CVE-2026-78987 Overview
CVE-2026-78987 is an information disclosure vulnerability in the Canvas component of Google Chrome. Versions prior to 152.0.7977.65 allow a remote attacker to bypass the web origin policy through a crafted HTML page. The Chromium project rates the security severity as Medium and classifies the weakness under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.
The flaw undermines the same-origin isolation that Canvas rendering is expected to enforce. An attacker who convinces a user to load a malicious page can read pixel data or derived state that should remain scoped to another origin.
Critical Impact
Cross-origin information disclosure via Canvas allows a remote attacker to read data from other web origins that the browser should isolate.
Affected Products
- Google Chrome desktop versions prior to 152.0.7977.65
- Chromium-based browsers that share the vulnerable Canvas code path
- Embedded frameworks packaging Chromium below the fixed release
Discovery Timeline
- 2026-08-25 - CVE-2026-78987 published to the National Vulnerability Database (NVD)
- 2026-08-26 - Last updated in the NVD database
Technical Details for CVE-2026-78987
Vulnerability Analysis
The vulnerability sits in Chrome's Canvas implementation, which exposes 2D and image-processing primitives to web pages. Canvas is required to honor the web origin policy so that pixel data derived from cross-origin resources cannot be read back by script. This flaw breaks that boundary.
A crafted HTML page can coerce Canvas into revealing data that should be tainted or unreadable across origins. The result is an information leak affecting confidentiality without requiring authentication or elevated privileges on the target machine. Public references include the Chrome Releases stable channel update and Chromium Issue #501594511.
Root Cause
The root cause is improper enforcement of origin isolation within Canvas rendering or read-back operations. When cross-origin content is drawn into a canvas, the surface must be marked tainted so operations such as getImageData or toDataURL fail. The vulnerable code path fails to preserve that state, permitting an attacker to extract pixel or metadata information from another origin.
Attack Vector
Exploitation is remote and requires user interaction limited to visiting a page controlled by the attacker. No credentials, prompts, or extensions are needed. The attacker hosts a crafted HTML document that loads a cross-origin resource, draws it to a canvas, and invokes the leaking operation. See the Chromium issue tracker entry for further technical detail once the report is unrestricted.
No verified exploit code is publicly available for this CVE. The vulnerability is described in prose only; refer to the vendor advisory for authoritative technical detail.
Detection Methods for CVE-2026-78987
Indicators of Compromise
- Browser telemetry showing Chrome or Chromium builds with versions below 152.0.7977.65 in production use
- Web proxy logs recording user navigation to unfamiliar domains that render Canvas content and issue cross-origin image fetches
- Repeated calls to getImageData, toDataURL, or readPixels following cross-origin resource loads from suspicious pages
Detection Strategies
- Inventory installed Chrome versions across managed endpoints and flag any build older than 152.0.7977.65.
- Correlate web gateway logs with browser version data to identify users at risk while visiting untrusted origins.
- Hunt for phishing lures or ad-network redirects delivering pages that heavily use Canvas APIs against third-party image endpoints.
Monitoring Recommendations
- Enable browser management reporting to receive real-time version and extension inventory data.
- Ingest DNS and HTTP proxy logs into a SIEM to correlate outbound requests with browser build data.
- Track vendor security bulletins and the Chrome Releases blog for follow-up advisories referencing Canvas.
How to Mitigate CVE-2026-78987
Immediate Actions Required
- Update Google Chrome to version 152.0.7977.65 or later on all managed endpoints.
- Restart browser sessions after patch deployment to ensure the vulnerable process is replaced.
- Push equivalent updates for Chromium-based browsers and embedded frameworks that inherit the Canvas code path.
Patch Information
Google addressed the vulnerability in the Stable channel update for desktop, shipping the fix in Chrome 152.0.7977.65. Full release notes and channel details are available in the Chrome Releases announcement. Downstream Chromium consumers should upgrade to a build that incorporates the corresponding merge from Chromium Issue #501594511.
Workarounds
- Restrict browsing to trusted sites through enterprise URL filtering until patches are deployed.
- Enforce automatic browser updates via group policy so that the fixed build reaches endpoints without user action.
- Isolate high-risk browsing in a remote browser or dedicated virtual machine to contain any cross-origin data exposure.
# Verify installed Chrome version on Linux/macOS endpoints
google-chrome --version
# Windows: query the installed version from the registry
reg query "HKLM\Software\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
