Disclosed Chromium Security Bugs

V8 TurboFan contextAccess depth truncation cause type confusion in Module Variable Access

#495273999•Reporter: qy...@gmail.com
$11,000
7/2/2026

UAF in UpdateShapeActive of PDF Ink V2

#494644471•Reporter: he...@gmail.com
$4,000
7/2/2026

Out-of-Bounds Write in Ruy Matrix Packing Due to int32 Overflow in Quantized Conv2d

#495096655•Reporter: ni...@intel.com
$0
7/2/2026

Arbitrary file read in UI DevTools via path traversal

#496107456•Reporter: vm...@google.com
$0
7/2/2026

DCHECK failure in i < this ->context_local_count() in scope-info-tq-inl.inc

#495888361•Reporter: 24...@project.gserviceaccount.com
$0
7/2/2026

CHECK failure: scope_info.scope_type() != ScopeType::SCRIPT_SCOPE

#495923720•Reporter: 24...@project.gserviceaccount.com
$0
7/2/2026

DCHECK failure in assigned == kMaybeAssigned in maglev-graph-builder.cc

#496074718•Reporter: 24...@project.gserviceaccount.com
$0
7/2/2026

Clamp-merge optimization corrupts maxPool2d padding via union aliasing, causing heap OOB write in GPU process

#494823884•Reporter: je...@gmail.com
$43,000
7/2/2026

Potential OOB Read in PostScriptMetaFile::SafePlayback via crafted EMF

#496196022•Reporter: vi...@google.com
$0
7/2/2026

DCHECK failure in i::Is(*local_isolate->roots_table().handle_at(index_)) in maglev-ir.cc

#495923721•Reporter: 24...@project.gserviceaccount.com
$0
7/2/2026
Showing 351-360 of 11332 bugs
1...353637...1134