Disclosed Chromium Security Bugs

V8 Sandbox Bypass: CompileLazy can install WasmResume into a mismatched JDT entry and control the native PC

#537948358•Reporter: sm...@gmail.com
$2,500
9/10/2026

Incompatible Cached `ScopeInfo` Causes a Sloppy-Arguments Underallocation and Caged ARW

#536271629•Reporter: am...@openai.com
$0
9/10/2026

Bad-free / Double-free memory corruption in XNNPACK subgraph optimization triggered via WebNN API

#539052047•Reporter: ds...@gmail.com
$0
9/10/2026

Browser UAF in IncognitoConnectability::Query via synchronous infobar destruction

#498402782•Reporter: vm...@google.com
$0
9/10/2026

AdditiveSafeInteger Plain Conversion Loses Range/NaN Guard and Forges Out-of-Range SlicedString Views, Enabling a V8 Heap Out-of-Bounds Write

#531503216•Reporter: am...@openai.com
$0
9/10/2026

Potential Use-After-Free in DefaultCaptureClient::SetCapture via synchronous window destruction

#502041642•Reporter: vm...@google.com
$0
9/10/2026

Potential ANGLE Vulkan: Use-After-Free of VkSampler in cleanupOrphanedSamplers

#517935753•Reporter: vm...@google.com
$0
9/10/2026

Potential Vulkan Use-After-Free in TextureVk::releaseImage due to Bypassed Dirty-Bit Guard

#519259107•Reporter: vm...@google.com
$0
9/10/2026

Potential browser-process UAF in X11Window::DispatchEvent due to re-entrant window destruction

#524395469•Reporter: vm...@google.com
$0
9/10/2026

V8 Sandbox Bypass: API callback provenance split causes Blink Window type confusion

#532323117•Reporter: sm...@gmail.com
$2,500
9/10/2026
Showing 321-330 of 13222 bugs
1...323334...1323