Disclosed Chromium Security Bugs

PowerVR sparse page-map heap OOB reachable from WebGL bypasses ANGLE's prior workaround and yields native code execution

#551573368•Reporter: in...@starlabs.sg
$5,000
9/27/2026

iOS Chrome address-bar spoof: blob-URL DeprecatedGetOriginAsURL empty-collision defeats IsHistoryStateChangeValid and CanTrustLastCommittedItem

#543471693•Reporter: nh...@gmail.com
$5,000
9/27/2026

[V8 Sandbox Bypass] Missing write barrier for JS_DISPATCH_HANDLE can leave stale optimized code and control the instruction pointer

#549892124•Reporter: yu...@gmail.com
$1,000
9/26/2026

OOB write in qualcomm gpu #2

#530045332•Reporter: ha...@gmail.com
$2,500
9/22/2026

V8 Sandbox Bypass: JSArrayBuffer during shared Wasm serialization

#546253900•Reporter: le...@depthfirst.com
$2,500
9/20/2026

Reused Maglev deoptimization `HeapNumber` enables cage-wide read/write

#547819997•Reporter: mo...@xbow.com
$1,000
9/19/2026

dangling pointer in external pointer table after iframe destruction

#542670566•Reporter: ke...@gmail.com
$1,000
9/18/2026

OOB in CreateTextureMemory

#497202432•Reporter: ha...@gmail.com
$32,000
9/18/2026

Site Isolation bypass: the ungated extensions RendererAutomationRegistry handler lets a compromised web renderer read cross-origin/cross-profile accessibility trees (page text, frame URLs).

#540265100•Reporter: og...@gmail.com
$5,000
9/18/2026

V8 Sandbox Bypass: WasmGetOwnProperty's no-write/no-throw effects allow a forged accessor to create mixed call_indirect dispatch and a native tiering-budget OOB write

#543557673•Reporter: sm...@gmail.com
$2,500
9/11/2026
Showing 1-10 of 2107 bugs
1234...211