PatchGap
Chrome · Paint › Html-in-canvas

CVE-2026-11133

Policy Bypass in Paint (Html-in-canvas)
Medium CVSS 6.5 chrome Policy Bypass 🔧 Commit mapped

Overview

Medium
Severity
6.5
CVSS
No
Exploited ITW
Fixed
Fix Status
ImpactInsufficient policy enforcement in Paint
DescriptionInsufficient policy enforcement in Paint
ComponentPaint
Sub-componentHtml-in-canvas
Bug ClassPolicy Bypass
Tracker501606085
Fix commit3cfdad305ed7 (chromium/src) +13/-6
Related commits06a08a18aaf4 candidate · chromium/src
27dafe4c2314 previously mapped (not the fix) · chromium/src
CWECWE-346 (Origin validation error)
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
CISA KEVNot listed
CreditedGoogle
Reported2026-04-11 (per vendor advisory)
Fix landed2026-04-27 (public git)
Disclosed2026-06-02
Patch gap36 days — fix public in source before the advisory
Re-mapped on 2026-10-03: our pipeline had picked the earliest commit citing this bug (27dafe4c2314), which an audit found was a preparatory/helper change, not the fix. This page now points to the commit whose diff removes the bug. No root-cause analysis is published for this CVE.

Changed Functions

FunctionChangeNotes
if
third_party/blink/renderer/core/paint/paint_property_tree_builder.cc
 modified

Files Changed

  • third_party/blink/renderer/core/paint/paint_property_tree_builder.cc
  • third_party/blink/web_tests/wpt_internal/html/canvas/drawElementImage/privacy/backdrop-filter-png-images-ignored.https.sub.html

Patch

view commit
diff --git a/third_party/blink/renderer/core/paint/paint_property_tree_builder.cc b/third_party/blink/renderer/core/paint/paint_property_tree_builder.cc
index 5bb86692..8b375d4 100644
--- a/third_party/blink/renderer/core/paint/paint_property_tree_builder.cc
+++ b/third_party/blink/renderer/core/paint/paint_property_tree_builder.cc
@@ -4096,9 +4096,17 @@
     }
   }
   if (!operations.IsEmpty()) {
-    state.backdrop_filter_info =
-        base::WrapUnique(new EffectPaintPropertyNode::BackdropFilterInfo{
-            std::move(operations), bounds, mask_compositor_element_id});
+    bool is_filter_disallowed =
+        RuntimeEnabledFeatures::CanvasDrawElementEnabled(
+            object_.GetDocument().GetExecutionContext()) &&
+        IsA<Element>(object_.GetNode()) &&
+        To<Element>(object_.GetNode())->IsInCanvasSubtree() &&
+        operations.OriginTainted();
+    if (!is_filter_disallowed) {
+      state.backdrop_filter_info =
+          base::WrapUnique(new EffectPaintPropertyNode::BackdropFilterInfo{
+              std::move(operations), bounds, mask_compositor_element_id});
+    }
   }
 }
 
diff --git a/third_party/blink/web_tests/wpt_internal/html/canvas/drawElementImage/privacy/backdrop-filter-png-images-ignored.https.sub.html b/third_party/blink/web_tests/wpt_internal/html/canvas/drawElementImage/privacy/backdrop-filter-png-images-ignored.https.sub.html
index 28ee93a0..6c368b1d 100644
--- a/third_party/blink/web_tests/wpt_internal/html/canvas/drawElementImage/privacy/backdrop-filter-png-images-ignored.https.sub.html
+++ b/third_party/blink/web_tests/wpt_internal/html/canvas/drawElementImage/privacy/backdrop-filter-png-images-ignored.https.sub.html
@@ -75,9 +75,8 @@
 
         let pixel = getPixel(5, 5);
         assert_array_equals(pixel, [0, 255, 0, 255], "Same origin feImage backdrop-filter should draw");
-        // TODO(https://crbug.com/501606085): Enable the cross-origin test.
-        // pixel = getPixel(5, 15);
-        // assert_array_equals(pixel, [0, 0, 255, 255], "Cross origin feImage backdrop-filter should not draw");
+        pixel = getPixel(5, 15);
+        assert_array_equals(pixel, [0, 0, 255, 255], "Cross origin feImage backdrop-filter should not draw");
       });
     }
   </script>
Loading diff…

Regression Test / PoC

shipped with the fix
diff --git a/third_party/blink/web_tests/wpt_internal/html/canvas/drawElementImage/privacy/backdrop-filter-png-images-ignored.https.sub.html b/third_party/blink/web_tests/wpt_internal/html/canvas/drawElementImage/privacy/backdrop-filter-png-images-ignored.https.sub.html
index 28ee93a0..6c368b1d 100644
--- a/third_party/blink/web_tests/wpt_internal/html/canvas/drawElementImage/privacy/backdrop-filter-png-images-ignored.https.sub.html
+++ b/third_party/blink/web_tests/wpt_internal/html/canvas/drawElementImage/privacy/backdrop-filter-png-images-ignored.https.sub.html
@@ -75,9 +75,8 @@
 
         let pixel = getPixel(5, 5);
         assert_array_equals(pixel, [0, 255, 0, 255], "Same origin feImage backdrop-filter should draw");
-        // TODO(https://crbug.com/501606085): Enable the cross-origin test.
-        // pixel = getPixel(5, 15);
-        // assert_array_equals(pixel, [0, 0, 255, 255], "Cross origin feImage backdrop-filter should not draw");
+        pixel = getPixel(5, 15);
+        assert_array_equals(pixel, [0, 0, 255, 255], "Cross origin feImage backdrop-filter should not draw");
       });
     }
   </script>
Loading diff…

Original Bug Report

The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.
On This Page