Disclosed Chromium Security Bugs

`VideoFrame.copyTo()` returns unwritten alignment padding from `WebMediaPlayerMSCompositor::CopyFrame`, leaking renderer heap

#544162997•Reporter: we...@gmail.com
$0
9/11/2026

Use-after-poison in v8::internal::compiler::turboshaft::StringEscapeAnalyzer::ProcessFrameState

#543836266•Reporter: 24...@project.gserviceaccount.com
$0
9/11/2026

V8 sandbox violation in v8::internal::JavaScriptFrame::Print

#541490470•Reporter: 24...@project.gserviceaccount.com
$0
9/11/2026

gpac:fuzz_probe_analyze: Global-buffer-overflow in gf_ac4_substream_group_info

#555786511•Reporter: 87...@developer.gserviceaccount.com
$0
9/10/2026

mruby:mruby_fuzzer: Crash in mrb_vm_exec

#559374900•Reporter: 87...@developer.gserviceaccount.com
$0
9/10/2026

Crash in Builtins_InterpreterEntryTrampoline

#534417753•Reporter: 24...@project.gserviceaccount.com
$0
9/10/2026

IMG: OOB heap write via generateMipmaps, immutable textures and TEXTURE_BASE_LEVEL

#534923522•Reporter: xi...@google.com
$0
9/10/2026

sandbox.pages path matching bypass allows web content to run in the extension origin

#538969297•Reporter: oj...@gmail.com
$0
9/10/2026

Potential iOS PhishGuard paste-detection bypass via preventDefault on Cmd+V keydown

#517702279•Reporter: vm...@google.com
$0
9/10/2026

Use After Free in GrowMipLevelArray lead android sandbox escape

#499602793•Reporter: ha...@gmail.com
$32,000
9/10/2026
Showing 101-110 of 13222 bugs
1...101112...1323