Google Chrome EUVD-2026-65946

The victim must visit an attacker-controlled HTML page using an unpatched version of Google Chrome prior to 152.0.7977.65 (UI:R per CVSS). The Canvas API information-leak path is triggered when a cross-origin resource - such as an image, video frame, or composited content from a different origin - is rendered into a canvas element and pixel-readback is attempted via getImageData() or similar APIs. For the leaked data to be sensitive, the victim must have an active authenticated session with the cross-origin resource's origin (e.g., logged into an internal application). Exploitation is constrained by: (1) mandatory user interaction to visit the malicious page; (2) the C:L impact ceiling, meaning only partial visual data is accessible rather than raw credentials or tokens; (3) the requirement that the target cross-origin resource be renderable in the victim's browser session. Default Chrome configurations are affected - no special feature flag or non-default setting is required.

The CVSS 3.1 base score of 4.3 (Medium) is grounded in a network-reachable attack (AV:N), low complexity (AC:L), no attacker privileges required (PR:N), mandatory user interaction (UI:R), unchanged scope (S:U), and limited confidentiality impact (C:L) with no integrity or availability impact - a profile consistent with a browser-based information disclosure requiring social engineering. EPSS at 0.27% (18th percentile) is low, corroborating the absence of active exploitation campaigns. No CISA KEV listing and no confirmed POC further reduce urgency relative to other Chrome vulnerabilities. The UI:R requirement is a meaningful real-world barrier: exploitation depends on luring a victim to a malicious page. The C:L cap also limits impact to partial data leakage rather than full session token or credential exposure. This is a genuine but lower-priority vulnerability; patching is warranted during normal update cycles rather than emergency response. No conflicting signals exist in the available data.

An attacker hosts a crafted HTML page that embeds a cross-origin resource (such as an authenticated image or rendered iframe from a victim's banking or intranet portal) into a canvas element, then uses canvas pixel-readback APIs to extract rendered pixel data that should be opaque to script. When an authenticated victim user visits the attacker's page, the attacker's JavaScript reads the cross-origin pixel data and exfiltrates it to a remote server, potentially exposing sensitive UI content. No public exploit code has been identified at time of analysis, and exploitation requires successfully luring the victim to the malicious page.