CVE-2026-78895: Google Chrome Paint Information Disclosure

CVE-2026-78895 Overview

CVE-2026-78895 is an information disclosure vulnerability in the Paint component of Google Chrome. Versions prior to 152.0.7977.65 allow a remote attacker to bypass the web origin policy through a crafted HTML page. The flaw is categorized under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor. Chromium engineers rated the underlying issue as High severity. Successful exploitation enables cross-origin data leakage, undermining the same-origin policy that isolates content between web origins in the browser.

Critical Impact
A remote attacker who convinces a user to visit a malicious page can read data belonging to other web origins, breaking a core browser isolation boundary.

Affected Products

Google Chrome Desktop versions prior to 152.0.7977.65
Chromium-based browsers incorporating the vulnerable Paint component
Downstream distributions that ship pre-152.0.7977.65 Chromium builds

Discovery Timeline

2026-08-25 - CVE-2026-78895 published to the National Vulnerability Database (NVD)
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-78895

Vulnerability Analysis

The vulnerability resides in Chrome's Paint subsystem, which is responsible for rasterizing and compositing web content prior to display. A crafted HTML page can manipulate Paint operations in a way that exposes pixel or graphics data across origin boundaries. This defeats the same-origin policy protections that normally prevent one site from reading rendered content belonging to another site.

Because the issue involves the rendering pipeline, exploitation does not require authentication or user interaction beyond loading the attacker-controlled page. The leaked information may include cross-origin image data, framed document contents, or other visual state that the browser processes during paint. See the Chromium Issue Tracker entry and the Google Chrome stable channel update for the official disclosure.

Root Cause

The root cause is improper enforcement of origin boundaries within Chrome's Paint code path [CWE-200]. Data intended to remain isolated to a specific origin becomes observable to script running in a different origin due to insufficient checks during rendering operations.

Attack Vector

An attacker hosts a crafted HTML page and lures a victim to visit it. The page issues rendering operations that trigger the Paint bug and reads back cross-origin pixel or content data using standard web APIs. The attack requires only that the victim load the page in a vulnerable Chrome build. No verified proof-of-concept code has been published; technical specifics remain restricted in the Chromium issue tracker at time of disclosure.

Detection Methods for CVE-2026-78895

Indicators of Compromise

Chrome browser processes running versions prior to 152.0.7977.65 in the environment
Endpoints navigating to unfamiliar domains hosting HTML pages that heavily exercise <canvas>, drawImage, or cross-origin iframe rendering
Outbound HTTP POST traffic containing base64-encoded image or canvas data to attacker-controlled hosts shortly after page load

Detection Strategies

Inventory installed Chrome versions across managed endpoints and flag any build below 152.0.7977.65
Correlate browser process telemetry with network destinations to surface visits to newly registered or low-reputation domains
Monitor web proxy logs for anomalous exfiltration patterns from browser processes, particularly large body payloads to non-corporate hosts

Monitoring Recommendations

Enable centralized browser version reporting through enterprise management policies
Alert on Chrome update failures that leave endpoints on outdated builds
Review DNS and proxy telemetry for domains associated with credential phishing or malvertising campaigns that could deliver the crafted page

How to Mitigate CVE-2026-78895

Immediate Actions Required

Update Google Chrome to version 152.0.7977.65 or later on all managed endpoints
Force-restart the browser after update to ensure the patched binaries are loaded
Audit Chromium-based browsers (Edge, Brave, Opera, Vivaldi) and apply vendor updates that incorporate the upstream fix

Patch Information

Google addressed CVE-2026-78895 in Chrome Stable 152.0.7977.65. Full details are available in the Google Chrome stable channel update. The underlying Chromium fix is tracked in Chromium Issue #532914190, which remains access-restricted pending broader patch adoption.

Workarounds

No official workaround exists; patching is the supported remediation path
Restrict browsing to trusted sites via enterprise policy where immediate patching is not feasible
Use browser isolation or remote browsing solutions for high-risk user populations until updates are deployed

bash

# Verify Chrome version on Linux/macOS endpoints
google-chrome --version

# Windows: query installed version via registry
reg query "HKLM\SOFTWARE\Google\Chrome\BLBeacon" /v version