Disclosed Chromium Security Bugs

V8 sandbox violation in v8::internal::maglev::CapturedObject::set

#339517309•Reporter: 24...@project.gserviceaccount.com
$0
8/20/2024

neteq_rtp_fuzzer: Use-of-uninitialized-value in webrtc::test::NetEqTest::RunToNextGetAudio

#339308502•Reporter: 24...@project.gserviceaccount.com
$0
8/20/2024

CHECK failure: !v8::internal::v8_flags.enable_slow_asserts.value() || (IsJSObject_NonInline(*th

#339685170•Reporter: sa...@google.com
$0
8/20/2024

Type Confusion between WasmObject and JSObject in Array Concat

#338908243•Reporter: ki...@gmail.com
$10,000
8/17/2024

CHECK failure: (location_) != nullptr in maybe-handles.h

#339043696•Reporter: 24...@project.gserviceaccount.com
$0
8/17/2024

Use After Free in BackForwardCacheDisablingFeatureTracker::ReportFeaturesToDelegate()

#336012573•Reporter: lo...@gmail.com
$11,000
8/17/2024

Security: UAF in CSSSelectorParser::ParsePseudoElement

#339458177•Reporter: ti...@chromium.org
$0
8/16/2024

open_type_math_support_fuzzer: Crash in tt_face_get_colr_glyph_paint

#41495455•Reporter: cl...@chromium.org
$0
8/16/2024

dawn_wire_server_and_vulkan_backend_fuzzer: Use-of-uninitialized-value in dawn_wire_server_and_vulkan_backend_fuzzer

#335704885•Reporter: 24...@project.gserviceaccount.com
$0
8/16/2024

GPU process crash via WebGPU shader - SimplifyInstruction in InstructionSimplify.cpp

#333414294•Reporter: wg...@gmail.com
$10,000
8/15/2024
Showing 5641-5650 of 13102 bugs
1...564565566...1311