an update (AC:H, UI:R); success yields full elevation, so C/I/A all High.

3.1 AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE CRITICAL

Red Hat 3.9 LOW

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Local

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:25 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:25 cve.org

HIGH 7.0

DescriptionCVE.org

Race in Updater in Google Chrome on Windows prior to 151.0.7922.72 allowed a local attacker to perform privilege escalation via a malicious file. (Chromium security severity: Low)

Executive ViewAI

Why It Matters

Google Chrome Updater on Windows (versions prior to 151.0.7922.72) contains a local privilege escalation vulnerability that allows low-privileged users to gain system-level access through a race condition in the update process. Organizations with Windows endpoints running affected Chrome versions face increased risk of unauthorized privilege escalation within their environment.

Business Impact: High

Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score

0.1%

Top 99% exploitable

Prevalence

Ubiquitous

Chrome is among the most widely deployed browsers across enterprise and consumer Windows endpoints

Social Media

Sightings

Data Quality

6 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS

Vulnrichment MSRC Vendor CIRCL

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.1%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Scheduled

Exploitation

None

System Exposure· derived

Small

Automatable

Human Impact

High

Technical Impact

Total

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +35

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Privilege Escalation HIGH

Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.

Race Condition MEDIUM

Race conditions occur when multiple concurrent requests exploit the brief time gap between checking a condition and acting upon it (TOCTOU - Time of Check, Time of Use).