CVE-2026-78908 in Chrome
Summary
by MITRE • 08/26/2026
Information leak in Canvas in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: High)
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/26/2026
The vulnerability identified as an information leak within the Canvas API of Google Chrome, specifically in versions prior to 152.0.7977.65, represents a significant breach of web origin policies that were designed to isolate content from different sources. This flaw allowed remote attackers to exploit the rendering engine's handling of canvas elements to extract sensitive data from cross-origin resources without proper authorization checks. The core technical issue stems from how the browser processed pixel data retrieved via methods such as getImageData when applied to canvases tainted by images loaded from external domains that did not provide appropriate Cross-Origin Resource Sharing headers or lacked explicit permission for such access. By crafting a malicious HTML page, an attacker could load restricted resources into a canvas element and subsequently read back the rendered pixels, effectively bypassing the same-origin policy protections intended to prevent unauthorized data exfiltration.
From a technical perspective, this vulnerability falls under the category of cross-site scripting adjacent attacks where the primary vector is not code execution but rather data leakage through side channels or direct API misuse. The Chromium security team classified this issue with high severity due to its potential for widespread exploitation and the sensitivity of the information that could be compromised. Attackers utilized standard web technologies available in modern browsers, requiring no special plugins or exploits beyond a well-crafted HTML document hosted on a malicious server. When a victim visited this page, the browser would inadvertently expose pixel data from protected resources, such as internal corporate dashboards, private images, or other sensitive visual content that was not meant to be accessible outside its original domain context.
The operational impact of this vulnerability is substantial, particularly for organizations relying on web-based applications for secure operations. An attacker could potentially reconstruct confidential documents, extract proprietary designs, or gather intelligence from restricted areas by analyzing the pixel data returned through the canvas API. This type of information disclosure undermines user trust and can lead to significant security incidents if sensitive visual data is exposed. Furthermore, because this exploit relies on standard browser functionality, it was difficult for users to detect without specialized monitoring tools, making stealthy reconnaissance possible against targeted individuals or entities using affected versions of Chrome.
Mitigation strategies primarily involve updating the Google Chrome browser to version 152.0.7977.65 or later, where these checks were tightened to ensure that canvas elements tainted by cross-origin images correctly enforce origin restrictions when attempting to read pixel data. Administrators should also implement Content Security Policy headers in their web applications to restrict unauthorized access to resources and monitor for unusual patterns of canvas usage within internal networks. Additionally, users are advised to keep their browsers updated automatically to receive timely security patches that address such high-severity flaws before they can be widely exploited by malicious actors seeking to bypass origin policies through information leakage techniques.