Google Chrome EUVD-2026-65859

Exploitation requires the victim to actively visit a crafted HTML page (UI:R is mandatory - passive drive-by without user navigation is not possible). The attack is network-delivered with no authentication or privileges required on the attacker side (PR:N, AV:N). Canvas API must be enabled, which is the default in all Chrome installations; no special server-side configuration is needed. The vulnerability is limited to cross-origin canvas data leakage, meaning the attacker can only extract pixel-level graphical information rendered in the victim's browser - not arbitrary files, cookies, or credentials. Impact is further bounded by unchanged scope (S:U): the attacker cannot escape the renderer or affect system integrity and availability. Exploitation is limited to Chrome versions below 152.0.7977.65 on all platforms.

CVSS 4.3 Medium (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) accurately captures the risk profile: remotely reachable but gated by mandatory user interaction, with only low confidentiality impact and no integrity or availability consequence. EPSS at 0.39% (32nd percentile) corroborates that automated or opportunistic exploitation is unlikely. There is no CISA KEV listing and no known public exploit, so this should not be treated as an emergency. The unchanged scope (S:U) confirms the attacker cannot pivot from renderer to OS or other browser contexts through this flaw alone. In practice this is a privacy/data-leakage risk - an attacker could potentially fingerprint users or extract low-resolution graphical data rendered in canvas elements - not a code execution or privilege escalation path. Normal patch-cycle remediation is appropriate; no compensating controls are urgently required for most enterprise environments.

An attacker hosts a crafted HTML page containing JavaScript that uses Canvas API read-back operations on cross-origin image or WebGL content to extract pixel data that Chrome's origin policy should block. When a victim visits the page (e.g., via a phishing link or malicious advertisement), the page silently reads and exfiltrates the leaked pixel data to an attacker-controlled endpoint. No public exploit or proof-of-concept has been identified at time of analysis, and the low EPSS score suggests this technique has not been operationalized widely.