Disclosed Chromium Security Bugs

Security: V8: JIT: JSBuiltinReducer::ReduceObjectCreate fails to ensure that the prototype is "null"

#40089898•Reporter: lo...@google.com
$0
3/24/2018

Security: pdfium: out-of-bounds read with nested colorspaces

#40089904•Reporter: ma...@google.com
$0
3/24/2018

Security: V8: JIT: Type confusion in GetSpecializationContext

#40089912•Reporter: lo...@google.com
$0
3/24/2018

CHECK failure: LoadElement of kRepFloat64 (NumberOrHole) cannot be changed to kRepTagged in rep

#40089901•Reporter: cl...@chromium.org
$0
3/22/2018

Security: V8: JIT: Simplified-lowererer IrOpcode::kStoreField, IrOpcode::kStoreElement optimization bug

#40089761•Reporter: lo...@google.com
$0
3/15/2018

Use-of-uninitialized-value in media::DecoderBuffer::timestamp

#40089202•Reporter: cl...@chromium.org
$0
3/14/2018

pobfuzz: cc::DrawTextBlobOp::Deserialize -> use-of-uninitialized-value in int const& SkTMax

#40089606•Reporter: cl...@chromium.org
$0
3/14/2018

CHECK failure: NumberToUint32 of kRepWord32 (Range(1, NUMBER)) cannot be changed to kRepTaggedS

#40089791•Reporter: cl...@chromium.org
$0
3/14/2018

ServiceWorkerScriptURLLoader does not check for certificate errors properly

#40089722•Reporter: es...@chromium.org
$0
3/9/2018

CHECK failure: frame_state->opcode() == IrOpcode::kFrameState || (node->opcode() == IrOpcode::k

#40089685•Reporter: cl...@chromium.org
$0
3/6/2018
Showing 6841-6850 of 10955 bugs
1...684685686...1096