EUVD-2026-44475
GHSA-5cvc-pm9v-pw7p
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Network-delivered via crafted page with mandatory victim interaction (UI:R); integrity-only impact from SOP bypass with no confidentiality or availability consequence.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
5DescriptionCVE.org
Insufficient policy enforcement in HTML-in-Canvas in Google Chrome prior to 150.0.7871.125 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
Same-origin policy bypass in Google Chrome prior to 150.0.7871.125 enables remote attackers to manipulate cross-origin content integrity through the browser's HTML-in-Canvas rendering subsystem. Exploitation requires a victim to visit a crafted HTML page, making this a socially-engineered attack rather than a fully autonomous one. No active exploitation has been recorded (CISA KEV: absent, SSVC exploitation: none), and EPSS sits at 0.26% - indicating low real-world exploitation activity at time of analysis.
Technical ContextAI
The vulnerability resides in Chrome's HTML-in-Canvas feature, which allows HTML content to be rendered within an HTML5 canvas element via mechanisms such as the drawImage or foreignObject path. CWE-346 (Origin Validation Error) identifies the root cause: Chrome fails to sufficiently enforce cross-origin policy boundaries when HTML content is processed in this context, allowing a page from one origin to interact with or influence content from another. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* with all versions prior to 150.0.7871.125 in scope. This class of flaw can allow a malicious origin to read pixels, extract rendered content, or manipulate state across origin boundaries in ways the same-origin policy is specifically designed to prevent.
RemediationAI
Update Google Chrome to version 150.0.7871.125 or later via the browser's built-in update mechanism (Settings > Help > About Google Chrome) or by deploying the update through enterprise management tooling. The patched release is documented in the Chrome stable channel update at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0353146366.html. For environments where immediate patching is not feasible, restricting user browsing to known-safe, allowlisted origins via enterprise policy (e.g., Chrome's URLBlocklist policy) would reduce exposure to crafted attacker-controlled pages at the cost of user friction. If HTML-in-Canvas usage can be identified and is not required by organizational web applications, Chrome enterprise policies restricting or sandboxing canvas-related APIs may serve as a compensating control, though this has not been independently validated as a complete mitigation. No workaround should be considered a substitute for patching.
Same weakness CWE-346 – Origin Validation Error
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today