Disclosed Chromium Security Bugs

AreRequestHeadersSafe() missing Origin and Sec-* prefix blocking — compromised renderer forges Origin and Sec-Fetch-* headers via modified_headers in FollowRedirect

#494800494•Reporter: os...@gmail.com
$1,000
8/13/2026

GPU memory leak via uninitialized locals in hardened ANGLE contexts

#503438092•Reporter: vm...@google.com
$0
8/13/2026

ARM64 MOPS register clobber mismodeling in V8 leads to in-sandbox OOB access

#502300817•Reporter: rj...@google.com
$0
8/13/2026

Renderer UAF in PostMessageSupport::SetActive via structured-clone getters

#506375731•Reporter: vm...@google.com
$0
8/13/2026

Potential GPU Info Leak via Dawn TransientAttachment Validation Bypass

#501629978•Reporter: vm...@google.com
$0
8/13/2026

V8 TryFastAddDataProperty descriptor-array OOB access

#506689381•Reporter: hu...@gmail.com
$55,000
8/13/2026

Potential Heap-buffer-overflow in libaom av1_rc_scene_detection_onepass_rt via WebCodecs

#502735235•Reporter: rj...@google.com
$0
8/13/2026

HTTP Request Smuggling via IndexedDB Blob Size Forgery and DataPipe Underflow

#497660733•Reporter: vm...@google.com
$0
8/13/2026

Information Leak: Autofill preview length leak via textarea.scrollTop

#506163510•Reporter: vm...@google.com
$0
8/13/2026

Potential Use-After-Free in PassthroughTouchEventQueue during synchronous touch ACK processing

#495939973•Reporter: vm...@google.com
$0
8/13/2026
Showing 191-200 of 12354 bugs
1...192021...1236