Disclosed Chromium Security Bugs

V8 Sandbox Bypass: Compiler-Eliminated CPT Tag Check

#500771385•Reporter: qw...@gmail.com
$20,000
8/4/2026

Missing lifetime check in SpdyStream::IncreaseRecvWindowSize leads to use-after-free in Network Service

#503420443•Reporter: je...@gmail.com
$43,000
8/4/2026

D3D10Warp!JITCopyContext::ExecuteResourceCopy memory heap overflow based on Integer overflow in gpu

#480548427•Reporter: do...@gmail.com
$17,000
8/4/2026

Validating Decoder Stale PACK_ALIGNMENT causes GPU Heap OOB Write

#505077859•Reporter: ci...@gmail.com
$43,000
8/1/2026

Turbolev: incorrent opcode effect modeling can lead to arbitrary code execution

#503975738•Reporter: pj...@gmail.com
$55,000
8/1/2026

Turboshaft: stale `PhiOp` replacement for Wasm arrays causes `array.len` bounds bypass and out-of-bounds array read/write

#505481948•Reporter: pj...@gmail.com
$55,000
7/31/2026

UAF in WebViewImpl::Minimize

#492899974•Reporter: he...@gmail.com
$11,000
7/31/2026

V8 sandbox bypass: reuse unpublished WasmDispatchTable lead to reproduce of 483220222

#503422307•Reporter: pv...@gmail.com
$20,000
7/30/2026

[Linux] Cross-Thread Use-After-Free in FontLoader::openStream via Non-Owning MappedFontFile Cache

#492374380•Reporter: je...@gmail.com
$11,000
7/30/2026

Renderer-to-GPU sandbox escape via Skia SPIR-V injection

#502636904•Reporter: qq...@calif.io
$25,000
7/30/2026
Showing 1-10 of 556 bugs
1234...56