Information leak in Canvas in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (CVE-2026-78908)

CVE-2026-78908 describes an information leak in the Canvas feature of Google Chrome before version 152.0.7977.65. The vulnerability enables a remote attacker to bypass the web origin policy through a specially crafted HTML page, potentially exposing limited information. The CVSS 3.1 vector indicates the attack requires no privileges and user interaction, with network attack vector, low complexity, and only impacts confidentiality. There is no indication of active exploitation or known exploits in the wild. No explicit patch or remediation details are provided in the available data.

The vulnerability allows an attacker to bypass the web origin policy, leading to a limited information leak via the Canvas API. The impact is limited to confidentiality with no effect on integrity or availability. This could potentially expose some user data or browser state but does not allow code execution or system compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users and administrators should monitor Google Chrome updates and apply the update to version 152.0.7977.65 or later once available to remediate this issue.