Information leak in Canvas in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (CVE-2026-79193)

CVE-2026-79193 is an information leak vulnerability in the Canvas implementation of Google Chrome before version 152.0.7977.65. It enables a remote attacker to leak data from other origins by using a specially crafted HTML page. The vulnerability has a CVSS 3.1 base score of 4.3 (medium severity), with an attack vector of network, low attack complexity, no privileges required, user interaction required, and impacts confidentiality only without affecting integrity or availability.

An attacker can remotely cause a cross-origin information leak via the Canvas API, potentially exposing sensitive data from other origins to the attacker. The impact is limited to confidentiality loss; there is no impact on integrity or availability. No known exploits are reported in the wild at this time.

A fix is available in Google Chrome version 152.0.7977.65 and later. Users and administrators should update to this version or later to remediate the vulnerability. Since this is a client-side browser vulnerability, applying the official update is the recommended mitigation.