EUVD-2026-40526
GHSA-grwv-9fwx-5mmc
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Attack is network-delivered via a crafted page requiring one victim visit (UI:R, PR:N); impact is confidentiality-only with no integrity or availability consequence.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Insufficient policy enforcement in Canvas in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
Cross-origin data leakage in Google Chrome's Canvas component prior to version 150.0.7871.47 exposes sensitive cross-origin content to remote attackers via a crafted HTML page. The flaw bypasses Same-Origin Policy protections enforced at the Canvas API layer, enabling pixel-level or structured data extraction from cross-origin resources rendered in a canvas context. With CVSS 6.5, EPSS at 0.21% (11th percentile), and no CISA KEV listing or public exploit identified at time of analysis, real-world exploitation is low-probability but credible given the zero-privilege, network-accessible attack path requiring only a single user visit.
Technical ContextAI
CWE-346 (Origin Validation Error) identifies the root cause: Chrome's Canvas rendering subsystem fails to consistently enforce cross-origin isolation policy, allowing scripts to read data from cross-origin content that the Same-Origin Policy should protect. The HTML Canvas API provides a scriptable 2D drawing surface; when cross-origin images or other resources are rendered into a canvas, browsers must 'taint' the canvas and block readback operations (e.g., getImageData(), toDataURL()) to prevent leaking cross-origin pixel data. This vulnerability indicates a gap in that enforcement within Chromium's Canvas implementation prior to 150.0.7871.47. CVSS vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N confirms this is a pure confidentiality-impact flaw with no code execution potential. Affected product per EUVD: Chrome versions below 150.0.7871.47.
RemediationAI
The primary fix is upgrading Google Chrome to version 150.0.7871.47 or later, confirmed as the patched release via the Chrome Stable Channel Update advisory at http://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Chrome's auto-update mechanism will deliver this patch automatically for most users; administrators managing enterprise deployments should verify policy-enforced update channels are current. As a compensating control where immediate updates are not feasible, consider restricting user navigation to untrusted external sites via web proxy allowlists or browser policies, which reduces the attack surface by limiting exposure to crafted pages - note this introduces operational friction and is not a substitute for patching. Enterprise Chrome deployments using ExtensionInstallForcelist or Chrome Browser Cloud Management should verify the Minimum Version policy is set to 150.0.7871.47 or higher to enforce compliance.
Same weakness CWE-346 – Origin Validation Error
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today