Disclosed Chromium Security Bugs

Potential Use-After-Free in WebrtcVideoRendererAdapter via mutable MediaStream tracks

#501722605•Reporter: vm...@google.com
$0
7/23/2026

Potential Type Confusion in AccessibilityNodeInfoDataWrapper leads to Arbitrary Free

#501572586•Reporter: vm...@google.com
$0
7/23/2026

Potential cross-thread UAF in CommandBufferHelperImpl via Windows GPU Video Encoders

#501388286•Reporter: vm...@google.com
$0
7/23/2026

Potential UAF in FedCM UI during synchronous view destruction

#502726329•Reporter: rj...@google.com
$0
7/23/2026

Arbitrary file write via path traversal in feedback_util::ZipString

#502248774•Reporter: vm...@google.com
$0
7/23/2026

Browser-process heap UAF read in TerminalSource due to data race

#501346792•Reporter: vm...@google.com
$0
7/23/2026

TOCTOU in MHTMLGenerationManager allows DOM exfiltration via BFCache race

#499119490•Reporter: vm...@google.com
$0
7/23/2026

Use-after-free in DevToolsRendererChannel::ForceDetachWorkerSessions via duplicate ChildTargetCreated for dedicated workers

#493652473•Reporter: je...@gmail.com
$26,000
7/23/2026

Heap UAF in Blink OffscreenCanvas

#494352590•Reporter: sh...@gmail.com
$7,000
7/23/2026

V8 Sandbox Bypass: Gin FunctionTemplateInfo EPT Type Confusion via Shared ExternalPointerTag

#499960178•Reporter: qw...@gmail.com
$5,000
7/23/2026
Showing 381-390 of 11922 bugs
1...383940...1193