CVE Catalog
CVE-2026-13840
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk0.17%
7th percentile — higher than 7% of all known CVEs
Summary
Insufficient policy enforcement in Canvas in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
Risk Assessment
An attacker could exfiltrate sensitive data from other origins, posing a significant threat to user privacy and organizational data security.
Recommendation
Immediately update Google Chrome to version 150.0.7871.47 or later to remediate the vulnerability.
Original NVD description (English source)
Insufficient policy enforcement in Canvas in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)