Executive brief
Google Chrome is a widely used web browser. A security vulnerability in the Canvas component, which handles graphics and images, could allow a malicious website to bypass security boundaries and access data from other websites you have open. This could lead to the unauthorized exposure of sensitive personal or corporate information.
Technical details
A vulnerability exists in Google Chrome's Canvas component due to insufficient policy enforcement. A remote attacker can exploit this by enticing a user to visit a specially crafted HTML page. Successful exploitation allows the attacker to bypass Same-Origin Policy (SOP) restrictions and leak sensitive data from different origins (cross-origin data). The issue is addressed in Google Chrome version 150.0.7871.47 and later.
Affected products
- Google Chrome prior to 150.0.7871.47
Timeline
- 2026-06-30: advisory
- 2026-06-30: patched