Disclosed Chromium Security Bugs

Use-After-Free in AsyncTaskManager::WaitAllPendingTasks Due to Early Task Destruction in GPU Process

#492735369•Reporter: se...@gmail.com
$11,000
8/13/2026

V8 race UAF/SEGV in `TracedHandles` with ProgrammaticScrollPromise

#504073879•Reporter: at...@gmail.com
$10,000
8/13/2026

V8 Sandbox Bypass: Compiler-Eliminated CPT Tag Check

#500771385•Reporter: qw...@gmail.com
$20,000
8/4/2026

Missing lifetime check in SpdyStream::IncreaseRecvWindowSize leads to use-after-free in Network Service

#503420443•Reporter: je...@gmail.com
$43,000
8/4/2026

D3D10Warp!JITCopyContext::ExecuteResourceCopy memory heap overflow based on Integer overflow in gpu

#480548427•Reporter: do...@gmail.com
$17,000
8/4/2026

Validating Decoder Stale PACK_ALIGNMENT causes GPU Heap OOB Write

#505077859•Reporter: ci...@gmail.com
$43,000
8/1/2026

Turbolev: incorrent opcode effect modeling can lead to arbitrary code execution

#503975738•Reporter: pj...@gmail.com
$55,000
8/1/2026

Turboshaft: stale `PhiOp` replacement for Wasm arrays causes `array.len` bounds bypass and out-of-bounds array read/write

#505481948•Reporter: pj...@gmail.com
$55,000
7/31/2026

UAF in WebViewImpl::Minimize

#492899974•Reporter: he...@gmail.com
$11,000
7/31/2026

V8 sandbox bypass: reuse unpublished WasmDispatchTable lead to reproduce of 483220222

#503422307•Reporter: pv...@gmail.com
$20,000
7/30/2026
Showing 11-20 of 568 bugs
1234...57