Disclosed Chromium Security Bugs

dangling pointer in external pointer table after iframe destruction

#542670566•Reporter: ke...@gmail.com
$1,000
9/18/2026

OOB in CreateTextureMemory

#497202432•Reporter: ha...@gmail.com
$32,000
9/18/2026

Site Isolation bypass: the ungated extensions RendererAutomationRegistry handler lets a compromised web renderer read cross-origin/cross-profile accessibility trees (page text, frame URLs).

#540265100•Reporter: og...@gmail.com
$5,000
9/18/2026

Potential cross-domain username leak for weakly affiliated credentials

#547832510•Reporter: dr...@google.com
$0
9/18/2026

V8 Sandbox Bypass: Swap SFI::trusted_function_data during bytecode flushing

#546080080•Reporter: ar...@google.com
$0
9/17/2026

Read grant restoration bypass via rename round-trip in File System Access API

#496401361•Reporter: vm...@google.com
$0
9/14/2026

Capability leak: KeepAliveURLLoaderService clones allow persistent access to origin credentials

#497869284•Reporter: er...@chromium.org
$0
9/14/2026

Potential OAuth token leakage via cross-origin redirects in google_apis::UrlFetchRequestBase

#513608831•Reporter: vm...@google.com
$0
9/14/2026

libyal:libvsgpt_partition_fuzzer: Crash in libvsgpt_partition_entry_read_data

#541965639•Reporter: 87...@developer.gserviceaccount.com
$0
9/12/2026

libxaac:xaac_enc_fuzzer: Index-out-of-bounds in iusace_estimate_scfs_chan

#531479957•Reporter: 87...@developer.gserviceaccount.com
$0
9/12/2026
Showing 71-80 of 13222 bugs
1...789...1323