CVE-2026-78895
Executive Summary
CVE-2026-78895 is a high-severity information leak vulnerability in Google Chrome's Paint component, fixed in version 152.0.7977.65. A remote attacker can exploit this flaw via a crafted HTML page to bypass web origin policy, potentially exposing sensitive cross-origin data to unauthorized parties. Given that no CVSS vector is currently available (scored N/A) and no public PoC or exploit code has been identified, exploitation likelihood in the wild remains speculative at this time; however, the browser-based attack vector and high severity rating warrant immediate patching priority for enterprise environments.
This record — and 170,000+ others — are available via the ValtersIT API. One endpoint replaces five: NVD + GitHub CVE + CISA KEV + EPSS + Nuclei + Exploit-DB, unified.
No signup required
Technical Analysis
CVE-2026-78895 describes an information leak within the Paint subsystem of Google Chrome prior to version 152.0.7977.65. The NVD description identifies the underlying weakness as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The vulnerability enables a remote attacker to bypass the browser's web origin policy using a crafted HTML page.
Vulnerability Mechanism:
The origin policy is a fundamental security boundary in web browsers, ensuring that content from one origin cannot access resources from another. The Paint component in Chrome is responsible for rendering visual content on the page — including elements, compositing layers, and visual effects. The vulnerability arises when this component inadvertently exposes information that should be isolated to a different origin.
While the specific implementation details are not disclosed in the NVD description, the vulnerability class suggests that when Chrome's Paint subsystem processes certain crafted HTML constructs (potentially involving CSS filters, transforms, or compositing operations), it fails to properly enforce the origin isolation boundary. This could leak pixel data, rendered content, layout metrics, or other visual information from cross-origin frames to the attacker-controlled page.
Attack Surface:
The attack surface is any user running Chrome 152.0.7977.65 or earlier who visits a malicious webpage. The attack vector is remote and requires no user interaction beyond visiting the crafted page — the user does not need to click, download, or otherwise interact with the content. JavaScript execution on the attacker's page is the presumed trigger mechanism, though the NVD description does not explicitly confirm this.
Attack Complexity:
Chromium security severity is rated as "High," which typically indicates either a moderate complexity attack with significant impact or a low complexity attack with substantial impact. Without CVSS metadata, the precise attack complexity cannot be determined. However, browser-based origin policy bypass vulnerabilities in rendering components generally require a victim to simply visit a malicious page, making the practical complexity low.
Exploitation Scenarios
Threat Actor Profile: The primary threat actors for this vulnerability are likely: (1) state-sponsored espionage groups targeting specific individuals (journalists, activists, government officials) via drive-by watering hole attacks, and (2) cybercriminals conducting credential harvesting or data theft campaigns.
Attack Chain:
Reconnaissance / Target Identification: The attacker identifies a target population or specific individuals. They then create or compromise a legitimate website likely to be visited by the target. This is a classic watering hole setup — the attacker does not need to directly target the victim's network; they simply need the victim to visit the malicious site.
Vulnerability Trigger: The victim's Chrome browser (version < 152.0.7977.65) renders the crafted HTML page. The page embeds cross-origin content (e.g., an
What is this? Security researchers use these exact search queries on Shodan.io (a search engine for internet-connected devices) to find vulnerable systems globally. You can copy these dorks to see if your organization's IP space is exposed.