Information leak in Canvas in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (CVE-2026-78987)

CVE-2026-78987 is an information leak vulnerability in the Canvas implementation of Google Chrome before version 152.0.7977.65. It enables a remote attacker to bypass the web origin policy, potentially exposing information that should be restricted by same-origin security controls. The vulnerability is classified under CWE-200 (Exposure of Sensitive Information). The CVSS 3.1 base score is 4.3, reflecting a network attack vector with low complexity, no privileges required, user interaction required, and limited confidentiality impact without affecting integrity or availability.

The vulnerability allows unauthorized disclosure of information by bypassing the web origin policy, potentially exposing sensitive data rendered or processed via the Canvas API. There is no impact on data integrity or system availability. No active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should update Google Chrome to version 152.0.7977.65 or later once available. Until then, cautious browsing and avoiding untrusted HTML content may reduce risk.