What is the CVSS score of EUVD-2026-50938?

EUVD-2026-50938 has a contested CVSS base score of 8.8 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by EUVD-2026-50938?

Google Chrome versions prior to 151.0.7922.72 contain a use-after-free vulnerability in the PDFium component (CVE-2026-18012, CVSS 8.8) enabling remote code execution when users open malicious PDFs.. A patch is available.

How to fix or mitigate EUVD-2026-50938?

Within 24 hours, audit Chrome deployment across endpoints using mobile device management (MDM) or endpoint detection and response (EDR) tools to identify scope and criticality; communicate patch requirements to stakeholders. Within 7 days, deploy Chrome version 151.0.7922.72 or later across all managed devices, prioritizing systems handling sensitive PDFs in finance, legal, and operations functions. By day 30, verify 100% patch compliance through audit reports and implement automatic browser update policies to enforce patching for all future stable releases.

Google Chrome EUVD-2026-50938

| CVE-2026-18012 HIGH

Use After Free (CWE-416)

2026-07-30 Chrome

GHSA-2x7x-944v-v7q2

RCE Denial Of Service Google Use After Free Memory Corruption Red Hat Suse

High

Disputed · 8.8 Vendor: Chrome

Severity by source

Sources disagree (Low–Critical)

Vendor (Chrome) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-delivered crafted PDF with low complexity and no privileges but required user interaction to open it; scope unchanged as code stays within the sandboxed renderer with high C/I/A impact to that component.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

4.3 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 14:31 vuln.today

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:26 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:26 cve.org

HIGH 8.8

DescriptionCVE.org

Use after free in PDFium in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted PDF file. (Chromium security severity: Low)

AnalysisAI

Remote code execution in Google Chrome's PDFium component (versions prior to 151.0.7922.72) allows a remote attacker to run arbitrary code - confined to the renderer sandbox - when a victim opens a maliciously crafted PDF. The flaw is a CWE-416 use-after-free reported by Google's own Chrome team and fixed in the July 2026 Stable channel update; Chromium rated its intrinsic severity Low because execution is contained within the sandbox, though NVD's CVSS scores it 8.8. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

The vulnerability lives in PDFium, the open-source PDF rendering engine embedded in Chrome (and Chromium-derived browsers) that parses and displays PDF documents in-browser. The root cause is a use-after-free (CWE-416): PDFium continues to reference a heap object after it has been freed, so a crafted PDF can manipulate object lifetimes to cause a dangling pointer to be reused, corrupting memory in a controllable way. Because PDFium runs inside Chrome's renderer process, successful memory-corruption exploitation yields code execution only within that sandboxed process, not the host OS. The affected CPE is cpe:2.3:a:google:chrome:*, i.e. the desktop Chrome browser across platforms up to build 151.0.7922.72.

RemediationAI

Vendor-released patch: update Google Chrome to 151.0.7922.72 or later via the July 2026 Stable channel update (https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html); Chrome typically auto-updates, so restart the browser to apply the pending update and verify the version under chrome://settings/help. Users of Chromium-based browsers should apply their vendor's build incorporating the equivalent PDFium fix. As an interim compensating control, avoid opening untrusted PDF files in-browser and route PDFs to a separate, patched/isolated viewer, or set Chrome to download rather than open PDFs (chrome://settings/content/pdfDocuments) - the trade-off is reduced convenience and users may open PDFs in another vulnerable application instead. Enterprises can enforce the update via Chrome Browser Cloud Management / group policy to guarantee timely rollout.