Tainted Canvas -

: Attempting to use getImageData() will throw a SecurityError .

: You cannot use toDataURL() , toBlob() , or captureStream() . Tainted Canvas

This feature protects user privacy by preventing malicious websites from "stealing" sensitive images (like bank statements or private photos) that might be cached or authenticated in a user's browser. Without this, a script could draw a private image to a canvas, read its pixels, and send that data to a third-party server. How to Fix It (CORS) cookies - Why is a "tainted canvas" a risk? : Attempting to use getImageData() will throw a

: The content remains visible to the user, but it cannot be programmatically read back or saved by scripts. Why It Exists Without this, a script could draw a private

Once a canvas is "tainted," it is no longer considered "origin-clean," and the browser blocks functions that allow you to read its pixel data: