Disclosed Chromium Security Bugs

Type confusion in BuildCheckSmi constant folding in V8/Maglev

#500880819•Reporter: qq...@calif.io
$55,000
7/22/2026

TFLite castInt4ToFloat heap-buffer-overflow (OOB Write) via WebNN dequantizeLinear

#498063923•Reporter: to...@gmail.com
$33,000
7/22/2026

heap-buffer-overflow in Dawn BufferGL::MapAtCreationImpl

#500774812•Reporter: ki...@gmail.com
$33,000
7/19/2026

Reentrant vector mutation during FrameSink invalidation causes heap use-after-free in Viz process

#493955227•Reporter: je...@gmail.com
$16,000
7/18/2026

V8 sandbox bypass: WasmDispatchTable swapping lead to use of not fully initialized WasmTrustedInstanceData

#498095290•Reporter: pv...@gmail.com
$20,000
7/18/2026

heap-use-after-free in dawn::native::vulkan::BindGroupLayout::GetOrCreateSpecializedHandle

#500609038•Reporter: ki...@gmail.com
$11,000
7/18/2026

Use-After-Free in DCOMPSurfaceRegistry due to data race on unsynchronized flat_map access in GPU Process

#490251701•Reporter: se...@gmail.com
$11,000
7/17/2026

Integer overflow in ruy pack kernel offset leads to heap OOB write in the GPU process via WebNN quantized Gemm

#497159159•Reporter: je...@gmail.com
$11,000
7/16/2026

Integer overflow in ruy SumsBytes leads to heap OOB write in the GPU process via WebNN quantized Gemm

#497202425•Reporter: je...@gmail.com
$11,000
7/16/2026

REFILE: Browser-Process UAF in FileSystemAccessChangeSource::DidInitialize (Reliability-Improved PoC)

#497880137•Reporter: as...@gmail.com
$10,000
7/15/2026
Showing 31-40 of 568 bugs
1...345...57