Disclosed Chromium Security Bugs

V8 Sandbox Bypass: OOB Write using %TypedArray%.prototype.set due to element type/size TOCTOU

#435630461•Reporter: kr...@gmail.com
$7,000
4/24/2026

V8 Sandbox Bypass: AAW due to JSArrayBuffer extension handle double fetch

#464296297•Reporter: h3...@gmail.com
$20,000
4/24/2026

Potential parameter count mismatch via `SharedFunctionInfoRef::GetBytecodeArray()`

#462288596•Reporter: is...@chromium.org
$0
4/24/2026

lua:string_len_test: Crash in arena_for_chunk

#505242510•Reporter: 87...@developer.gserviceaccount.com
$0
4/23/2026

libvips:vips_fuzzer: Heap-buffer-overflow in vips_stdif_generate

#503995698•Reporter: 87...@developer.gserviceaccount.com
$0
4/23/2026

c-blosc2:decompress_frame_fuzzer: Use-of-uninitialized-value in get_coffset

#494958474•Reporter: 87...@developer.gserviceaccount.com
$0
4/23/2026

skcms:iccprofile_transform: Heap-buffer-overflow in skcms_private::baseline::clut

#504261818•Reporter: 87...@developer.gserviceaccount.com
$0
4/23/2026

freetype2:truetype-render-i35: Heap-buffer-overflow in TT_RunIns

#499455833•Reporter: 87...@developer.gserviceaccount.com
$0
4/23/2026

libvips:vips_fuzzer: Heap-buffer-overflow in vips_bandjoin_const_buffer

#500174822•Reporter: 87...@developer.gserviceaccount.com
$0
4/23/2026

thrift-java:RoundtripCompactFuzzer: Security exception in org.apache.thrift.protocol.TProtocolUtil.skip

#478126022•Reporter: 87...@developer.gserviceaccount.com
$0
4/23/2026
Showing 2801-2810 of 13102 bugs
1...280281282...1311