Disclosed Chromium Security Bugs

Potential Sandbox Escape via UAF in AXTreeManagerMap due to IFastRundown Race

#498883610•Reporter: vm...@google.com
$0
7/30/2026

Potential heap buffer underflow in FFmpeg mov_read_lhvc due to integer truncation (32-bit platforms)

#504364905•Reporter: vm...@google.com
$0
7/30/2026

Intl.Collator/PluralRules/DateTimeFormat still use Managed<>->raw() not ->get()

#485286897•Reporter: k1...@gmail.com
$5,000
7/30/2026

Missing validation of subsample metadata in MediaFoundation decryption path allows sandbox escape

#498700369•Reporter: er...@chromium.org
$0
7/30/2026

Use-After-Free in SVGElement::SynchronizeAttributeInShadowInstances via sync blur

#496284584•Reporter: rj...@google.com
$0
7/30/2026

Browser-process blind SSRF / LNA bypass via Cast MEDIA_STATUS image URL

#499215943•Reporter: vm...@google.com
$0
7/30/2026

Potential OOB GPU write in Dawn Metal backend via unreset depthPlane in texture workaround

#501499832•Reporter: vm...@google.com
$0
7/30/2026

Potential GPU process OOB read on Android via AHardwareBuffer_lock on multi-planar formats

#497542735•Reporter: vm...@google.com
$0
7/30/2026

Potential cross-origin credential disclosure via Android Autofill in HTTP Auth prompts

#501504245•Reporter: vm...@google.com
$0
7/30/2026

Cross-origin history leak via SVG SMIL currentColor animation

#502631225•Reporter: vm...@google.com
$0
7/30/2026
Showing 1291-1300 of 13102 bugs
1...129130131...1311