Google and Microsoft disclosed CVE-2026-7977 on May 6, 2026, as a medium-severity Chrome Canvas flaw fixed in Chrome 148.0.7778.96 for Linux and 148.0.7778.96/97 for Windows and macOS, allowing a crafted HTML page to bypass the browser’s same-origin policy. That is the plain answer; the more...