Disclosed Chromium Security Bugs

Bad-cast to blink::LayoutObject from invalid vptr in blink::LayoutInline::SplitFlow

#40056530•Reporter: cl...@chromium.org
$0
10/20/2021

Crash in blink::LayoutObject::SlowLastChild

#40056537•Reporter: cl...@chromium.org
$0
10/20/2021

Heap-use-after-free in blink::Text::RecalcTextStyle

#40056538•Reporter: cl...@chromium.org
$0
10/20/2021

Heap-use-after-free in blink::HasRenderedNonAnonymousDescendantsWithHeight

#40056539•Reporter: cl...@chromium.org
$0
10/20/2021

tint_msl_transform_fuzzer: Heap-buffer-overflow in tint::writer::msl::GeneratorImpl::EmitTypeConstructor

#40056487•Reporter: cl...@chromium.org
$0
10/19/2021

CHECK failure: !v8::internal::FLAG_enable_slow_asserts || (IsHeapObject()) in heap-object.h

#40056507•Reporter: cl...@chromium.org
$0
10/19/2021

Cross-origin download bypasses SameSite cookie

#40091708•Reporter: s....@gmail.com
$1,000
10/18/2021

CHECK failure: kind() == CodeKind::BASELINE

#40056495•Reporter: cl...@chromium.org
$0
10/18/2021

Container-overflow in cc::draw_property_utils::LayerShouldBeSkippedForDrawPropertiesComputation

#40056414•Reporter: cl...@chromium.org
$0
10/17/2021

Container-overflow in cc::LayerImpl::LayerPropertyChangedFromPropertyTrees

#40056415•Reporter: cl...@chromium.org
$0
10/17/2021
Showing 8271-8280 of 13102 bugs
1...827828829...1311