Disclosed Chromium Security Bugs

Potential Use-After-Free in BrowserActionFactory via dangling Browser pointer

#505324751•Reporter: li...@chromium.org
$0
7/31/2026

Potential out-of-bounds read in validating command decoder due to flawed CanAccess logic

#503464551•Reporter: vm...@google.com
$0
7/31/2026

[Tabs] Use-after-free in TabStripActionContainer nudge animation-end callback

#504175497•Reporter: yu...@microsoft.com
$0
7/31/2026

Global-Buffer-Overflow in GetDecoderName() via Unchecked static_cast in Cast Remoting

#486536242•Reporter: am...@gmail.com
$0
7/31/2026

Potential Cross-Origin Password Leak via WebAuthn Request Clobbering on Android

#500044225•Reporter: vm...@google.com
$0
7/31/2026

Potential Heap OOB Read/Write in libvpx VP9 Encoder via Cast Mirroring

#504587797•Reporter: vm...@google.com
$0
7/31/2026

Turboshaft: stale `PhiOp` replacement for Wasm arrays causes `array.len` bounds bypass and out-of-bounds array read/write

#505481948•Reporter: pj...@gmail.com
$55,000
7/31/2026

GPU Process RCE via Integer Overflow in Dawn Command Iterator

#499159695•Reporter: vm...@google.com
$0
7/31/2026

GPU Process RCE via Dawn CommandIterator Desync in WriteBuffer(size=0)

#500090141•Reporter: vm...@google.com
$0
7/31/2026

Stale renderTargetWidth in cached MTLRenderPassDescriptor leads to potential GPU OOB write

#498721316•Reporter: vm...@google.com
$0
7/31/2026
Showing 101-110 of 11922 bugs
1...101112...1193