This vulnerability in Google Chrome's Canvas implementation prior to version 149.0.7827.53 allows a remote attacker to bypass the same origin policy by using a specially crafted HTML page. The same origin policy is a critical security mechanism that restricts how documents or scripts loaded from one origin can interact with resources from another origin. Bypassing this policy can lead to unauthorized actions or data manipulation within the browser context. The CVSS score is 6.5 (medium severity), indicating a moderate risk with network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact. No known exploits are reported in the wild. The vendor advisory link is provided but does not explicitly state patch or remediation status.

The vulnerability allows bypassing the same origin policy, which can compromise the integrity of web content and potentially allow unauthorized manipulation of data or actions within the browser. There is no reported impact on confidentiality or availability. The attack requires user interaction and can be performed remotely over the network without privileges.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html for current remediation guidance. Users and administrators should monitor official Google Chrome release notes for updates addressing this vulnerability. Until a patch is confirmed, exercising caution with untrusted web content is advised.