Disclosed Chromium Security Bugs

Turbolev: stale DataView field type after GC can lead to arbitrary memory r/w

#541926503•Reporter: po...@gmail.com
$1,000
9/10/2026

Potential Sandbox Escape via TOCTOU in WebUSB DeviceImpl transfers

#522732244•Reporter: rj...@google.com
$0
9/10/2026

Potential uninitialized VRAM read in CompoundImageBacking via failed proactive copy-back

#536460270•Reporter: aw...@chromium.org
$0
9/10/2026

Potential Switch Access UI Spoofing via Web Content leading to Cross-Origin Data Theft

#513699064•Reporter: vm...@google.com
$0
9/10/2026

Potential missing key binding in CloudPolicyValidatorBase allows arbitrary policy injection via MITM

#511761758•Reporter: vm...@google.com
$0
9/10/2026

V8 Sandbox Bypass: EPT copied-handle laundering leads to PaintWorklet MicrotaskQueue OOS write

#515252150•Reporter: sm...@gmail.com
$2,500
9/10/2026

Site Isolation Bypass via Missing Blob Redirect Validation in WorkerScriptLoader

#532939327•Reporter: vm...@google.com
$0
9/10/2026

Service Worker navigation leak of unfiltered kCors response headers

#524541667•Reporter: vm...@google.com
$0
9/10/2026

Gesture hijack in TabDragController via nested VisibilityWaiter run loop

#522302504•Reporter: vm...@google.com
$0
9/10/2026

Potential cross-world object leak in Blink Streams implementation via stored_error_

#520516462•Reporter: vm...@google.com
$0
9/10/2026
Showing 241-250 of 13222 bugs
1...242526...1323