Disclosed Chromium Security Bugs

ORT DML EP: heap-buffer-overflow in CreateCpuResource via int4/uint4 constants

#494248550•Reporter: to...@gmail.com
$10,000
7/25/2026

WebML Double-Free Via XNNPACK LUT-Fusion

#497456778•Reporter: h2...@gmail.com
$43,000
7/25/2026

V8 Sandbox Bypass: double-free in HandleScope::Extend via concurrent JS stack printing from MainMarkingVisitor and ConcurrentMarkingVisitor

#501136000•Reporter: gu...@gmail.com
$5,000
7/24/2026

XNNPACK Workspace Size Overflow — Heap Buffer Overflow from WebNN

#498494630•Reporter: to...@gmail.com
$42,000
7/24/2026

V8 Sandbox Bypass:TypedArray.prototype.set ElementsKind TOCTOU

#499717570•Reporter: gr...@gmail.com
$5,000
7/23/2026

Use-after-free in DevToolsRendererChannel::ForceDetachWorkerSessions via duplicate ChildTargetCreated for dedicated workers

#493652473•Reporter: je...@gmail.com
$26,000
7/23/2026

Heap UAF in Blink OffscreenCanvas

#494352590•Reporter: sh...@gmail.com
$7,000
7/23/2026

V8 Sandbox Bypass: Gin FunctionTemplateInfo EPT Type Confusion via Shared ExternalPointerTag

#499960178•Reporter: qw...@gmail.com
$5,000
7/23/2026

V8 Sandbox Escape: CopyElementsHandleSlow→SetImpl missing SBXCHECK — OOB Write 192GB past guard via getter re-entrancy (race-free, deterministic)

#500413224•Reporter: bb...@gmail.com
$5,000
7/23/2026

V8: Incorrect Address Computation in Int64LoweringReducer via IncreaseOffset element_scale Mishandling

#502030575•Reporter: ca...@gmail.com
$8,000
7/23/2026
Showing 21-30 of 1144 bugs
1234...115