Disclosed Chromium Security Bugs

Fenced frame `_unfencedTop` navigation leaks `initiator_origin` to destination via `Sec-Fetch-Site`

#487564032•Reporter: os...@gmail.com
$3,000
8/13/2026

VerifyInitiatorOrigin() skips HostsOrigin() process lock check for opaque origins in error documents and MHTML subframes

#487300831•Reporter: os...@gmail.com
$2,000
8/13/2026

Previous page executes JS after navigation, allowing history.back() tab hijack

#480074849•Reporter: mr...@gmail.com
$2,000
8/13/2026

Popup window tab doesn't show the origin correctly

#458442542•Reporter: sa...@gmail.com
$1,000
8/13/2026

Site Isolation bypass via error page precursors and sandboxed srcdoc frames

#502348223•Reporter: vm...@google.com
$0
8/13/2026

Parser differential in experimental Rust XML lexer via chunk boundaries

#502285273•Reporter: vm...@google.com
$0
8/13/2026

Info leak of global UMA data via metricsPrivate.getHistogram in chrome-untrusted://

#502256049•Reporter: vm...@google.com
$0
8/13/2026

Potential cross-origin info leak via uninitialized Skia stencil buffer

#501861921•Reporter: vm...@google.com
$0
8/13/2026

Sandbox escape via AppleScript `save` command allowing arbitrary file write

#501844153•Reporter: vm...@google.com
$0
8/13/2026

Compromised renderer can remove other extensions' webRequest listeners via EventRouter IPC

#501739206•Reporter: vm...@google.com
$0
8/13/2026
Showing 1051-1060 of 13102 bugs
1...105106107...1311