Disclosed Chromium Security Bugs

Potential Use-After-Free in FileSelectHelper via double-release

#500416901•Reporter: rj...@google.com
$0
8/18/2026

SpdyStream Use-After-Free in QueueNextDataFrame via PrefacePing drain

#507365348•Reporter: ci...@gmail.com
$43,000
8/18/2026

Potential Use-After-Free in AXTree::CreateNode via AXTreeExtractor

#511731857•Reporter: vm...@google.com
$0
8/18/2026

Potential Out-of-Bounds Heap Read in iOS CrashAnalyzer via Lightweight UAF Detector

#502768780•Reporter: vm...@google.com
$0
8/18/2026

CDP Spoofing: Compromised renderer can spoof root events in flattened DevTools mode

#497532918•Reporter: vm...@google.com
$0
8/18/2026

Protocol handler hijacking via unvalidated PWA manifest schemes

#511753514•Reporter: vm...@google.com
$0
8/18/2026

CHECK failure: scope_info.scope_type() != ScopeType::SCRIPT_SCOPE in maglev-graph-builder.cc

#509162587•Reporter: 24...@project.gserviceaccount.com
$0
8/18/2026

DCHECK failure in !known_node_aspects().HasContextCacheValue( context, offset, maybe_assigned == k

#511747292•Reporter: 24...@project.gserviceaccount.com
$0
8/18/2026

DCHECK failure in state_ == kSpill in maglev-regalloc-node-info.h

#511935486•Reporter: 24...@project.gserviceaccount.com
$0
8/18/2026

Potential privilege escalation in Boca SWA SetSitePermission Mojo call grants arbitrary permissions

#496624907•Reporter: vi...@google.com
$0
8/18/2026
Showing 91-100 of 12354 bugs
1...91011...1236