Disclosed Chromium Security Bugs

ANGLE Metal Shadow Buffer Stale Size causes GPU OOB WRITE

#492249619•Reporter: ci...@gmail.com
$18,000
7/10/2026

Maglev: unsound node replacement when inlining can lead to exploitable write barrier omission

#493534950•Reporter: pj...@gmail.com
$55,000
7/10/2026

UAF in Metal LibraryCache

#497724490•Reporter: he...@gmail.com
$16,000
7/10/2026

Integer overflow in TFLite StridedSlice output dimension computation leads to heap buffer overflow in the GPU process

#495864183•Reporter: je...@gmail.com
$43,000
7/9/2026

OOB and UAF in pdfium lcms

#498284498•Reporter: he...@gmail.com
$7,000
7/9/2026

V8 Sandbox Bypass: Fast API overload metadata corruption causes compiler-emitted mixed native call type confusion

#492077213•Reporter: gu...@gmail.com
$5,000
7/9/2026

heap-use-after-free in XNNPACK widen_fp16_accumulators

#495864169•Reporter: ki...@gmail.com
$43,000
7/9/2026

V8: Signed Integer Overflow in Maglev ValueNode use_count_

#496807872•Reporter: ca...@gmail.com
$5,000
7/9/2026

FrameState: polymorphic Wasm accessor lazy deopt type confusion lead to in-sandbox corruption

#497404188•Reporter: pj...@gmail.com
$10,000
7/8/2026

Integer overflow in ANGLE D3D11 TextureStorage11::setData() leads to heap buffer overflow via WebGL2

#491760376•Reporter: yu...@gmail.com
$5,000
7/8/2026
Showing 1-10 of 1095 bugs
1234...110