Disclosed Chromium Security Bugs

ARM64 MOPS register clobber mismodeling in V8 leads to in-sandbox OOB access

#502300817•Reporter: rj...@google.com
$0
8/13/2026

Renderer UAF in PostMessageSupport::SetActive via structured-clone getters

#506375731•Reporter: vm...@google.com
$0
8/13/2026

Potential GPU Info Leak via Dawn TransientAttachment Validation Bypass

#501629978•Reporter: vm...@google.com
$0
8/13/2026

V8 TryFastAddDataProperty descriptor-array OOB access

#506689381•Reporter: hu...@gmail.com
$55,000
8/13/2026

Potential Heap-buffer-overflow in libaom av1_rc_scene_detection_onepass_rt via WebCodecs

#502735235•Reporter: rj...@google.com
$0
8/13/2026

HTTP Request Smuggling via IndexedDB Blob Size Forgery and DataPipe Underflow

#497660733•Reporter: vm...@google.com
$0
8/13/2026

Information Leak: Autofill preview length leak via textarea.scrollTop

#506163510•Reporter: vm...@google.com
$0
8/13/2026

Potential Use-After-Free in PassthroughTouchEventQueue during synchronous touch ACK processing

#495939973•Reporter: vm...@google.com
$0
8/13/2026

Service-side UAF due to missing sync token update in C*RP:WillDrawInternal()

#493708171•Reporter: he...@gmail.com
$10,000
8/13/2026

Mach port handle confusion in Browser process via CALayerParams copy-assignment

#502104354•Reporter: vm...@google.com
$0
8/13/2026
Showing 921-930 of 13102 bugs
1...929394...1311