This vulnerability (CVE-2026-13840) in Google Chrome is due to insufficient policy enforcement in the Canvas API, enabling a remote attacker to leak cross-origin data by crafting a malicious HTML page. The issue affects Chrome versions before 150.0.7871.47. The CVSS 3.1 base score is 6.5, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, high confidentiality impact, and no integrity or availability impact. The vulnerability is categorized under CWE-346 (Insufficient Authorization). The vendor advisory is linked but does not explicitly state if a fix is available or if users must take action.

Successful exploitation allows a remote attacker to leak sensitive cross-origin data through the Canvas feature in affected Chrome versions. This compromises confidentiality but does not affect integrity or availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html for current remediation guidance. Until confirmation of a fix, users should exercise caution when visiting untrusted websites and consider updating to the latest Chrome version once available.