CVE-2026-87651

Overview

High

Severity

4.3

CVSS

No

Exploited ITW

Fixed

Fix Status

ImpactIncorrect authorization in Paint

DescriptionIncorrect authorization in Paint

ComponentPaint

Sub-componentHiC

Bug ClassAuthorization Error

Action tierwatch — information disclosure — security-relevant, below the RCE-class bar
Computed by PatchGap's deterministic exploitability ruler from the fixing commit. patch-now = RCE-class & attacker-reachable in a default config, or exploited in the wild; watch = real security signal below that bar; noise = no security relevance.

Tracker550141694

Fix commitd514b24be816 (chromium/src) +2/-6

CWECWE-863

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

CISA KEVNot listed

CreditedOGINOME Tomohito

Reported2026-08-21 (per vendor advisory)

Fix landed2026-09-01 (public git)

Disclosed2026-09-08

Patch gap7 days — fix public in source before the advisory

Background

HTML-in-Canvas (HiC) / `drawElementImage`: an experimental Canvas API, gated by the CanvasDrawElement runtime feature and shippable as an origin trial, that lets a page draw live DOM elements (with their CSS, including filters) into a canvas.
Origin-tainted filter: a CSS filter whose operations.OriginTainted() is true because it references cross-origin content; painting it inside a canvas subtree could leak cross-origin pixels, so it must be stripped.
`state.is_in_drawable_canvas_subtree`: a flag carried in the paint-property-tree-builder fragment context that records whether the object being walked lives in a canvas-drawable subtree, independent of any per-frame feature flag.

Root Cause Analysis

During paint property tree construction, the code that decides whether an origin-tainted filter (and backdrop-filter) must be removed computed is_filter_disallowed by first calling RuntimeEnabledFeatures::CanvasDrawElementEnabled(object_.GetDocument().GetExecutionContext()). That feature check is resolved against the execution context of the frame currently being painted, so a main frame that never enabled HTML-in-Canvas returns false even though a nested same-origin subframe legitimately enabled the origin trial through its subframe-request headers. When the subframe used drawElementImage with cross-origin filter content, the main frame’s painting code short-circuited the disallow check to false, retained the origin-tainted filter, and painted it — violating the invariant that cross-origin filters must always be stripped inside a canvas-drawn subtree regardless of which frame reports the feature enabled.

The fix replaces the flag-and-IsInCanvasSubtree() test with state.is_in_drawable_canvas_subtree, which reflects the actual canvas subtree state carried through the tree walk, so the tainted filter is stripped whenever it is inside a drawable canvas subtree. The removed comment/lines confirm the old behavior deferred to the feature flag; the change is a broadening of the stripping check, not a tightening of an allow-list.

Key insight

The single mistake was gating a cross-origin security decision on a per-frame feature flag (CanvasDrawElementEnabled evaluated on the main frame’s execution context) instead of on the actual canvas-subtree state, letting a same-origin subframe that opted into the origin trial bypass filter stripping in the parent’s paint tree. The fix keys the decision on state.is_in_drawable_canvas_subtree, which is true wherever the content is actually in a drawable canvas subtree, so the flag mismatch between frames can no longer suppress stripping.

Attack Path

Host a main frame without HiC The attacker serves a top-level (or intermediate) page that does not enable the HTML-in-Canvas origin trial, so CanvasDrawElementEnabled is false for that frame’s execution context.
Embed a same-origin subframe that opts in A nested same-origin iframe is loaded whose subframe response headers enable the CanvasDrawElement origin trial, making the feature true only for the subframe.
Draw cross-origin filter content The subframe calls drawElementImage on an element carrying an origin-tainted CSS filter (one whose operations.OriginTainted() is true because it references cross-origin content).
Parent paint skips stripping When the paint property tree builder computes is_filter_disallowed, the main-frame feature check returns false, so is_filter_disallowed is false, filter_info/backdrop_filter_info is populated, and the tainted filter is painted instead of removed.
Cross-origin content is exposed The retained tainted filter renders cross-origin content that should have been blocked, leaking information across the origin boundary (inferred extent — the diff shows the removal is skipped but does not itself demonstrate the exact readback channel).

Impact Assessment

An attacker gains a cross-origin information disclosure (“Incorrect authorization in Paint”) within the renderer process: cross-origin filter content that must be stripped inside a canvas-drawn subtree is instead painted, exposing data across the origin boundary. The precondition is a frame that does not enable HTML-in-Canvas embedding a same-origin subframe that does enable the origin trial (via subframe headers) and uses drawElementImage with tainted filter content. The vendor advisory rates this high severity and does not report in-the-wild exploitation; NVD scores it CVSS 4.3. Any escalation beyond disclosure of the tainted filter content is (inferred).

Changed Functions

Function	Change	Notes
`if` third_party/blink/renderer/core/paint/paint_property_tree_builder.cc	modified

Files Changed

third_party/blink/renderer/core/paint/paint_property_tree_builder.cc

Audit Directions

Feature-flag checks as security gates
Audit any place a RuntimeEnabledFeatures::*Enabled(ExecutionContext*) (especially origin-trial-backed features) is ANDed into a cross-origin or authorization decision; the flag can differ between a frame and its same-origin subframes, so the security check should key on structural/subtree state, not the flag.
Cross-frame paint decisions
Look for paint, hit-testing, or property-tree code that reads object_.GetDocument().GetExecutionContext() to decide whether to strip or expose content, since the “current object” frame may not be the frame that produced the content being painted.
Origin-taint stripping paths
Review other consumers of operations.OriginTainted() / IsInCanvasSubtree() (filters, backdrop-filters, masks, clip-paths) to confirm each stripping decision fires on canvas-subtree state consistently rather than on a feature flag that a subframe can independently enable.

Patch

view commit

From d514b24be816134378c44660782560b16685a29e Mon Sep 17 00:00:00 2001
From: Stephen Chenney <[email protected]>
Date: Mon, 31 Aug 2026 19:44:38 -0700
Subject: [PATCH] [HiC] Fix privacy leaks due to feature flag checks

When a frame that does not enable HTML-in-Canvas embeds a same-origin
iframe that does enable the origin trial (through headers in the
subframe request) the sub-frame can use drawElementImage with
cross-origin filter content and the checks in the main frame painting
code will not remove the filter, because the main frame does not think
HTML-in-Canvas is enabled.

Fix the cross-origin filter removal code to check for canvas subtree
instead of using the feature flag. While this will remove filters in
canvas subtrees even if HTML-in-Canvas is not enabled, it doesn't matter
because the filters are not exposed to a11y and there is otherwise no
way to see them.

Bug: 550141694
Change-Id: I3dc8f8d9f157ee2a3f73851687a04d537b1dcef9
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8310987
Commit-Queue: Stephen Chenney <[email protected]>
Reviewed-by: Stefan Zager <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1689553}
---
diff --git a/third_party/blink/renderer/core/paint/paint_property_tree_builder.cc b/third_party/blink/renderer/core/paint/paint_property_tree_builder.cc
index f4c17437..d1a242b 100644
--- a/third_party/blink/renderer/core/paint/paint_property_tree_builder.cc
+++ b/third_party/blink/renderer/core/paint/paint_property_tree_builder.cc
@@ -2636,9 +2636,7 @@
       UpdateFilterEffect(object_, properties_->Filter(), filter_info);
       bool is_filter_tainted = filter_info.operations.OriginTainted();
       bool is_filter_disallowed =
-          RuntimeEnabledFeatures::CanvasDrawElementEnabled(
-              object_.GetDocument().GetExecutionContext()) &&
-          object_.IsInCanvasSubtree() && is_filter_tainted;
+          state.is_in_drawable_canvas_subtree && is_filter_tainted;
       if (!(filter_info.operations.IsEmpty() || is_filter_disallowed)) {
         state.filter_info =
             std::make_unique<EffectPaintPropertyNode::FilterInfo>(
@@ -4416,9 +4414,7 @@
   }
   if (!operations.IsEmpty()) {
     bool is_filter_disallowed =
-        RuntimeEnabledFeatures::CanvasDrawElementEnabled(
-            object_.GetDocument().GetExecutionContext()) &&
-        object_.IsInCanvasSubtree() && operations.OriginTainted();
+        state.is_in_drawable_canvas_subtree && operations.OriginTainted();
     if (!is_filter_disallowed) {
       state.backdrop_filter_info =
           base::WrapUnique(new EffectPaintPropertyNode::BackdropFilterInfo{

Loading diff…

Original Bug Report

The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.

References

Vendor advisory Fix commit Bug tracker NVD