Disclosed Chromium Security Bugs

Double-free in Chrome's bundled OpenJPEG (opj_j2k_copy_default_tcp_and_create_tcd) reachable from PDF rendering when PartitionAlloc returns nullptr

#540817065•Reporter: mi...@gmail.com
$500
9/10/2026

incorrect Array.isArray(Smi) folding leads to an unchecked field store

#541085654•Reporter: sm...@gmail.com
$500
9/10/2026

Non-strict Int32 check is recorded as a strict bounds fact, leading to an OOB tagged store

#539075457•Reporter: sm...@gmail.com
$500
9/10/2026

Linux Chromium incorrectly triggers userActivation on focus. This allows XSS to silently harvest saved passwords on page load without clicks, bypassing mandatory user gesture security checks.

#504600482•Reporter: di...@gmail.com
$1,000
9/10/2026

Automated Password Change fills the user's password into a cross-origin iframe

#541869870•Reporter: oj...@gmail.com
$1,000
9/10/2026

Renderer use-after-free in Glic KeyDispatcher after synchronous SelectAll reentrancy

#539904797•Reporter: al...@gmail.com
$500
9/10/2026

Confused Deputy in PaymentRequestDisplayManager allows hijacked Payment Handler UI

#514006959•Reporter: vm...@google.com
$0
9/10/2026

Potential Browser-Process Use-After-Free in PaymentRequestState::OnDoneCreatingPaymentApps

#540138836•Reporter: vm...@google.com
$0
9/10/2026

Potential Cross-Origin File Leak to Non-Target Process via Uncleared post_data in FailedNavigations

#531165110•Reporter: aw...@chromium.org
$0
9/10/2026

Sandbox escape and credential disclosure in vendored gclient_eval.py on Pinpoint

#523232966•Reporter: vm...@google.com
$0
9/10/2026
Showing 221-230 of 13222 bugs
1...222324...1323