CVE-2026-78908: Infoleak

Q: What does an attacker need to exploit this issue?

An attacker needs to get a user to load a crafted HTML page in an affected Chrome browser. The issue is exploitable remotely and can bypass the web origin policy.

Q: Which Chrome versions are affected?

Google Chrome versions prior to 152.0.7977.65 are affected. Update Chrome to 152.0.7977.65 or later.

Q: What could indicate exposure before an update is applied?

Exposure requires visiting an attacker-controlled crafted HTML page while using an affected version. The provided information does not identify a specific observable indicator or log artifact for successful exploitation.

Published Aug 25, 2026

Updated

Information leak in Canvas in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: High)

Affected Software

1 affected component

Google Google Chrome<152.0.7977.65

Event History

Aug 25, 2026

CVE Published

via MITRE·08:10 PM

Data Sourced

via MITRE·08:10 PM

DescriptionWeakness

Frequently Asked Questions

What does an attacker need to exploit this issue?

An attacker needs to get a user to load a crafted HTML page in an affected Chrome browser. The issue is exploitable remotely and can bypass the web origin policy.

Which Chrome versions are affected?

Google Chrome versions prior to 152.0.7977.65 are affected. Update Chrome to 152.0.7977.65 or later.

What could indicate exposure before an update is applied?

Exposure requires visiting an attacker-controlled crafted HTML page while using an affected version. The provided information does not identify a specific observable indicator or log artifact for successful exploitation.

CVE-2026-78908: Infoleak

Affected Software

Event History

Frequently Asked Questions

What does an attacker need to exploit this issue?

Which Chrome versions are affected?

What could indicate exposure before an update is applied?

Company

Resources

Contact

Frequently Asked Questions

What does an attacker need to exploit this issue?

Which Chrome versions are affected?

What could indicate exposure before an update is applied?