Disclosed Chromium Security Bugs

Potential Heap OOB Write in ChromeOS Video Capture Service via Unvalidated Camera HAL Dimensions

#502760197•Reporter: vm...@google.com
$0
9/10/2026

JSPI Wasm-Resume Fixed-Arity Assumption Enables Native ROP Outside the V8 Heap Sandbox

#534416978•Reporter: am...@openai.com
$0
9/10/2026

PDF process isolation bypass via lazy RestrictedCookieManager binding

#516665605•Reporter: vm...@google.com
$0
9/10/2026

Bypass of PDF storage isolation restrictions via FileSystemAccessManager

#517484284•Reporter: vm...@google.com
$0
9/10/2026

StoreStoreElimination can eliminate initializing stores

#527385397•Reporter: pi...@arm.com
$500
9/10/2026

Potential UAF/Data Race in WebRTC track replacement due to iframe detachment

#523296105•Reporter: rj...@google.com
$0
9/10/2026

JSDispatchTable entry mark-bit erasure in Code::SetMarkedForDeoptimization

#525686865•Reporter: vm...@google.com
$0
9/10/2026

Libvpx VP8 MT decoder uninitialized heap memory leak

#504633668•Reporter: vm...@google.com
$0
9/10/2026

Blink IDLRecord conversion can outgrow its reserved native Vector during reentrancy

#536913431•Reporter: mo...@xbow.com
$1,000
9/10/2026

Bypass of password manual fallback security checks via direct mojom::AutofillDriver IPC

#521502218•Reporter: vm...@google.com
$0
9/10/2026
Showing 301-310 of 13222 bugs
1...303132...1323