Disclosed Chromium Security Bugs

Potential gl_FragData indexing bypass via comma operator leading to OOB SPIR-V generation

#540019091•Reporter: vm...@google.com
$0
9/10/2026

Incomplete fix for 536584251: UAF in AuthenticatorRequestDialogController (two missed SetCurrentStep sites)

#539754136•Reporter: yu...@gmail.com
$0
9/10/2026

Potential host-heap OOB read and wild pointer dereference in ANGLE Vulkan via unchecked sampler arrays

#536648007•Reporter: aw...@chromium.org
$0
9/10/2026

Potential Host OOB Write in ANGLE D3D11 via Stale mReservedSpace and Unchecked Addition

#536444790•Reporter: aw...@chromium.org
$0
9/10/2026

OOB OpAccessChain in ANGLE Vulkan via RewriteStructSamplers Name Collision

#536434693•Reporter: aw...@chromium.org
$0
9/10/2026

IMG: OOB heap read via copyTexImage2D and TEXTURE_BASE_LEVEL

#534912743•Reporter: xi...@google.com
$0
9/10/2026

A use-after-free in the IMG Vulkan user-mode driver's dynamic-rendering attachment cache reachable from WebGPU

#529878021•Reporter: xi...@google.com
$0
9/10/2026

Potential Local Privilege Escalation (Double-Free/UAF) in Updater AppWebImpl via Data Race

#524453236•Reporter: aw...@chromium.org
$0
9/10/2026

Bypass of tab-modal dialog protections via unhandled keyboard event redispatch

#523277481•Reporter: rj...@google.com
$0
9/10/2026

SameSite CSRF via stale force_ignore_site_for_cookies flag on no-cors redirects

#503464711•Reporter: vm...@google.com
$0
9/10/2026
Showing 211-220 of 13222 bugs
1...212223...1323