Disclosed Chromium Security Bugs

Heap OOB read in Blink text shaping

#491080830•Reporter: sh...@gmail.com
$2,000
6/18/2026

NaN poisoning in k-rate SetValueCurve leads to out-of-bounds read in DelayNode

#490533968•Reporter: je...@gmail.com
$2,000
6/18/2026

OOB in WaveShaper of WebAudio

#487357842•Reporter: he...@gmail.com
$3,000
6/18/2026

Use-after-poison in InspectorMediaEventHandler::SendQueuedMediaEvents via canvas.captureStream() (zero interaction)

#490727241•Reporter: hu...@gmail.com
$7,000
6/18/2026

CheckSmi elision in BuildCheckSmi is too aggressive for Phis with known static type

#491164735•Reporter: 24...@project.gserviceaccount.com
$0
6/18/2026

Heap buffer overflow in GPU process via WebNN LiteRT backend tensor size mismatch

#490536688•Reporter: sm...@gmail.com
$0
6/18/2026

Vulnerability: multiple vulnerabilities affecting GitOnBorg::chromium::chromium::src

#465184794•Reporter: au...@google.com
$0
6/18/2026

WebNN LiteRT: heap-buffer-overflow write in XNNPACK subconv2d via convTranspose2d

#486167751•Reporter: to...@gmail.com
$25,000
6/18/2026

imagemagick:encoder_mvg_fuzzer: Heap-buffer-overflow in RenderMVGContent

#523531851•Reporter: 87...@developer.gserviceaccount.com
$0
6/17/2026

openjph:ojph_expand_fuzz_target: Crash in ojph::local::param_dfs::get_dwt_type

#524415236•Reporter: 87...@developer.gserviceaccount.com
$0
6/17/2026
Showing 2231-2240 of 13102 bugs
1...223224225...1311