Because of the migration of Chromium bug tracker from Monorail to Buganizer, this account won't submit new bugs temporarily (until it's migrated to fetch the data from the new source). Sorry!

Security: arbitrary address access in vrend_renderer_blit_gl (reward: $2000)

Use-after-poison in cppgc::internal::HeapVisitor<cppgc::internal::UnmarkedObjectsPoisoner>::Traverse

Use-after-poison in cppgc::internal::MarkingStateBase::MarkAndPush

Security: Contextual search selection offsets should be sanitized

chrome.inspectedWindow.eval execution on Web Store with trailing URL dot (reward: $5000)

Security: Chrome OS: Multiple controllable OOB write bugs in Qcom camx drivers may cause sandbox escape to kernel

Security: Race Condition UAF in virtio_transport_space_update (reward: $2000)

Use-after-poison in blink::HTMLPlugInElement::DetachLayoutTree

Security: OOB access in

heap-buffer-overflow in ~SingleShotFrameHandler(imagecapture/image_capture_frame_grabber.cc) (reward: $8000)

lightweight-heap-use-after-free : web_app::WebAppCommandManager::StartCommand

Security: UAF in gpu::ClientSharedImageInterface::DestroySharedImage(browser process) (reward: $2000)

Security: Heap buffer overflow write due to bound check missing

Security: Out-of-Bound Write due to bound check missing (reward: $5000)

Security: Integer-Overflow in ChapsAdaptor::GenerateRandom

Heap-buffer-overflow in v8::internal::Simulator::WriteW

Security: readanything render frame UAF fix of https://t.co/HiUARXjmCH is not robust. (reward: $2000)

Security: Heap-use-after-free in ReadAnythingUntrustedPageHandler::LogTextStyle (reward: $2000)

security: libmbim | out-of-bounds access on mbim-message.c (reward: $250)