Disclosed Chromium Security Bugs

A crafted GLSL ES 3.0 shader triggers an AST transformation bug in ANGLE's shared compiler frontend that produces an internally inconsistent AST (dangling variable references).

#484756087•Reporter: ja...@gmail.com
$2,000
8/15/2026

Reentrant socket destruction during ThrottlingP2PNetworkInterceptor timer callback leads to heap-use-after-free in the Network Service (browser process on Android)

#487357841•Reporter: je...@gmail.com
$5,000
8/15/2026

Potential UAF via stale KHR_debug callback in Passthrough Decoder due to EGLState context retention

#500187083•Reporter: vm...@google.com
$0
8/15/2026

CHECK failure: !scope_info.HasOuterScopeInfo() implies d + 1 == depth in maglev-graph-builder.c

#508813947•Reporter: 24...@project.gserviceaccount.com
$0
8/15/2026

CHECK failure: !WriteBarrier::IsRequired(heap_object, Tagged(value)) in heap.cc

#510444284•Reporter: 24...@project.gserviceaccount.com
$0
8/15/2026

Trap in Builtins_InterpreterEntryTrampoline

#509995033•Reporter: 24...@project.gserviceaccount.com
$0
8/15/2026

DCHECK failure in !map.is_identical_to(lookup_start_object_map()) in ic.cc

#509622555•Reporter: 24...@project.gserviceaccount.com
$0
8/15/2026

Missing allowSkSL Gate In Skia SkRuntimeImageFilter::CreateProc Lets DevTools-Protocol Callers Compile Arbitrary SkSL In The Renderer

#510813403•Reporter: as...@gmail.com
$0
8/15/2026

V8 Turboshaft late load elimination reuses stale map load after aliased map transition

#508811477•Reporter: mu...@winfunc.com
$500
8/14/2026

Potential Use-After-Free in Chrome Management API via PWA Navigation Capturing

#506558270•Reporter: vm...@google.com
$0
8/14/2026
Showing 861-870 of 13102 bugs
1...868788...1311