Disclosed Chromium Security Bugs

Renderer-to-GPU sandbox escape via Skia SPIR-V injection

#502636904•Reporter: qq...@calif.io
$25,000
7/30/2026

Potential UAF in ModalDialogWrapper during 200ms exit animation

#502139310•Reporter: vm...@google.com
$0
7/30/2026

DCHECK failure in i < context_local_count() in scope-info-inl.h

#503411275•Reporter: 24...@project.gserviceaccount.com
$0
7/30/2026

CHECK failure: IsJSReceiver(obj)

#505118175•Reporter: 24...@project.gserviceaccount.com
$0
7/30/2026

DCHECK failure in disposable_stack->state() == DisposableStackState::kDisposed implies static_cast

#505178419•Reporter: 24...@project.gserviceaccount.com
$0
7/30/2026

DCHECK failure in instance_type != HOLE_TYPE in objects-inl.h

#505028208•Reporter: 24...@project.gserviceaccount.com
$0
7/30/2026

CHECK failure: IsJSReceiver(obj)

#505117976•Reporter: 24...@project.gserviceaccount.com
$0
7/30/2026

DCHECK failure in IsPrimitiveMap(this) || instance_type() == WASM_NULL_TYPE in map-inl.h

#505118173•Reporter: 24...@project.gserviceaccount.com
$0
7/30/2026

Potential UAF and RCE via re-entrant aura::Window destruction on Windows

#497548912•Reporter: vm...@google.com
$0
7/30/2026

Potential Information Leak in ANGLE GL backend via integer overflow in robust resource initialization

#495363705•Reporter: rj...@google.com
$0
7/30/2026
Showing 181-190 of 11922 bugs
1...181920...1193