Disclosed Chromium Security Bugs

Turbolev: incorrent opcode effect modeling can lead to arbitrary code execution

#503975738•Reporter: pj...@gmail.com
$55,000
8/1/2026

Turboshaft: stale `PhiOp` replacement for Wasm arrays causes `array.len` bounds bypass and out-of-bounds array read/write

#505481948•Reporter: pj...@gmail.com
$55,000
7/31/2026

Arbitrary Memory Read and Write in ANGLE GL Backend via PBO Desync

#498904293•Reporter: ki...@gmail.com
$97,000
7/29/2026

Type confusion in BuildCheckSmi constant folding in V8/Maglev

#500880819•Reporter: qq...@calif.io
$55,000
7/22/2026

OOB write in PDFium TIFF decoder via lossless JPEG data precision mismatch

#496907110•Reporter: se...@gmail.com
$50,000
7/15/2026

Maglev: unsound node replacement when inlining can lead to exploitable write barrier omission

#493534950•Reporter: pj...@gmail.com
$55,000
7/10/2026

ANGLE BlitGL copySubTextureCPUReadback Controlled Heap Overflow via Unsynchronized PACK_ROW_LENGTH

#490170083•Reporter: ci...@gmail.com
$90,000
7/7/2026

ANGLE Metal Stale mFormat Cache causes GPU OOB WRITE

#493256564•Reporter: ci...@gmail.com
$77,000
7/1/2026

Use-After-Free in Dawn Wire Server Uncaptured-Error Callback via Incomplete Device Unregistration Cleanup

#491518608•Reporter: se...@gmail.com
$70,000
6/27/2026

Heap buffer overflow in BufferMtl shadow copy sync during bufferData leads to GPU process memory corruption in macOS

#489494022•Reporter: je...@gmail.com
$77,000
6/24/2026
Showing 1-10 of 55 bugs
1234...6