CVE-2026-79193 in Chrome
Summary
by MITRE • 08/26/2026
Information leak in Canvas in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/26/2026
The vulnerability identified as an information leak within the Canvas API of Google Chrome, specifically in versions prior to 152.0.7977.65, represents a significant breach of browser isolation principles. This flaw allows a remote attacker to extract sensitive data from cross-origin resources that should be protected by standard security boundaries. The issue stems from improper handling or validation within the Canvas element's rendering engine, which inadvertently exposes pixel data or other internal state information when manipulated through crafted HTML pages. Such leaks undermine the fundamental Same-Origin Policy (SOP) and Cross-Origin Resource Sharing (CORS) mechanisms designed to prevent unauthorized access to web content across different domains.
From a technical perspective, this vulnerability falls under the category of cross-origin data leakage, often associated with CWE-200: Information Exposure. The attacker crafts an HTML page that interacts with the Canvas API in a specific manner to trigger the exposure of internal browser state or rendered graphics from another origin. By analyzing the pixel values returned by canvas operations such as getImageData, an adversary can reconstruct sensitive information that was not intended for public consumption. This technique exploits the fact that certain rendering paths did not properly sanitize output when dealing with cross-origin images or stylesheets loaded into the canvas context.
The operational impact of this vulnerability is substantial, particularly in environments where users access multiple web applications simultaneously. An attacker could host a malicious webpage and trick a victim into visiting it while logged into sensitive services such as banking portals, email providers, or enterprise dashboards. By leveraging the Canvas API to probe these cross-origin resources, the attacker can potentially steal session tokens, user interface layouts that reveal proprietary information, or even encoded data embedded within images displayed on those sites. This capability effectively bypasses traditional browser security models, allowing for sophisticated surveillance and data exfiltration without triggering standard alerting mechanisms.
This type of attack aligns with several tactics in the MITRE ATT&CK framework, particularly T1074: Data Staged or Exfiltration Over C2 Channel if combined with other techniques, but more directly relates to reconnaissance activities such as T1539: Steal Web Session Cookie or general information gathering via browser-based exploits. The ability to read cross-origin canvas data enables attackers to fingerprint user environments, detect specific software configurations, and gather contextual intelligence that can facilitate further attacks like phishing or targeted malware deployment.
Mitigation for this vulnerability requires immediate updates to Google Chrome on all affected systems. Administrators should ensure that browsers are patched to version 152.0.7977.65 or later, where the Canvas API's handling of cross-origin data has been corrected to enforce stricter isolation boundaries. Additionally, users can employ browser extensions that restrict canvas access for untrusted origins as a defensive measure until updates are applied. Developers integrating third-party content into their applications should also audit their use of the Canvas API to ensure they are not inadvertently exposing sensitive rendering states through improper context management or missing checks on image sources loaded from external domains.