What is the CVSS score of EUVD-2026-50930?

EUVD-2026-50930 has a contested CVSS base score of 4.3 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for EUVD-2026-50930?

Yes, a patch is available for EUVD-2026-50930. Update the affected software to the latest version immediately.

Google Chrome EUVD-2026-50930

| CVE-2026-18004 MEDIUM

Improper Access Control (CWE-284)

2026-07-30 Chrome

GHSA-r7rv-6663-g87q

Authentication Bypass Google

Medium

Disputed · 4.3 Vendor: Chrome

Severity by source

Sources disagree (Low–Critical)

Vendor (Chrome) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

vuln.today AI

3.1 LOW

Renderer-compromise prerequisite elevates AC to H; confidentiality-only impact with no integrity or availability consequence per description.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

4.0 AV:N/AC:H/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

3.2 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 16:32 vuln.today

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:26 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:26 cve.org

MEDIUM 4.3

DescriptionCVE.org

Insufficient policy enforcement in Speech in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Cross-origin data leakage in Google Chrome's Speech component prior to version 151.0.7922.72 exposes sensitive information to attackers who have already achieved renderer process compromise. The vulnerability stems from insufficient policy enforcement in the Speech API, allowing a crafted HTML page to bypass cross-origin boundaries and exfiltrate data. With no CISA KEV listing, no public POC, and an EPSS of 0.16% (6th percentile), this is a low-probability exploitation scenario best understood as a potential second-stage component in a multi-vulnerability chain rather than a standalone attack.

Technical ContextAI

Google Chrome's renderer process executes web content in an isolated sandbox and enforces security policies including the Same-Origin Policy (SOP) that prevents pages from reading cross-origin data. The Speech component - corresponding to the Web Speech API - contains a policy enforcement gap that fails to adequately restrict cross-origin data access from within a compromised renderer context. Although no CWE is formally assigned, the root cause aligns with CWE-284 (Improper Access Control) or CWE-346 (Origin Validation Error), where the security policy check governing which origins can access Speech-mediated data is not properly applied. Affected products are identified by CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* across all platforms for versions prior to 151.0.7922.72, as confirmed by EUVD-2026-50930.

RemediationAI

Upgrade Google Chrome to version 151.0.7922.72 or later, which resolves the insufficient Speech policy enforcement. The patch was released via the Chrome stable channel update documented at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Enterprise administrators should enforce the update via Chrome Browser Cloud Management or Group Policy to ensure fleet-wide coverage. As a compensating control, restricting the Web Speech API via browser or OS permissions can reduce the attack surface; note this may break legitimate voice-input functionality for users. Chrome's Site Isolation feature (enabled by default in modern versions) limits renderer process access to cross-origin data and partially constrains this attack path. Endpoint detection solutions monitoring for unusual renderer process behavior can help surface broader exploit chains of which this may be a component.