Disclosed Chromium Security Bugs

Cross-Origin OPFS Access via Missing Bucket Ownership Check in DeserializeHandle

#498710886•Reporter: rj...@google.com
$0
9/20/2026

V8 Sandbox Bypass: JSArrayBuffer during shared Wasm serialization

#546253900•Reporter: le...@depthfirst.com
$2,500
9/20/2026

Origin spoofing and PNA bypass in WebViewGuest via loadDataWithBaseUrl

#502179319•Reporter: vm...@google.com
$0
9/20/2026

Reused Maglev deoptimization `HeapNumber` enables cage-wide read/write

#547819997•Reporter: mo...@xbow.com
$1,000
9/19/2026

CORS preflight cache keyed on raw request_initiator, not byte-serialized origin -- tainted (`Origin: null`) preflight satisfies untainted request

#543464436•Reporter: nh...@gmail.com
$0
9/19/2026

Extensions isolation bypass due to a TOCTOU in DevTools shortcut forwarding and missing selected-call-frame authorization

#548611433•Reporter: be...@gmail.com
$0
9/19/2026

V8 sandbox violation in v8::internal::ExternalString::DisposeResource

#532204454•Reporter: 24...@project.gserviceaccount.com
$0
9/19/2026

Potential cross-origin info leak via Framebuffer signature collision in validating decoder

#513162143•Reporter: vm...@google.com
$0
9/19/2026

IMG: cross-origin information disclosure exists in the WebGPU shading pipeline due to uninitialization

#546639650•Reporter: xi...@google.com
$0
9/19/2026

Potential DRM Bypass via missing UpdateTarget call in DesktopCaptureAccessHandler

#514487499•Reporter: rj...@google.com
$0
9/19/2026
Showing 61-70 of 13222 bugs
1...678...1323