Disclosed Chromium Security Bugs

Safe Browsing bypass via stale hash state on parallel-to-serial download resumption

#517163294•Reporter: vm...@google.com
$0
9/26/2026

Potential browser-process UAF and heap corruption via off-thread ModelQualityLogEntry destruction

#520516206•Reporter: vm...@google.com
$0
9/26/2026

Text fragment scrolls cross-origin despite a retained opener, when the target calls history.replaceState()

#549911100•Reporter: ti...@gmail.com
$0
9/26/2026

Cross-process security state manipulation via shared BrowsingContextState

#495529018•Reporter: rj...@google.com
$0
9/26/2026

Potential UXSS via unvalidated javascript: schemes in Omnibox DocumentProvider

#523208474•Reporter: rj...@google.com
$0
9/26/2026

Potential UXSS via missing user activation check in ReadAnythingUntrustedPageHandler

#552413517•Reporter: pl...@google.com
$0
9/26/2026

[V8 Sandbox Bypass] Missing write barrier for JS_DISPATCH_HANDLE can leave stale optimized code and control the instruction pointer

#549892124•Reporter: yu...@gmail.com
$1,000
9/26/2026

SSRF, Browser DoS, and Lifetime Escape via ProvisionFetcherImpl

#497204165•Reporter: vm...@google.com
$0
9/25/2026

DCHECK failure in pos.line > 0 in profile-generator.cc

#552023752•Reporter: 24...@project.gserviceaccount.com
$0
9/25/2026

Potential Arbitrary File Read in ARC Content FileSystem via Confused Deputy

#502793739•Reporter: vm...@google.com
$0
9/25/2026
Showing 41-50 of 13222 bugs
1...456...1323