Disclosed Chromium Security Bugs

PowerVR sparse page-map heap OOB reachable from WebGL bypasses ANGLE's prior workaround and yields native code execution

#551573368•Reporter: in...@starlabs.sg
$5,000
9/27/2026

iOS Chrome address-bar spoof: blob-URL DeprecatedGetOriginAsURL empty-collision defeats IsHistoryStateChangeValid and CanTrustLastCommittedItem

#543471693•Reporter: nh...@gmail.com
$5,000
9/27/2026

OOB in CreateTextureMemory

#497202432•Reporter: ha...@gmail.com
$32,000
9/18/2026

Site Isolation bypass: the ungated extensions RendererAutomationRegistry handler lets a compromised web renderer read cross-origin/cross-profile accessibility trees (page text, frame URLs).

#540265100•Reporter: og...@gmail.com
$5,000
9/18/2026

Use After Free in GrowMipLevelArray lead android sandbox escape

#499602793•Reporter: ha...@gmail.com
$32,000
9/10/2026

Cross-thread use-after-free in browser process via chrome.processes.terminate()

#499206649•Reporter: je...@gmail.com
$5,000
9/10/2026

Site Isolation bypass leading to Arbitrary File Write through RenderFrameHost, Extension Installation, and Downloads Page.

#527023137•Reporter: av...@gmail.com
$5,000
9/10/2026

Reentrant Resume During BFCache Restore Causes Browser-Process Use-After-Free in CommitDeferringConditionRunner

#502293787•Reporter: je...@gmail.com
$36,000
9/10/2026

Unvalidated chrome_host param allows attacker-controlled webview inside chrome://contextual-tasks

#537390933•Reporter: xp...@gmail.com
$5,000
9/10/2026

New UAF trigger for https://issues.chromium.org/issues/493747593 (Fullchain RCE)

#520656244•Reporter: ha...@gmail.com
$5,000
9/10/2026
Showing 1-10 of 1175 bugs
1234...118