Disclosed Chromium Security Bugs

Checked Span: Bounds-checking end-of-allocation can crash

#535964021•Reporter: 24...@project.gserviceaccount.com
$0
9/10/2026

Potential Use-After-Free in MenuItemView::UpdateEmptyMenusAndMetrics via SetSelection Reentrancy

#536067175•Reporter: vm...@google.com
$0
9/10/2026

Security: heap-buffer-overflow in base::SubstringSetMatcher::AhoCorasickNode::SetEdge (OOB write on duplicate patterns)

#533331920•Reporter: vi...@microsoft.com
$0
9/10/2026

Potential credential leak and allowlist bypass via redirects in ProjectorXhrSender

#511754632•Reporter: vm...@google.com
$0
9/10/2026

Potential Use-After-Free in WidgetBase::UpdateCompositionInfo due to synchronous layout

#523292588•Reporter: rj...@google.com
$0
9/10/2026

Improper ONC password placeholder translation allows potential GAIA password theft

#504213206•Reporter: vm...@google.com
$0
9/10/2026

Potential Heap OOB Read/Write and Wild Free in WallpaperControllerClientImpl

#513828031•Reporter: vm...@google.com
$0
9/10/2026

Potential State Desynchronization in GrTextureResolveRenderTask Exposes Stale GPU Memory

#517973093•Reporter: vm...@google.com
$0
9/10/2026

Dawn zero-count `ResolveQuerySet` command-buffer UAF

#541130706•Reporter: le...@gmail.com
$2,500
9/10/2026

V8 Maglev/TurboFan: JSProxy identity-hash Smi confused with NameDictionary, leading to in-cage AAR/AAW

#541251902•Reporter: yu...@gmail.com
$500
9/10/2026
Showing 281-290 of 13222 bugs
1...282930...1323