Disclosed Chromium Security Bugs

Browser-process heap UAF read in TerminalSource due to data race

#501346792•Reporter: vm...@google.com
$0
7/23/2026

TOCTOU in MHTMLGenerationManager allows DOM exfiltration via BFCache race

#499119490•Reporter: vm...@google.com
$0
7/23/2026

Use-after-free in DevToolsRendererChannel::ForceDetachWorkerSessions via duplicate ChildTargetCreated for dedicated workers

#493652473•Reporter: je...@gmail.com
$26,000
7/23/2026

Heap UAF in Blink OffscreenCanvas

#494352590•Reporter: sh...@gmail.com
$7,000
7/23/2026

V8 Sandbox Bypass: Gin FunctionTemplateInfo EPT Type Confusion via Shared ExternalPointerTag

#499960178•Reporter: qw...@gmail.com
$5,000
7/23/2026

V8 Sandbox Escape: CopyElementsHandleSlow→SetImpl missing SBXCHECK — OOB Write 192GB past guard via getter re-entrancy (race-free, deterministic)

#500413224•Reporter: bb...@gmail.com
$5,000
7/23/2026

RISC-V64: Missing WasmCodePointer bounds masking (incomplete fix for bug 446113730)

#483050098•Reporter: kf...@gmail.com
$0
7/23/2026

Bypass of PreventInfiniteLoops via flawed LoopAnalysis leads to OOB GPU memory access

#502206907•Reporter: vm...@google.com
$0
7/23/2026

Potential uninitialized GPU memory leak in Dawn D3D12 T2B copies via workaround buffer

#500443031•Reporter: vm...@google.com
$0
7/23/2026

ContentSettings policy bypass via IP address subresources

#498373018•Reporter: vm...@google.com
$0
7/23/2026
Showing 1521-1530 of 13102 bugs
1...152153154...1311