Disclosed Chromium Security Bugs

V8 sandbox bypass: reuse unpublished WasmDispatchTable lead to reproduce of 483220222

#503422307•Reporter: pv...@gmail.com
$20,000
7/30/2026

[Linux] Cross-Thread Use-After-Free in FontLoader::openStream via Non-Owning MappedFontFile Cache

#492374380•Reporter: je...@gmail.com
$11,000
7/30/2026

CanvasRenderingContext2D::drawFocusIfNeeded dangling `Path` use-after-free

#501646327•Reporter: qw...@gmail.com
$7,000
7/30/2026

Intl.Collator/PluralRules/DateTimeFormat still use Managed<>->raw() not ->get()

#485286897•Reporter: k1...@gmail.com
$5,000
7/30/2026

Renderer-to-GPU sandbox escape via Skia SPIR-V injection

#502636904•Reporter: qq...@calif.io
$25,000
7/30/2026

ANGLE: missing setPixelPackBuffer(nullptr) in norm16 readback workaround causes GPU process crash via WebGL PBO type confusion

#503768143•Reporter: ma...@gmail.com
$5,000
7/29/2026

Use-After-Free in AllocateSctpSids via DCEP OPEN Message Failure Leads to Renderer Crash

#503422316•Reporter: je...@gmail.com
$11,000
7/29/2026

Arbitrary Memory Read and Write in ANGLE GL Backend via PBO Desync

#498904293•Reporter: ki...@gmail.com
$97,000
7/29/2026

GPU process arbitrary address read via unvalidated client pointer in passthrough `CompressedTexImage3D` / `CompressedTexSubImage3D` handlers

#495373657•Reporter: se...@gmail.com
$5,000
7/29/2026

Stack out-of-bounds write in CreateBufferFromHandle: unchecked DMA-BUF plane count from compromised renderer overflows fixed-size gbm_import_fd_modifier_data arrays in GPU process.

#488268854•Reporter: je...@gmail.com
$11,000
7/25/2026
Showing 11-20 of 1144 bugs
1234...115