CVE-2026-78908: Google Chrome Canvas Information Disclosure

CVE-2026-78908 Overview

CVE-2026-78908 is an information disclosure vulnerability in the Canvas component of Google Chrome versions prior to 152.0.7977.65. A remote attacker can bypass the web origin policy using a crafted HTML page, causing Chrome to expose data that should be isolated across origins. Chromium's internal security triage rated the issue High severity.

The flaw is tracked under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor. Exploitation requires the target to load attacker-controlled web content, making drive-by browsing and malvertising realistic delivery paths.

Critical Impact
A malicious page can read cross-origin pixel data or other Canvas-derived information, breaking the same-origin policy that browsers rely on to isolate sensitive site content.

Affected Products

Google Chrome for Desktop prior to 152.0.7977.65
Chromium-based browsers built on affected upstream versions
Downstream forks embedding the vulnerable Canvas component

Discovery Timeline

2026-08-25 - CVE-2026-78908 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-78908

Vulnerability Analysis

The vulnerability resides in the Canvas implementation used by Chrome for 2D graphics rendering. Canvas normally enforces origin tainting: any image or resource loaded from a different origin without proper cross-origin resource sharing (CORS) headers marks the canvas as tainted, blocking pixel readback through APIs such as getImageData() and toDataURL().

CVE-2026-78908 breaks that enforcement. An attacker-controlled page can induce Chrome to expose Canvas-derived data across origin boundaries, defeating the browser's core isolation model. The disclosure category (CWE-200) indicates the leak reveals data the caller should not be able to observe rather than achieving code execution.

With an EPSS probability of 0.329%, wide-scale opportunistic exploitation is not yet predicted, but the underlying primitive is directly useful in targeted attacks. See the Chromium Issue Tracker entry #532904047 for restricted technical details.

Root Cause

The root cause is improper enforcement of same-origin restrictions within the Canvas pipeline. A specific sequence of Canvas operations, likely involving cross-origin image sources, filters, or compositing, allows pixel information to be recovered despite the canvas being tainted. The exact code path is embargoed in the Chromium tracker until users have had time to update.

Attack Vector

Exploitation occurs entirely through the web. An attacker hosts a crafted HTML page, or delivers it through a third-party frame such as an advertisement or embedded widget. When a victim visits the page, JavaScript on the page loads a cross-origin target resource, performs the triggering Canvas operations, and reads out data belonging to that other origin.

Useful targets include authenticated images from webmail, banking, social media, or corporate SaaS applications loaded via the victim's active session cookies. No user interaction beyond visiting the page is required. See the Google Chrome Stable Channel Update for release context.

Detection Methods for CVE-2026-78908

Indicators of Compromise

Browser processes loading pages that make repeated getImageData() or toDataURL() calls against cross-origin image sources.
Outbound POST traffic from browser renderers containing base64-encoded image blobs to unfamiliar domains.
Chrome versions older than 152.0.7977.65 reported by endpoint inventory after the patch release date.

Detection Strategies

Inventory installed Chrome versions across the fleet and flag any host below 152.0.7977.65.
Inspect web proxy logs for pages that load authenticated cross-origin images and then exfiltrate large encoded payloads.
Alert on browser child processes making unusual DNS lookups to freshly registered domains shortly after visiting untrusted content.

Monitoring Recommendations

Feed browser version telemetry into the security data lake and build a persistent query for outdated Chrome installations.
Monitor Content Security Policy (CSP) violation reports from internal applications for anomalous cross-origin canvas reads.
Track process lineage from chrome.exe renderer processes to detect follow-on activity after suspicious page visits.

How to Mitigate CVE-2026-78908

Immediate Actions Required

Update Google Chrome to version 152.0.7977.65 or later on all managed endpoints.
Force browser restart through group policy so the patched binary is actually loaded into memory.
Update Chromium-based browsers (Edge, Brave, Opera, Vivaldi) as their vendors ship rebased releases.

Patch Information

Google addressed the issue in the Stable channel release documented at the Chrome Releases blog. The fixed build is 152.0.7977.65. Enterprises using the Chrome Enterprise MSI or managed update channels should verify that the new version reaches all Windows, macOS, and Linux hosts. Restricted implementation details remain in Chromium Issue #532904047.

Workarounds

Enforce automatic Chrome updates through the ChromeCleanupEnabled and AutoUpdateCheckPeriodMinutes policies to shrink the exposure window.
Restrict browsing to trusted destinations for high-value accounts using proxy category filtering until patching is complete.
Disable third-party content in sensitive web applications through strict CSP img-src and frame-ancestors directives.

bash

# Verify installed Chrome version on Windows via PowerShell
(Get-Item "C:\Program Files\Google\Chrome\Application\chrome.exe").VersionInfo.ProductVersion

# macOS
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version

# Linux
google-chrome --version

# Expected output: 152.0.7977.65 or later