Disclosed Chromium Security Bugs

Fatal error in Type cast failed in Parameter 0 at ../../src/builtins/builtins-handler-gen.cc:29

#339736513•Reporter: sa...@google.com
$0
8/20/2024

V8 sandbox violation in v8::internal::maglev::CapturedObject::set

#339517309•Reporter: 24...@project.gserviceaccount.com
$0
8/20/2024

neteq_rtp_fuzzer: Use-of-uninitialized-value in webrtc::test::NetEqTest::RunToNextGetAudio

#339308502•Reporter: 24...@project.gserviceaccount.com
$0
8/20/2024

CHECK failure: !v8::internal::v8_flags.enable_slow_asserts.value() || (IsJSObject_NonInline(*th

#339685170•Reporter: sa...@google.com
$0
8/20/2024

Type Confusion between WasmObject and JSObject in Array Concat

#338908243•Reporter: ki...@gmail.com
$10,000
8/17/2024

CHECK failure: (location_) != nullptr in maybe-handles.h

#339043696•Reporter: 24...@project.gserviceaccount.com
$0
8/17/2024

Use After Free in BackForwardCacheDisablingFeatureTracker::ReportFeaturesToDelegate()

#336012573•Reporter: lo...@gmail.com
$11,000
8/17/2024

Security: UAF in CSSSelectorParser::ParsePseudoElement

#339458177•Reporter: ti...@chromium.org
$0
8/16/2024

open_type_math_support_fuzzer: Crash in tt_face_get_colr_glyph_paint

#41495455•Reporter: cl...@chromium.org
$0
8/16/2024

dawn_wire_server_and_vulkan_backend_fuzzer: Use-of-uninitialized-value in dawn_wire_server_and_vulkan_backend_fuzzer

#335704885•Reporter: 24...@project.gserviceaccount.com
$0
8/16/2024
Showing 3131-3140 of 10559 bugs
1...313314315...1056