Disclosed Chromium Security Bugs

WebUI Privilege Escalation in Cast Shell via Unvalidated RegisterWebUiClient API

#517651910•Reporter: vm...@google.com
$0
9/10/2026

UAF and Double-Free in ~HeadlessBrowserContextImpl via Reentrant Map Erase

#517003116•Reporter: vm...@google.com
$0
9/10/2026

Cross-origin GPU texture leak via inconsistent Slug bounds in Skia Ganesh

#513948227•Reporter: vm...@google.com
$0
9/10/2026

Out-of-Bounds write in ANGLE PLS via resized attachments during active session

#513920258•Reporter: vm...@google.com
$0
9/10/2026

[V8] Incomplete fix for CVE-2026-11075: TurboFan multi-add AdditiveSafeInteger truncation produces an OOB SlicedString and controlled Uri::Unescape OOB write

#539350801•Reporter: ma...@gmail.com
$500
9/10/2026

Chrome Renderer RCE + V8 sandbox escape due to integer overflow in Wasm code space size computation during deserialization

#538378084•Reporter: ss...@qedaudit.io
$2,500
9/10/2026

Unprobed Maglev OSR frame growth can skip stack guards

#536945254•Reporter: mo...@xbow.com
$500
9/10/2026

Dawn debug-group label heap-use-after-free

#541316155•Reporter: c1...@gmail.com
$2,500
9/10/2026

RCE in Unsandboxed ProfileImport via Blink Image Codecs

#513757918•Reporter: vm...@google.com
$0
9/10/2026

UAF in QualifiedName via blink::Sanitizer::getFrom

#541854084•Reporter: ha...@google.com
$0
9/10/2026
Showing 231-240 of 13222 bugs
1...232425...1323