Disclosed Chromium Security Bugs

Race Condition Between Maglev IdentityMap and Mark-Compact GC ThinString Shortcutting Leads to OOB Write in Trusted Space

#508811474•Reporter: hu...@gmail.com
$500
8/13/2026

Potential iOS Autofill isolation bypass via async callback resurrection

#505123022•Reporter: li...@chromium.org
$0
8/13/2026

Potential arbitrary write in Browser via uninitialized memory in GamepadDeviceMac

#508463705•Reporter: li...@chromium.org
$0
8/13/2026

Potential Folder Hijacking in iOS Save to Drive via Shared Folders

#508257850•Reporter: li...@chromium.org
$0
8/13/2026

Potential Site Isolation Bypass in iOS Actor Tools via Routing Mismatch

#505076737•Reporter: li...@chromium.org
$0
8/13/2026

Potential Privilege Escalation via Unvalidated continue_url in Account Consistency Flow on iOS

#505200733•Reporter: li...@chromium.org
$0
8/13/2026

OOB Access in WebGL via ANGLE Identifier Collision and Clamp Bypass

#499176133•Reporter: vm...@google.com
$0
8/13/2026

Potential Cross-Thread Use-After-Free in MediaFoundationStreamWrapper

#503565293•Reporter: rj...@google.com
$0
8/13/2026

CSP bypass in MV2 extensions via script-src-elem/attr

#500528267•Reporter: vm...@google.com
$0
8/13/2026

Potential Heap Buffer Overflow in Mac WebMenuRunner via unvalidated item_font_size IPC

#508452241•Reporter: li...@chromium.org
$0
8/13/2026
Showing 971-980 of 13102 bugs
1...979899...1311