CVE-2026-79193: Google Chrome Information Disclosure Flaw

CVE-2026-79193 Overview

CVE-2026-79193 is an information disclosure vulnerability in the Canvas component of Google Chrome. The flaw affects versions prior to 152.0.7977.65 and enables a remote attacker to leak cross-origin data through a crafted HTML page. The vulnerability is categorized under [CWE-200] Information Exposure. Google classified the Chromium security severity as Medium.

Exploitation requires user interaction, specifically a victim visiting a malicious or attacker-controlled web page. Successful exploitation breaks the same-origin policy protections that isolate content across web origins in the browser.

Critical Impact
A remote attacker can leak cross-origin data rendered through the Canvas API by luring a user to a crafted HTML page, undermining same-origin policy guarantees.

Affected Products

Google Chrome versions prior to 152.0.7977.65
Chromium-based browsers incorporating the vulnerable Canvas implementation
Desktop Stable channel builds released before the August 2026 update

Discovery Timeline

2026-08-25 - CVE-2026-79193 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-79193

Vulnerability Analysis

The vulnerability resides in the Canvas implementation in Chrome. The Canvas API allows scripts to draw graphics, images, and text into a bitmap surface, and the browser enforces cross-origin restrictions to prevent scripts from reading pixel data belonging to other origins.

CVE-2026-79193 breaks that isolation. An attacker who controls an HTML page can cause the browser to disclose data drawn from a different origin, bypassing the taint-tracking that would normally block cross-origin reads. This category of flaw enables read-only access to sensitive content the attacker's origin should not observe.

The issue is remotely reachable, requires no authentication, and requires user interaction limited to visiting a page. Confidentiality is impacted while integrity and availability are not.

Root Cause

The root cause is improper enforcement of cross-origin data boundaries within Canvas rendering or pixel-readback paths. When cross-origin resources are drawn to a canvas, the surface should be marked as tainted so subsequent reads fail. A missing or incorrect taint check allows attacker-controlled script to observe data derived from another origin. Full technical details are tracked in the Chromium Issue Tracker #517655953.

Attack Vector

Exploitation follows a standard drive-by pattern. The attacker hosts a crafted HTML page that loads cross-origin content and manipulates Canvas operations to extract data through read operations, pixel inspection, or timing behaviors. The victim only needs to load the page in a vulnerable Chrome build for the leak to occur. No privileges on the target system are required.

Because the attack works purely through the browser's rendering pipeline, it bypasses network-layer defenses and can be delivered through malicious ads, compromised sites, or phishing links.

Detection Methods for CVE-2026-79193

Indicators of Compromise

Chrome browser processes reporting a version string below 152.0.7977.65 in endpoint inventory data
Outbound HTTP requests to unfamiliar domains hosting HTML pages that heavily use <canvas> elements and getImageData() calls
Web content that loads cross-origin images or iframes and immediately reads Canvas pixel data

Detection Strategies

Inventory browser versions across managed endpoints and flag any Chrome install below the patched build
Monitor proxy or DNS telemetry for user navigation to newly registered or low-reputation domains delivering canvas-heavy JavaScript
Correlate browser process telemetry with unexpected reads of session tokens, authenticated resources, or SSO-protected content shortly after web browsing

Monitoring Recommendations

Track Chrome update compliance through enterprise management tooling and alert on stalled auto-updates
Log and review browser extension and script activity that queries cross-origin image or media resources
Subscribe to the Google Chrome Stable Update feed to receive advisories for related Canvas or renderer fixes

How to Mitigate CVE-2026-79193

Immediate Actions Required

Update Google Chrome to version 152.0.7977.65 or later on all managed endpoints
Restart Chrome after the update so the patched renderer process is loaded
Verify update deployment through fleet management and remediate hosts that have not restarted
Advise users to avoid untrusted links until patching is confirmed

Patch Information

Google addressed the vulnerability in the Chrome Stable channel release documented in the Google Chrome Stable Update advisory. The fix ships in Chrome 152.0.7977.65 and later builds. Chromium-based browsers should apply the corresponding upstream patch as it becomes available in their release channels.

Workarounds

Enforce Chrome auto-update policies through enterprise configuration to accelerate rollout
Restrict browsing to trusted destinations using web filtering while patch deployment is in progress
Disable JavaScript on high-risk sites through browser policy for users handling sensitive cross-origin content

bash

# Verify installed Chrome version on Windows
reg query "HKLM\SOFTWARE\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv

# Verify installed Chrome version on macOS
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version

# Verify installed Chrome version on Linux
google-chrome --version