Executive brief
A security vulnerability in Google Chrome's Canvas component could allow a malicious website to bypass the browser's Same-Origin Policy. This policy is a fundamental security boundary that prevents one website from reading data from another. If exploited, an attacker could potentially access sensitive information from other websites you have open in your browser.
Technical details
An inappropriate implementation in the Canvas component of Google Chrome allowed for a Same-Origin Policy (SOP) bypass. By enticing a user to visit a specially crafted HTML page, a remote attacker could exploit this flaw to access data across origin boundaries. The vulnerability stems from how the Canvas API handles cross-origin resources, potentially allowing unauthorized data extraction. This issue was addressed in Google Chrome version 149.0.7827.53. Chromium developers classified this as a Medium severity issue.
Affected products
- Google Chrome prior to 149.0.7827.53
Timeline
- 2026-06-02: patched: Fixed in Chrome 149.0.7827.53 stable release.
- 2026-06-04: disclosed: CVE published.