Disclosed Chromium Security Bugs

Stack out-of-bounds write in CreateBufferFromHandle: unchecked DMA-BUF plane count from compromised renderer overflows fixed-size gbm_import_fd_modifier_data arrays in GPU process.

#488268854•Reporter: je...@gmail.com
$11,000
7/25/2026

DCHECK failure in !IsTheHole(argument) in elements.cc

#503622408•Reporter: 24...@project.gserviceaccount.com
$0
7/25/2026

DCHECK failure in IsPrimitiveMap(*this) || instance_type() == WASM_NULL_TYPE in map-inl.h

#503472574•Reporter: 24...@project.gserviceaccount.com
$0
7/25/2026

ORT DML EP: heap-buffer-overflow in CreateCpuResource via int4/uint4 constants

#494248550•Reporter: to...@gmail.com
$10,000
7/25/2026

ORT DML EP: new-delete-type-mismatch via WebNN quantizeLinear

#493566347•Reporter: to...@gmail.com
$0
7/25/2026

WebML Double-Free Via XNNPACK LUT-Fusion

#497456778•Reporter: h2...@gmail.com
$43,000
7/25/2026

CHECK failure: Phi of kRepFloat64 (Range(0, inf)) cannot be changed to kRepWord64 in representa

#502923583•Reporter: 24...@project.gserviceaccount.com
$0
7/25/2026

Cross-origin permission state leak via top_level_storage_access extension

#497448099•Reporter: rj...@google.com
$0
7/25/2026

Potential persistent cross-device IME hijack via ARC ime_id comma injection

#502368416•Reporter: vm...@google.com
$0
7/25/2026

javaparser:parseFuzzer: Security exception in com.github.javaparser.ast.expr.FieldAccessExpr.accept

#537183300•Reporter: 87...@developer.gserviceaccount.com
$0
7/24/2026
Showing 1451-1460 of 13102 bugs
1...145146147...1311