Disclosed Chromium Security Bugs

[Linux] Cross-Thread Use-After-Free in FontLoader::openStream via Non-Owning MappedFontFile Cache

#492374380•Reporter: je...@gmail.com
$11,000
7/30/2026

Renderer-to-GPU sandbox escape via Skia SPIR-V injection

#502636904•Reporter: qq...@calif.io
$25,000
7/30/2026

Use-After-Free in AllocateSctpSids via DCEP OPEN Message Failure Leads to Renderer Crash

#503422316•Reporter: je...@gmail.com
$11,000
7/29/2026

Arbitrary Memory Read and Write in ANGLE GL Backend via PBO Desync

#498904293•Reporter: ki...@gmail.com
$97,000
7/29/2026

Stack out-of-bounds write in CreateBufferFromHandle: unchecked DMA-BUF plane count from compromised renderer overflows fixed-size gbm_import_fd_modifier_data arrays in GPU process.

#488268854•Reporter: je...@gmail.com
$11,000
7/25/2026

ORT DML EP: heap-buffer-overflow in CreateCpuResource via int4/uint4 constants

#494248550•Reporter: to...@gmail.com
$10,000
7/25/2026

WebML Double-Free Via XNNPACK LUT-Fusion

#497456778•Reporter: h2...@gmail.com
$43,000
7/25/2026

XNNPACK Workspace Size Overflow — Heap Buffer Overflow from WebNN

#498494630•Reporter: to...@gmail.com
$42,000
7/24/2026

Use-after-free in DevToolsRendererChannel::ForceDetachWorkerSessions via duplicate ChildTargetCreated for dedicated workers

#493652473•Reporter: je...@gmail.com
$26,000
7/23/2026

Security: double-free in blink::WebRtcVideoFrameAdapter::SharedResources::ScaleAndMapFrameAsync

#494823867•Reporter: zh...@gmail.com
$11,000
7/22/2026
Showing 21-30 of 568 bugs
1234...57