[ { "id": "519007689", "title": "PDFium NameTree lookup-only path still truncates /Limits", "url": "https://issues.chromium.org/issues/519007689", "status": "Assigned", "severity": "S3-Low", "component": "PDFium", "reporter": "sd...@gmail.com", "cve_ids": [], "bounty_amount": 500.0, "reward_amount_meta": 500.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-06-02T08:38:13+00:00", "year": 2026, "attachment_count": 0, "local_path": "issues/519007689", "has_markdown": true }, { "id": "517168239", "title": "use-after-poison in ViewTransitionSupplement::OnTransitionCaptured", "url": "https://issues.chromium.org/issues/517168239", "status": "Assigned", "severity": "S3-Low", "component": "Blink>ViewTransitions", "reporter": "tr...@gmail.com", "cve_ids": [], "bounty_amount": 500.0, "reward_amount_meta": 500.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-05-27T17:37:05+00:00", "year": 2026, "attachment_count": 2, "local_path": "issues/517168239", "has_markdown": true }, { "id": "515155946", "title": "Heap-use-after-free read in `blink::Document::ProcessBaseElement` via re-entrant SpeculationRules error dispatch from `UpdateBaseURL`", "url": "https://issues.chromium.org/issues/515155946", "status": "Assigned", "severity": "Unknown", "component": "Blink>Loader>Preload", "reporter": "qw...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": null, "public_issue": true, "inclusion_reason": "award_text", "award_text_found": true, "created_date": "2026-05-20T23:33:11+00:00", "year": 2026, "attachment_count": 3, "local_path": "issues/515155946", "has_markdown": true }, { "id": "514120653", "title": "V8 Sandbox Bypass: controlled OOB write to `Isolate` via RegExp source corruption during tier-up.", "url": "https://issues.chromium.org/issues/514120653", "status": "Verified", "severity": "S3-Low", "component": "Blink>JavaScript>Regexp", "reporter": "ma...@advert.com.au", "cve_ids": [], "bounty_amount": 20000.0, "reward_amount_meta": 20000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-05-18T01:09:10+00:00", "year": 2026, "attachment_count": 1, "local_path": "issues/514120653", "has_markdown": true }, { "id": "513893425", "title": "Windows PWA handler launcher filename can smuggle --utility-cmd-prefix from manifest name, causing Chrome to execute attacker-chosen wrapper on utility process launch.", "url": "https://issues.chromium.org/issues/513893425", "status": "New", "severity": "S3-Low", "component": "UI>Browser>WebAppInstalls", "reporter": "ro...@gmail.com", "cve_ids": [], "bounty_amount": 2500.0, "reward_amount_meta": 2500.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-05-16T22:37:08+00:00", "year": 2026, "attachment_count": 27, "local_path": "issues/513893425", "has_markdown": true }, { "id": "513631768", "title": "WebGPU T2B Compute-Blit No-Submit Stale Buffer Disclosure", "url": "https://issues.chromium.org/issues/513631768", "status": "Accepted", "severity": "S3-Low", "component": "Dawn", "reporter": "sh...@dongspace.info", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-05-16T15:58:02+00:00", "year": 2026, "attachment_count": 5, "local_path": "issues/513631768", "has_markdown": true }, { "id": "513756452", "title": "V8 Sandbox Escape via gin::PerContextData EmbedderDataTypeTag collision with Blink ScriptState", "url": "https://issues.chromium.org/issues/513756452", "status": "Accepted", "severity": "S3-Low", "component": "Blink>Bindings", "reporter": "sm...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-05-16T06:46:38+00:00", "year": 2026, "attachment_count": 4, "local_path": "issues/513756452", "has_markdown": true }, { "id": "513753575", "title": "V8 TryFastAddDataProperty descriptor-array OOB access", "url": "https://issues.chromium.org/issues/513753575", "status": "Assigned", "severity": "S4-Minimal", "component": "Blink>JavaScript>Runtime", "reporter": "hu...@gmail.com", "cve_ids": [], "bounty_amount": 55000.0, "reward_amount_meta": 55000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-05-16T06:28:12+00:00", "year": 2026, "attachment_count": 3, "local_path": "issues/513753575", "has_markdown": true }, { "id": "513745518", "title": "Leaking size of cross-origin resources via rangeless opaque responses using Service Workers and the Fetch API", "url": "https://issues.chromium.org/issues/513745518", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Network>FetchAPI", "reporter": "he...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-05-16T05:44:07+00:00", "year": 2026, "attachment_count": 4, "local_path": "issues/513745518", "has_markdown": true }, { "id": "513289241", "title": "V8 type confusion in FulfillPromise via double settlement of chrome.runtime.getPackageDirectoryEntry() Promise", "url": "https://issues.chromium.org/issues/513289241", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript>Runtime", "reporter": "ga...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-05-14T20:49:36+00:00", "year": 2026, "attachment_count": 5, "local_path": "issues/513289241", "has_markdown": true }, { "id": "513205882", "title": "Type confusion in BuildCheckSmi constant folding in V8/Maglev", "url": "https://issues.chromium.org/issues/513205882", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript>Compiler>Maglev", "reporter": "qq...@calif.io", "cve_ids": [], "bounty_amount": 55000.0, "reward_amount_meta": 55000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-05-14T14:58:10+00:00", "year": 2026, "attachment_count": 7, "local_path": "issues/513205882", "has_markdown": true }, { "id": "513069625", "title": "GPU passthrough decoder UAF: DoBufferData GL error path skips mapped_buffer_map.erase()", "url": "https://issues.chromium.org/issues/513069625", "status": "Assigned", "severity": "S3-Low", "component": "Internals>GPU>Internals", "reporter": "pa...@gmail.com", "cve_ids": [], "bounty_amount": 25000.0, "reward_amount_meta": 25000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-05-14T05:37:59+00:00", "year": 2026, "attachment_count": 2, "local_path": "issues/513069625", "has_markdown": true }, { "id": "513060309", "title": "Improper handling of side-effects of CopyFastSmiOrObjectElements in LateLoadElimination leads to a fake object / arbitrary write primitive", "url": "https://issues.chromium.org/issues/513060309", "status": "Assigned", "severity": "S4-Minimal", "component": "Blink>JavaScript>Compiler>Maglev", "reporter": "bj...@neodyme.io", "cve_ids": [], "bounty_amount": 11000.0, "reward_amount_meta": 11000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-05-14T04:54:46+00:00", "year": 2026, "attachment_count": 1, "local_path": "issues/513060309", "has_markdown": true }, { "id": "512592772", "title": "V8 TryFastAddDataProperty descriptor-array OOB access", "url": "https://issues.chromium.org/issues/512592772", "status": "Assigned", "severity": "S4-Minimal", "component": "Blink>JavaScript>Runtime", "reporter": "hu...@gmail.com", "cve_ids": [], "bounty_amount": 55000.0, "reward_amount_meta": 55000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-05-12T23:41:42+00:00", "year": 2026, "attachment_count": 12, "local_path": "issues/512592772", "has_markdown": true }, { "id": "510968707", "title": "RenderFrameHostImpl::RunJavaScriptDialog() missing browser-side allow-modals sandbox flag check", "url": "https://issues.chromium.org/issues/510968707", "status": "Fixed", "severity": "S3-Low", "component": "Blink>HTML>Dialog, Blink>SecurityFeature>IFrameSandbox, Internals>Sandbox>SiteIsolation", "reporter": "os...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-05-08T03:49:31+00:00", "year": 2026, "attachment_count": 3, "local_path": "issues/510968707", "has_markdown": true }, { "id": "510107264", "title": "Update Poc: Container-Overflow in `SurfaceAllocationGroup::OnFirstSurfaceActivation` due to reentrant mutation of `active_embedders_` in GPU process", "url": "https://issues.chromium.org/issues/510107264", "status": "Assigned", "severity": "S3-Low", "component": "Internals>Compositing", "reporter": "se...@gmail.com", "cve_ids": [ "CVE-2026-7333" ], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-05-06T02:46:24+00:00", "year": 2026, "attachment_count": 6, "local_path": "issues/510107264", "has_markdown": true }, { "id": "509789237", "title": "[Security] Hole leakage into packed elements due to elided TDZ check in dynamic scope", "url": "https://issues.chromium.org/issues/509789237", "status": "Assigned", "severity": "Unknown", "component": "Blink>JavaScript>Runtime", "reporter": "gu...@gmail.com", "cve_ids": [], "bounty_amount": 500.0, "reward_amount_meta": 500.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-05-05T12:00:36+00:00", "year": 2026, "attachment_count": 3, "local_path": "issues/509789237", "has_markdown": true }, { "id": "508811477", "title": "V8 Turboshaft late load elimination reuses stale map load after aliased map transition", "url": "https://issues.chromium.org/issues/508811477", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript>Compiler>Turboshaft", "reporter": "mu...@winfunc.com", "cve_ids": [], "bounty_amount": 500.0, "reward_amount_meta": 500.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-05-02T22:06:32+00:00", "year": 2026, "attachment_count": 12, "local_path": "issues/508811477", "has_markdown": true }, { "id": "508811474", "title": "Race Condition Between Maglev IdentityMap and Mark-Compact GC ThinString Shortcutting Leads to OOB Write in Trusted Space", "url": "https://issues.chromium.org/issues/508811474", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript>Compiler>Maglev", "reporter": "hu...@gmail.com", "cve_ids": [], "bounty_amount": 500.0, "reward_amount_meta": 500.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-05-02T15:45:51+00:00", "year": 2026, "attachment_count": 0, "local_path": "issues/508811474", "has_markdown": true }, { "id": "508789134", "title": "V8 Sandbox Bypass: OOB Write using %TypedArray%.prototype.set due to element type/size TOCTOU", "url": "https://issues.chromium.org/issues/508789134", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript>Sandbox", "reporter": "kr...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-05-02T04:40:15+00:00", "year": 2026, "attachment_count": 2, "local_path": "issues/508789134", "has_markdown": true }, { "id": "508092644", "title": "Security Bug: UAF in Dawn wire from RequestDevice id reuse", "url": "https://issues.chromium.org/issues/508092644", "status": "Assigned", "severity": "S3-Low", "component": "Dawn>Wire", "reporter": "62...@qq.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-04-30T18:17:27+00:00", "year": 2026, "attachment_count": 0, "local_path": "issues/508092644", "has_markdown": true }, { "id": "508092634", "title": "Forged audio_forwarder in SpeechRecognition IPC bypasses per-origin microphone permission on Android", "url": "https://issues.chromium.org/issues/508092634", "status": "Accepted", "severity": "S3-Low", "component": "Blink>Speech", "reporter": "je...@gmail.com", "cve_ids": [], "bounty_amount": 8000.0, "reward_amount_meta": 8000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-04-30T13:49:49+00:00", "year": 2026, "attachment_count": 3, "local_path": "issues/508092634", "has_markdown": true }, { "id": "508092629", "title": "V8 Sandbox Escape: Stale MicrotaskQueue cache leads to OOS write", "url": "https://issues.chromium.org/issues/508092629", "status": "Accepted", "severity": "S3-Low", "component": "Blink>JavaScript>Runtime", "reporter": "sm...@gmail.com", "cve_ids": [], "bounty_amount": 20000.0, "reward_amount_meta": 20000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-04-30T10:57:09+00:00", "year": 2026, "attachment_count": 13, "local_path": "issues/508092629", "has_markdown": true }, { "id": "507920777", "title": "SpdyStream Use-After-Free in QueueNextDataFrame via PrefacePing drain", "url": "https://issues.chromium.org/issues/507920777", "status": "New", "severity": "S3-Low", "component": "Internals>Network>HTTP2", "reporter": "ci...@gmail.com", "cve_ids": [], "bounty_amount": 43000.0, "reward_amount_meta": 43000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-04-29T20:31:31+00:00", "year": 2026, "attachment_count": 3, "local_path": "issues/507920777", "has_markdown": true }, { "id": "507743677", "title": "UXSS in Chrome for Android", "url": "https://issues.chromium.org/issues/507743677", "status": "Accepted", "severity": "S3-Low", "component": "UI>Browser>Mobile", "reporter": "ad...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-04-29T15:14:28+00:00", "year": 2026, "attachment_count": 1, "local_path": "issues/507743677", "has_markdown": true }, { "id": "507707838", "title": "Potential UAF write in GPU process via glBufferData OOM on Android", "url": "https://issues.chromium.org/issues/507707838", "status": "Assigned", "severity": "S3-Low", "component": "Internals>GPU>Internals", "reporter": "vm...@google.com", "cve_ids": [], "bounty_amount": 25000.0, "reward_amount_meta": null, "public_issue": true, "inclusion_reason": "award_text", "award_text_found": true, "created_date": "2026-04-29T08:23:41+00:00", "year": 2026, "attachment_count": 3, "local_path": "issues/507707838", "has_markdown": true }, { "id": "507508103", "title": "memory corruption in qualcomm gpu lead sandbox escape", "url": "https://issues.chromium.org/issues/507508103", "status": "New", "severity": "S4-Minimal", "component": "Blink>WebGL", "reporter": "ha...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-04-29T00:09:04+00:00", "year": 2026, "attachment_count": 3, "local_path": "issues/507508103", "has_markdown": true }, { "id": "507356235", "title": "Security: heap-use-after-free in extensions::ExtensionInstallTimePermissionProvider::GetRuleIterator", "url": "https://issues.chromium.org/issues/507356235", "status": "Accepted", "severity": "S3-Low", "component": "Platform>Extensions", "reporter": "zh...@gmail.com", "cve_ids": [ "CVE-2026-8587" ], "bounty_amount": 6000.0, "reward_amount_meta": 6000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-04-28T16:14:43+00:00", "year": 2026, "attachment_count": 7, "local_path": "issues/507356235", "has_markdown": true }, { "id": "507365348", "title": "SpdyStream Use-After-Free in QueueNextDataFrame via PrefacePing drain", "url": "https://issues.chromium.org/issues/507365348", "status": "New", "severity": "S3-Low", "component": "Internals>Network>HTTP2", "reporter": "ci...@gmail.com", "cve_ids": [], "bounty_amount": 43000.0, "reward_amount_meta": 43000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-04-28T12:19:43+00:00", "year": 2026, "attachment_count": 6, "local_path": "issues/507365348", "has_markdown": true }, { "id": "507332299", "title": "Use-after-free in DevToolsRendererChannel::ForceDetachWorkerSessions via duplicate ChildTargetCreated for dedicated workers", "url": "https://issues.chromium.org/issues/507332299", "status": "Assigned", "severity": "S3-Low", "component": "Platform>DevTools", "reporter": "je...@gmail.com", "cve_ids": [ "CVE-2026-6919" ], "bounty_amount": 26000.0, "reward_amount_meta": 26000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-04-28T10:01:15+00:00", "year": 2026, "attachment_count": 2, "local_path": "issues/507332299", "has_markdown": true }, { "id": "507138723", "title": "UAF in RenderFrameHostImpl::ExitFullscreen() — missing WeakPtr guard (variant of EnterFullscreen fix 91d5baaef742)", "url": "https://issues.chromium.org/issues/507138723", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>FullScreen", "reporter": "mi...@minico.ai", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-04-27T21:53:15+00:00", "year": 2026, "attachment_count": 7, "local_path": "issues/507138723", "has_markdown": true }, { "id": "507090179", "title": "Heap-buffer-overflow read in libavformat `mov_seek_stream` / `can_seek_to_key_sample` via a crafted HEVC MP4 and an HTMLMediaElement seek", "url": "https://issues.chromium.org/issues/507090179", "status": "Assigned", "severity": "S3-Low", "component": "Internals>Media>FFmpeg", "reporter": "qw...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-04-27T19:04:05+00:00", "year": 2026, "attachment_count": 4, "local_path": "issues/507090179", "has_markdown": true }, { "id": "506921089", "title": "UAF in RenderFrameHostImpl::ExitFullscreen() — missing WeakPtr guard (variant of EnterFullscreen fix 91d5baaef742)", "url": "https://issues.chromium.org/issues/506921089", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>FullScreen", "reporter": "mi...@minico.ai", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-04-27T12:46:53+00:00", "year": 2026, "attachment_count": 3, "local_path": "issues/506921089", "has_markdown": true }, { "id": "506684534", "title": "UAF in RenderFrameHostImpl::ExitFullscreen() — missing WeakPtr guard (variant of EnterFullscreen fix 91d5baaef742)", "url": "https://issues.chromium.org/issues/506684534", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>FullScreen", "reporter": "mi...@minico.ai", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-04-27T10:50:58+00:00", "year": 2026, "attachment_count": 4, "local_path": "issues/506684534", "has_markdown": true }, { "id": "506855825", "title": "Incorrect implementation of the track-array-buffer-views feature leads to a crash", "url": "https://issues.chromium.org/issues/506855825", "status": "Assigned", "severity": "S4-Minimal", "component": "Blink>JavaScript>Runtime", "reporter": "hu...@gmail.com", "cve_ids": [], "bounty_amount": 8000.0, "reward_amount_meta": 8000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-04-27T09:06:15+00:00", "year": 2026, "attachment_count": 0, "local_path": "issues/506855825", "has_markdown": true }, { "id": "506689381", "title": "V8 TryFastAddDataProperty descriptor-array OOB access", "url": "https://issues.chromium.org/issues/506689381", "status": "Assigned", "severity": "S4-Minimal", "component": "Blink>JavaScript>Runtime", "reporter": "hu...@gmail.com", "cve_ids": [], "bounty_amount": 55000.0, "reward_amount_meta": 55000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-04-27T03:26:05+00:00", "year": 2026, "attachment_count": 0, "local_path": "issues/506689381", "has_markdown": true }, { "id": "506653647", "title": "WebGL Memory Corruption via Passthrough Decoder Bound Buffers Cache Desync", "url": "https://issues.chromium.org/issues/506653647", "status": "Assigned", "severity": "S3-Low", "component": "Internals>GPU", "reporter": "h2...@gmail.com", "cve_ids": [], "bounty_amount": 35000.0, "reward_amount_meta": 35000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-04-26T17:23:03+00:00", "year": 2026, "attachment_count": 5, "local_path": "issues/506653647", "has_markdown": true }, { "id": "506570358", "title": "V8 Sandbox Escape: CppHeapPointerTable evacuation entry causes out-of-sandbox CppGC mark-bit write", "url": "https://issues.chromium.org/issues/506570358", "status": "Accepted", "severity": "S3-Low", "component": "Blink>JavaScript>Sandbox", "reporter": "sm...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-04-26T08:03:48+00:00", "year": 2026, "attachment_count": 7, "local_path": "issues/506570358", "has_markdown": true }, { "id": "506347575", "title": "Use-After-Free via re-entrant attribute mutation during synchronous speculation-rules error dispatch", "url": "https://issues.chromium.org/issues/506347575", "status": "Assigned", "severity": "S4-Minimal", "component": "Blink>DOM", "reporter": "pw...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-04-25T07:26:50+00:00", "year": 2026, "attachment_count": 4, "local_path": "issues/506347575", "has_markdown": true }, { "id": "506212452", "title": "Integer truncation in ANGLE D3D11 VertexDataManager leads to heap OOB read from compromised renderer on Windows", "url": "https://issues.chromium.org/issues/506212452", "status": "Accepted", "severity": "S3-Low", "component": "Internals>GPU>ANGLE", "reporter": "je...@gmail.com", "cve_ids": [ "CVE-2026-5281" ], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-04-24T20:43:14+00:00", "year": 2026, "attachment_count": 4, "local_path": "issues/506212452", "has_markdown": true }, { "id": "506010945", "title": "AddressSanitizer heap-buffer-overflow in skcms CLUT from a PNG iCCP chunk on the default Rust ICC path", "url": "https://issues.chromium.org/issues/506010945", "status": "Accepted", "severity": "S3-Low", "component": "Internals>Skia", "reporter": "oj...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-04-24T08:22:01+00:00", "year": 2026, "attachment_count": 22, "local_path": "issues/506010945", "has_markdown": true }, { "id": "505823721", "title": "V8: Turboshaft miscompilation: Operand drop in TryReduceRorInTree allows potential sandbox bypass", "url": "https://issues.chromium.org/issues/505823721", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript>Compiler>Turboshaft", "reporter": "or...@gmail.com", "cve_ids": [], "bounty_amount": 8000.0, "reward_amount_meta": 8000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-04-23T19:51:02+00:00", "year": 2026, "attachment_count": 3, "local_path": "issues/505823721", "has_markdown": true }, { "id": "505676335", "title": "Integer truncation in ANGLE D3D11 VertexDataManager leads to heap OOB read from compromised renderer on Windows", "url": "https://issues.chromium.org/issues/505676335", "status": "Accepted", "severity": "S3-Low", "component": "Internals>GPU>ANGLE", "reporter": "je...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-04-23T11:16:49+00:00", "year": 2026, "attachment_count": 3, "local_path": "issues/505676335", "has_markdown": true }, { "id": "505427216", "title": "Service Worker Static Routing API cache source bypasses CORP in crossOriginIsolated context (fix wiring ineffective)", "url": "https://issues.chromium.org/issues/505427216", "status": "Accepted", "severity": "S3-Low", "component": "Blink>ServiceWorker", "reporter": "da...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-04-23T09:28:58+00:00", "year": 2026, "attachment_count": 2, "local_path": "issues/505427216", "has_markdown": true }, { "id": "505481948", "title": "Turboshaft: stale `PhiOp` replacement for Wasm arrays causes `array.len` bounds bypass and out-of-bounds array read/write", "url": "https://issues.chromium.org/issues/505481948", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript>Compiler>Turboshaft", "reporter": "pj...@gmail.com", "cve_ids": [], "bounty_amount": 55000.0, "reward_amount_meta": 55000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-04-23T00:16:17+00:00", "year": 2026, "attachment_count": 1, "local_path": "issues/505481948", "has_markdown": true }, { "id": "505371980", "title": "heap-buffer-overflow in TabDragController::AttachToNewContext", "url": "https://issues.chromium.org/issues/505371980", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>TopChrome>TabStrip", "reporter": "xp...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-04-22T20:22:52+00:00", "year": 2026, "attachment_count": 8, "local_path": "issues/505371980", "has_markdown": true }, { "id": "505063249", "title": "OOB read in TFLite TransposeConvV2", "url": "https://issues.chromium.org/issues/505063249", "status": "Assigned", "severity": "S4-Minimal", "component": "Blink>WebML", "reporter": "he...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-04-22T05:14:55+00:00", "year": 2026, "attachment_count": 2, "local_path": "issues/505063249", "has_markdown": true }, { "id": "505068950", "title": "Security: Heap-use-after-free regression in ServiceWorkerContextCore::OnRunningStateChanged\n", "url": "https://issues.chromium.org/issues/505068950", "status": "Accepted", "severity": "S3-Low", "component": "Blink>ServiceWorker", "reporter": "me...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-04-22T01:49:51+00:00", "year": 2026, "attachment_count": 3, "local_path": "issues/505068950", "has_markdown": true }, { "id": "505077859", "title": "Validating Decoder Stale PACK_ALIGNMENT causes GPU Heap OOB Write", "url": "https://issues.chromium.org/issues/505077859", "status": "New", "severity": "S3-Low", "component": "Internals>GPU", "reporter": "ci...@gmail.com", "cve_ids": [], "bounty_amount": 43000.0, "reward_amount_meta": 43000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-04-21T20:19:46+00:00", "year": 2026, "attachment_count": 5, "local_path": "issues/505077859", "has_markdown": true }, { "id": "505056913", "title": "WebGL indexed-draw validation truncation on ANGLE Metal allows out-of-bounds vertex fetches", "url": "https://issues.chromium.org/issues/505056913", "status": "Assigned", "severity": "S3-Low", "component": "Internals>GPU>ANGLE", "reporter": "mu...@winfunc.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-04-21T19:45:53+00:00", "year": 2026, "attachment_count": 4, "local_path": "issues/505056913", "has_markdown": true }, { "id": "505045913", "title": "UAF in RenderFrameHostImpl::ExitFullscreen() — missing WeakPtr guard (variant of EnterFullscreen fix 91d5baaef742)", "url": "https://issues.chromium.org/issues/505045913", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>FullScreen", "reporter": "mi...@minico.ai", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-04-21T18:29:46+00:00", "year": 2026, "attachment_count": 2, "local_path": "issues/505045913", "has_markdown": true }, { "id": "504820809", "title": "WebGL can disclose stale stencil contents because ANGLE robust framebuffer initialization honors attacker-controlled stencilMask(0)", "url": "https://issues.chromium.org/issues/504820809", "status": "Assigned", "severity": "S3-Low", "component": "Internals>GPU>ANGLE", "reporter": "mu...@winfunc.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-04-21T10:24:51+00:00", "year": 2026, "attachment_count": 2, "local_path": "issues/504820809", "has_markdown": true }, { "id": "504663582", "title": "V8 SBX Trap Fuzzing: Container Overflow in src/bigint/bigint.h:163:37", "url": "https://issues.chromium.org/issues/504663582", "status": "Accepted", "severity": "S3-Low", "component": "Blink>JavaScript>Runtime", "reporter": "al...@goodmanemail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-04-20T23:52:44+00:00", "year": 2026, "attachment_count": 3, "local_path": "issues/504663582", "has_markdown": true }, { "id": "504471167", "title": "Out-of-bounds write in ipcz while deserializing message", "url": "https://issues.chromium.org/issues/504471167", "status": "Assigned", "severity": "S3-Low", "component": "Internals>Mojo>Core", "reporter": "bl...@gmail.com", "cve_ids": [ "CVE-2025-4609" ], "bounty_amount": 35000.0, "reward_amount_meta": 35000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-04-20T06:03:21+00:00", "year": 2026, "attachment_count": 2, "local_path": "issues/504471167", "has_markdown": true }, { "id": "504175501", "title": "Integer wrap in ANGLE IndexRange allows WebGL OOB vertex fetch", "url": "https://issues.chromium.org/issues/504175501", "status": "Assigned", "severity": "S3-Low", "component": "Internals>GPU>ANGLE", "reporter": "ra...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-04-19T21:53:51+00:00", "year": 2026, "attachment_count": 2, "local_path": "issues/504175501", "has_markdown": true }, { "id": "504302441", "title": "On Ubuntu (or other Linux-based systems) an attacker can steal files uploaded to other sites with little user interaction.", "url": "https://issues.chromium.org/issues/504302441", "status": "Accepted", "severity": "S3-Low", "component": "UI>Linux Toolkit Theming", "reporter": "va...@hotmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-04-19T15:06:07+00:00", "year": 2026, "attachment_count": 0, "local_path": "issues/504302441", "has_markdown": true }, { "id": "504156069", "title": "Missing return after ShutdownForBadMessage in SimpleDevToolsProtocolClient leads to past-end OOB read in the browser process", "url": "https://issues.chromium.org/issues/504156069", "status": "Assigned", "severity": "S3-Low", "component": "Platform>Browser Automation>Headless", "reporter": "je...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-04-19T14:11:24+00:00", "year": 2026, "attachment_count": 3, "local_path": "issues/504156069", "has_markdown": true }, { "id": "504073879", "title": "V8 race UAF/SEGV in `TracedHandles` with ProgrammaticScrollPromise", "url": "https://issues.chromium.org/issues/504073879", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Scroll", "reporter": "at...@gmail.com", "cve_ids": [], "bounty_amount": 10000.0, "reward_amount_meta": 10000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-04-19T06:21:01+00:00", "year": 2026, "attachment_count": 8, "local_path": "issues/504073879", "has_markdown": true }, { "id": "503987504", "title": "Double-free in BrowserLiveBackgroundController::VideoConsumer::OnFrameCaptured()", "url": "https://issues.chromium.org/issues/503987504", "status": "Verified", "severity": "S3-Low", "component": "UI>Browser", "reporter": "al...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-04-19T05:30:58+00:00", "year": 2026, "attachment_count": 3, "local_path": "issues/503987504", "has_markdown": true }, { "id": "504160794", "title": "AddressSanitizer heap-buffer-overflow in skcms CLUT from a PNG iCCP chunk on the default Rust ICC path", "url": "https://issues.chromium.org/issues/504160794", "status": "Accepted", "severity": "S3-Low", "component": "Internals>Skia", "reporter": "oj...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-04-19T00:53:04+00:00", "year": 2026, "attachment_count": 4, "local_path": "issues/504160794", "has_markdown": true }, { "id": "503975738", "title": "Turbolev: incorrent opcode effect modeling can lead to arbitrary code execution", "url": "https://issues.chromium.org/issues/503975738", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript>Compiler>Turboshaft", "reporter": "pj...@gmail.com", "cve_ids": [], "bounty_amount": 55000.0, "reward_amount_meta": 55000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-04-19T00:47:43+00:00", "year": 2026, "attachment_count": 4, "local_path": "issues/503975738", "has_markdown": true }, { "id": "504073872", "title": "\tSharedWorker same-origin check bypass for chrome-extension:// — DedicatedWorker hardening (8bde565) not applied to sibling SharedWorker path", "url": "https://issues.chromium.org/issues/504073872", "status": "Accepted", "severity": "S3-Low", "component": "Blink>Workers", "reporter": "tr...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-04-19T00:33:25+00:00", "year": 2026, "attachment_count": 9, "local_path": "issues/504073872", "has_markdown": true }, { "id": "504103236", "title": "AddressSanitizer heap-buffer-overflow in skcms CLUT from a PNG iCCP chunk on the default Rust ICC path", "url": "https://issues.chromium.org/issues/504103236", "status": "Accepted", "severity": "S3-Low", "component": "Internals>Skia", "reporter": "oj...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-04-18T19:16:26+00:00", "year": 2026, "attachment_count": 3, "local_path": "issues/504103236", "has_markdown": true }, { "id": "503768143", "title": "ANGLE: missing setPixelPackBuffer(nullptr) in norm16 readback workaround causes GPU process crash via WebGL PBO type confusion", "url": "https://issues.chromium.org/issues/503768143", "status": "New", "severity": "Unknown", "component": "Internals>GPU>ANGLE", "reporter": "ma...@gmail.com", "cve_ids": [ "CVE-2026-10883", "CVE-2026-6296" ], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-04-17T18:09:10+00:00", "year": 2026, "attachment_count": 5, "local_path": "issues/503768143", "has_markdown": true }, { "id": "503763493", "title": "Browser Process Heap-Use-After-Free in Digital Credentials API (Renderer → Browser Memory Corruption)", "url": "https://issues.chromium.org/issues/503763493", "status": "New", "severity": "S3-Low", "component": "Blink>Identity>DigitalCredentials", "reporter": "wo...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-04-17T17:52:56+00:00", "year": 2026, "attachment_count": 2, "local_path": "issues/503763493", "has_markdown": true }, { "id": "503731573", "title": "Browser Process Heap-Use-After-Free in Digital Credentials API (Renderer → Browser Memory Corruption)", "url": "https://issues.chromium.org/issues/503731573", "status": "New", "severity": "S3-Low", "component": "Blink>Identity>DigitalCredentials", "reporter": "wo...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-04-17T16:12:42+00:00", "year": 2026, "attachment_count": 3, "local_path": "issues/503731573", "has_markdown": true }, { "id": "503553614", "title": "Heap-use-after-free in v8_inspector::InjectedScript::wrapObjectMirror due to context destruction in JS callback", "url": "https://issues.chromium.org/issues/503553614", "status": "Assigned", "severity": "S3-Low", "component": "Platform>DevTools", "reporter": "al...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-04-17T13:12:55+00:00", "year": 2026, "attachment_count": 8, "local_path": "issues/503553614", "has_markdown": true }, { "id": "503553602", "title": "V8 Sandbox Bypass:LOCAL+frame OOB write in `SetLocalVariableValue`", "url": "https://issues.chromium.org/issues/503553602", "status": "Accepted", "severity": "S3-Low", "component": "Platform>DevTools", "reporter": "gr...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-04-17T08:22:46+00:00", "year": 2026, "attachment_count": 5, "local_path": "issues/503553602", "has_markdown": true }, { "id": "503422316", "title": "Use-After-Free in AllocateSctpSids via DCEP OPEN Message Failure Leads to Renderer Crash", "url": "https://issues.chromium.org/issues/503422316", "status": "Assigned", "severity": "S3-Low", "component": "Blink>WebRTC", "reporter": "je...@gmail.com", "cve_ids": [], "bounty_amount": 11000.0, "reward_amount_meta": 11000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-04-17T08:11:33+00:00", "year": 2026, "attachment_count": 3, "local_path": "issues/503422316", "has_markdown": true }, { "id": "503558392", "title": "Integer truncation in ANGLE D3D11 VertexDataManager leads to heap OOB read from compromised renderer on Windows", "url": "https://issues.chromium.org/issues/503558392", "status": "Accepted", "severity": "S3-Low", "component": "Internals>GPU>ANGLE", "reporter": "je...@gmail.com", "cve_ids": [ "CVE-2026-6296" ], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-04-17T05:15:36+00:00", "year": 2026, "attachment_count": 2, "local_path": "issues/503558392", "has_markdown": true }, { "id": "503420443", "title": "Missing lifetime check in SpdyStream::IncreaseRecvWindowSize leads to use-after-free in Network Service", "url": "https://issues.chromium.org/issues/503420443", "status": "New", "severity": "S3-Low", "component": "Internals>Network>HTTP2", "reporter": "je...@gmail.com", "cve_ids": [ "CVE-2019-9512", "CVE-2019-9514", "CVE-2019-9515" ], "bounty_amount": 43000.0, "reward_amount_meta": 43000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-04-17T04:37:21+00:00", "year": 2026, "attachment_count": 12, "local_path": "issues/503420443", "has_markdown": true }, { "id": "503422307", "title": "V8 sandbox bypass: reuse `protected_uses` of `WasmDispatchTable` after grow", "url": "https://issues.chromium.org/issues/503422307", "status": "Accepted", "severity": "S3-Low", "component": "Blink>JavaScript>Sandbox, Blink>JavaScript>WebAssembly", "reporter": "pv...@gmail.com", "cve_ids": [], "bounty_amount": 20000.0, "reward_amount_meta": 20000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-04-17T02:55:23+00:00", "year": 2026, "attachment_count": 2, "local_path": "issues/503422307", "has_markdown": true }, { "id": "503420438", "title": "Security: Heap-use-after-free in PasskeyResetWebContentsObserver::MaybeRunCallback\n", "url": "https://issues.chromium.org/issues/503420438", "status": "Verified", "severity": "Unknown", "component": "Unknown", "reporter": "me...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": null, "public_issue": true, "inclusion_reason": "award_text", "award_text_found": true, "created_date": "2026-04-17T02:41:07+00:00", "year": 2026, "attachment_count": 3, "local_path": "issues/503420438", "has_markdown": true }, { "id": "503425922", "title": "apply_stch uint32 accumulation OOB write (Chromium renderer SEGV)", "url": "https://issues.chromium.org/issues/503425922", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Fonts", "reporter": "ma...@gmail.com", "cve_ids": [], "bounty_amount": 10000.0, "reward_amount_meta": 10000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-04-16T20:53:12+00:00", "year": 2026, "attachment_count": 3, "local_path": "issues/503425922", "has_markdown": true }, { "id": "503393471", "title": "Elevation of Privilege in GoogleUpdate with Windows", "url": "https://issues.chromium.org/issues/503393471", "status": "Assigned", "severity": "S3-Low", "component": "Internals>Updater", "reporter": "do...@pksecurity.io", "cve_ids": [ "CVE-2024-1694" ], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-04-16T18:54:33+00:00", "year": 2026, "attachment_count": 20, "local_path": "issues/503393471", "has_markdown": true }, { "id": "503346647", "title": " I identified that the Chrome browser’s Reading List feature introduces an origin confusion issue by reordering domain names. This behavior can mislead users about the true origin of a website.", "url": "https://issues.chromium.org/issues/503346647", "status": "Fixed", "severity": "S3-Low", "component": "UI>Browser>TopChrome>BookmarksBar>ReadingList", "reporter": "ah...@gmail.com", "cve_ids": [], "bounty_amount": 500.0, "reward_amount_meta": 500.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-04-16T16:35:18+00:00", "year": 2026, "attachment_count": 3, "local_path": "issues/503346647", "has_markdown": true }, { "id": "503197487", "title": "ipcz bug can allow renderer duplicate browser process handle to escape sandbox", "url": "https://issues.chromium.org/issues/503197487", "status": "Assigned", "severity": "S3-Low", "component": "Internals>Mojo>Core", "reporter": "ha...@gmail.com", "cve_ids": [], "bounty_amount": 250000.0, "reward_amount_meta": 250000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-04-16T16:03:55+00:00", "year": 2026, "attachment_count": 4, "local_path": "issues/503197487", "has_markdown": true }, { "id": "502636904", "title": "Renderer-to-GPU sandbox escape via Skia SPIR-V injection", "url": "https://issues.chromium.org/issues/502636904", "status": "New", "severity": "S3-Low", "component": "Internals>Skia", "reporter": "qq...@calif.io", "cve_ids": [], "bounty_amount": 25000.0, "reward_amount_meta": 25000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-04-14T20:12:42+00:00", "year": 2026, "attachment_count": 3, "local_path": "issues/502636904", "has_markdown": true }, { "id": "502617990", "title": "Integer overflow in ANGLE D3D11 compressed 3D texture deferred-init leads to heap OOB read in GPU process", "url": "https://issues.chromium.org/issues/502617990", "status": "Assigned", "severity": "S3-Low", "component": "Internals>GPU>ANGLE", "reporter": "se...@gmail.com", "cve_ids": [ "CVE-2026-5859" ], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-04-14T18:32:45+00:00", "year": 2026, "attachment_count": 4, "local_path": "issues/502617990", "has_markdown": true }, { "id": "502449873", "title": "Integer truncation in `protectedAudience.decodeUtf8()` causes out-of-bounds read via `strlen` in auction worklet utility process", "url": "https://issues.chromium.org/issues/502449873", "status": "Verified", "severity": "S3-Low", "component": "Blink>InterestGroups", "reporter": "je...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-04-14T16:52:33+00:00", "year": 2026, "attachment_count": 7, "local_path": "issues/502449873", "has_markdown": true }, { "id": "502461760", "title": "Heap-use-after-free in `remoting::PamAuthorizer::GetNextMessage` / `OnMessageProcessed`", "url": "https://issues.chromium.org/issues/502461760", "status": "Fixed", "severity": "S4-Minimal", "component": "Services (Use Subcomponents)>Chromoting", "reporter": "da...@gmail.com", "cve_ids": [], "bounty_amount": 500.0, "reward_amount_meta": 500.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-04-14T12:48:19+00:00", "year": 2026, "attachment_count": 2, "local_path": "issues/502461760", "has_markdown": true }, { "id": "502449857", "title": "Security: Heap-use-after-free in CastActivityManager::FindActivityForSessionJoin", "url": "https://issues.chromium.org/issues/502449857", "status": "Assigned", "severity": "S3-Low", "component": "Internals>Cast", "reporter": "me...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-04-14T10:44:24+00:00", "year": 2026, "attachment_count": 5, "local_path": "issues/502449857", "has_markdown": true }, { "id": "502328201", "title": "Contact dialog can be shown over a cross-origin page which might confuse a user into leaking sensitive information to an attacker", "url": "https://issues.chromium.org/issues/502328201", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Contacts", "reporter": "he...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-04-14T06:06:42+00:00", "year": 2026, "attachment_count": 3, "local_path": "issues/502328201", "has_markdown": true }, { "id": "502317122", "title": "V8 Sandbox Bypass: BigInt CachedMod Native Heap OOB via Corrupted BigInt Length", "url": "https://issues.chromium.org/issues/502317122", "status": "Accepted", "severity": "S4-Minimal", "component": "Blink>JavaScript", "reporter": "pi...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-04-13T23:30:31+00:00", "year": 2026, "attachment_count": 3, "local_path": "issues/502317122", "has_markdown": true }, { "id": "502030575", "title": "V8: Incorrect Address Computation in Int64LoweringReducer via IncreaseOffset element_scale Mishandling", "url": "https://issues.chromium.org/issues/502030575", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript>Compiler>Turboshaft, Blink>JavaScript>WebAssembly", "reporter": "ca...@gmail.com", "cve_ids": [], "bounty_amount": 8000.0, "reward_amount_meta": 8000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-04-13T10:58:26+00:00", "year": 2026, "attachment_count": 1, "local_path": "issues/502030575", "has_markdown": true }, { "id": "502107756", "title": "Buffer overflow in vp9_get_token_cost via crafted VideoEncoder frame sequence", "url": "https://issues.chromium.org/issues/502107756", "status": "Assigned", "severity": "S4-Minimal", "component": "Internals>Media>Video", "reporter": "sh...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-04-13T10:09:59+00:00", "year": 2026, "attachment_count": 4, "local_path": "issues/502107756", "has_markdown": true }, { "id": "501792454", "title": "Heap-Use-After-Free via stale set iterator dereference in HostResolverDnsTask::OnTransactionSorted", "url": "https://issues.chromium.org/issues/501792454", "status": "Assigned", "severity": "S3-Low", "component": "Internals>Network>DoH", "reporter": "pw...@gmail.com", "cve_ids": [], "bounty_amount": 4000.0, "reward_amount_meta": 4000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-04-12T15:15:07+00:00", "year": 2026, "attachment_count": 3, "local_path": "issues/501792454", "has_markdown": true }, { "id": "501844365", "title": "V8 Sandbox Bypass: AAW/PC control via CallKnownJSFunction reduction for builtins", "url": "https://issues.chromium.org/issues/501844365", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript>Sandbox", "reporter": "kr...@gmail.com", "cve_ids": [], "bounty_amount": 22000.0, "reward_amount_meta": 22000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-04-12T08:29:55+00:00", "year": 2026, "attachment_count": 4, "local_path": "issues/501844365", "has_markdown": true }, { "id": "501646327", "title": "CanvasRenderingContext2D::drawFocusIfNeeded dangling `Path` use-after-free", "url": "https://issues.chromium.org/issues/501646327", "status": "Accepted", "severity": "S4-Minimal", "component": "Blink>Canvas", "reporter": "qw...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-04-11T10:23:30+00:00", "year": 2026, "attachment_count": 6, "local_path": "issues/501646327", "has_markdown": true }, { "id": "501476576", "title": "ANGLE: Heap-Buffer-Overflow in ANGLE Vulkan Backend via TEXTURE_2D_ARRAY Layer Count Mismatch", "url": "https://issues.chromium.org/issues/501476576", "status": "Assigned", "severity": "S3-Low", "component": "Internals>GPU>ANGLE", "reporter": "ca...@gmail.com", "cve_ids": [], "bounty_amount": 17000.0, "reward_amount_meta": 17000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-04-11T07:13:35+00:00", "year": 2026, "attachment_count": 1, "local_path": "issues/501476576", "has_markdown": true }, { "id": "501147587", "title": "V8 Sandbox Bypass: JSPI suspender EPT not cleared in exception-unwind path", "url": "https://issues.chromium.org/issues/501147587", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript>WebAssembly", "reporter": "qq...@calif.io", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-04-10T05:13:05+00:00", "year": 2026, "attachment_count": 2, "local_path": "issues/501147587", "has_markdown": true }, { "id": "501254242", "title": "HLS key redirect bypasses origin restriction", "url": "https://issues.chromium.org/issues/501254242", "status": "Fixed", "severity": "S3-Low", "component": "Internals>Media", "reporter": "oj...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-04-10T03:36:18+00:00", "year": 2026, "attachment_count": 3, "local_path": "issues/501254242", "has_markdown": true }, { "id": "501136000", "title": "V8 Sandbox Bypass: double-free in HandleScope::Extend via concurrent JS stack printing from MainMarkingVisitor and ConcurrentMarkingVisitor", "url": "https://issues.chromium.org/issues/501136000", "status": "Accepted", "severity": "S3-Low", "component": "Blink>JavaScript>GarbageCollection", "reporter": "gu...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-04-10T01:11:19+00:00", "year": 2026, "attachment_count": 5, "local_path": "issues/501136000", "has_markdown": true }, { "id": "501115599", "title": "Browser-Process Heap Use-After-Free in FileSystemAccessWatcherManager", "url": "https://issues.chromium.org/issues/501115599", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Storage>FileSystem", "reporter": "as...@gmail.com", "cve_ids": [], "bounty_amount": 10000.0, "reward_amount_meta": 10000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-04-10T00:15:52+00:00", "year": 2026, "attachment_count": 3, "local_path": "issues/501115599", "has_markdown": true }, { "id": "501096128", "title": "Dawn: heap-use-after-free in wire client ObjectStore via multithreaded WebGPU", "url": "https://issues.chromium.org/issues/501096128", "status": "Accepted", "severity": "S3-Low", "component": "Dawn", "reporter": "no...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-04-09T17:14:05+00:00", "year": 2026, "attachment_count": 8, "local_path": "issues/501096128", "has_markdown": true }, { "id": "500774812", "title": "heap-buffer-overflow in Dawn BufferGL::MapAtCreationImpl", "url": "https://issues.chromium.org/issues/500774812", "status": "New", "severity": "S3-Low", "component": "Dawn", "reporter": "ki...@gmail.com", "cve_ids": [], "bounty_amount": 33000.0, "reward_amount_meta": 33000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-04-09T09:08:36+00:00", "year": 2026, "attachment_count": 3, "local_path": "issues/500774812", "has_markdown": true }, { "id": "500880819", "title": "Type confusion in BuildCheckSmi constant folding in V8/Maglev", "url": "https://issues.chromium.org/issues/500880819", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript>Compiler>Maglev", "reporter": "qq...@calif.io", "cve_ids": [], "bounty_amount": 55000.0, "reward_amount_meta": 55000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-04-09T05:44:56+00:00", "year": 2026, "attachment_count": 1, "local_path": "issues/500880819", "has_markdown": true }, { "id": "500771385", "title": "V8 Sandbox Bypass: Compiler-Eliminated CPT Tag Check", "url": "https://issues.chromium.org/issues/500771385", "status": "Accepted", "severity": "S3-Low", "component": "Blink>JavaScript", "reporter": "qw...@gmail.com", "cve_ids": [], "bounty_amount": 20000.0, "reward_amount_meta": 20000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-04-08T19:24:05+00:00", "year": 2026, "attachment_count": 8, "local_path": "issues/500771385", "has_markdown": true }, { "id": "500609038", "title": "heap-use-after-free in dawn::native::vulkan::BindGroupLayout::GetOrCreateSpecializedHandle", "url": "https://issues.chromium.org/issues/500609038", "status": "New", "severity": "S3-Low", "component": "Dawn", "reporter": "ki...@gmail.com", "cve_ids": [], "bounty_amount": 11000.0, "reward_amount_meta": 11000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-04-08T14:11:51+00:00", "year": 2026, "attachment_count": 3, "local_path": "issues/500609038", "has_markdown": true }, { "id": "500413224", "title": "V8 Sandbox Escape: CopyElementsHandleSlow→SetImpl missing SBXCHECK — OOB Write 192GB past guard via getter re-entrancy (race-free, deterministic)", "url": "https://issues.chromium.org/issues/500413224", "status": "Accepted", "severity": "S3-Low", "component": "Blink>JavaScript", "reporter": "bb...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-04-07T19:27:14+00:00", "year": 2026, "attachment_count": 7, "local_path": "issues/500413224", "has_markdown": true }, { "id": "500066234", "title": "VP9 alpha plane use-after-free via show_existing_frame reuse of FrameBufferPool storage", "url": "https://issues.chromium.org/issues/500066234", "status": "Assigned", "severity": "S3-Low", "component": "Internals>Media>Codecs", "reporter": "je...@gmail.com", "cve_ids": [], "bounty_amount": 8000.0, "reward_amount_meta": 8000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-04-07T03:34:32+00:00", "year": 2026, "attachment_count": 3, "local_path": "issues/500066234", "has_markdown": true }, { "id": "499917177", "title": "Missing origin check in FileSystemAccessObserverHost::Observe() allows cross-origin file observation", "url": "https://issues.chromium.org/issues/499917177", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Storage>FileSystem", "reporter": "er...@paloaltonetworks.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-04-06T15:01:59+00:00", "year": 2026, "attachment_count": 1, "local_path": "issues/499917177", "has_markdown": true }, { "id": "499960178", "title": "V8 Sandbox Bypass: Gin FunctionTemplateInfo EPT Type Confusion via Shared ExternalPointerTag", "url": "https://issues.chromium.org/issues/499960178", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript", "reporter": "qw...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-04-06T12:23:46+00:00", "year": 2026, "attachment_count": 4, "local_path": "issues/499960178", "has_markdown": true }, { "id": "499752800", "title": "Debug check failed: i < this ->context_local_count() (0 vs. 0). in v8", "url": "https://issues.chromium.org/issues/499752800", "status": "Assigned", "severity": "S4-Minimal", "component": "Blink>JavaScript>Compiler>Maglev", "reporter": "sw...@gmail.com", "cve_ids": [], "bounty_amount": 8000.0, "reward_amount_meta": 8000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-04-06T08:46:30+00:00", "year": 2026, "attachment_count": 1, "local_path": "issues/499752800", "has_markdown": true }, { "id": "499659070", "title": "V8: JIT Miscompilation via Incorrect Type Narrowing in TurboFan SpeculativeAdditiveSafeIntegerAdd", "url": "https://issues.chromium.org/issues/499659070", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript>Compiler>Turbofan", "reporter": "ca...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-04-06T07:48:44+00:00", "year": 2026, "attachment_count": 1, "local_path": "issues/499659070", "has_markdown": true }, { "id": "499572780", "title": "Chromium crashes during xdg-desktop-portal screencast on Wayland KDE (Slack screen share)", "url": "https://issues.chromium.org/issues/499572780", "status": "Accepted", "severity": "S3-Low", "component": "Internals>Media>ScreenCapture", "reporter": "bo...@gmail.com", "cve_ids": [], "bounty_amount": 4000.0, "reward_amount_meta": 4000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-04-05T22:58:57+00:00", "year": 2026, "attachment_count": 4, "local_path": "issues/499572780", "has_markdown": true }, { "id": "499717570", "title": "V8 Sandbox Bypass:TypedArray.prototype.set ElementsKind TOCTOU", "url": "https://issues.chromium.org/issues/499717570", "status": "Accepted", "severity": "S3-Low", "component": "Blink>JavaScript", "reporter": "gr...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-04-05T17:55:28+00:00", "year": 2026, "attachment_count": 7, "local_path": "issues/499717570", "has_markdown": true }, { "id": "499587071", "title": "Chromium crashes during xdg-desktop-portal screencast on Wayland KDE (Slack screen share)", "url": "https://issues.chromium.org/issues/499587071", "status": "Accepted", "severity": "S3-Low", "component": "Internals>Media>ScreenCapture", "reporter": "bo...@gmail.com", "cve_ids": [], "bounty_amount": 4000.0, "reward_amount_meta": 4000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-04-05T17:26:55+00:00", "year": 2026, "attachment_count": 10, "local_path": "issues/499587071", "has_markdown": true }, { "id": "499606101", "title": "OOB Write in V8 TryMatchLoadStoreShift on Mac arm64 (OOB read on non-Mac arm64)", "url": "https://issues.chromium.org/issues/499606101", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript>Compiler>Turboshaft", "reporter": "he...@gmail.com", "cve_ids": [], "bounty_amount": 11000.0, "reward_amount_meta": 11000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-04-05T05:41:46+00:00", "year": 2026, "attachment_count": 2, "local_path": "issues/499606101", "has_markdown": true }, { "id": "499492027", "title": "Maglev's handling of target and new.target is incorrect", "url": "https://issues.chromium.org/issues/499492027", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript>Runtime", "reporter": "hu...@gmail.com", "cve_ids": [], "bounty_amount": 50000.0, "reward_amount_meta": 50000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-04-04T11:22:45+00:00", "year": 2026, "attachment_count": 2, "local_path": "issues/499492027", "has_markdown": true }, { "id": "499006005", "title": "Cross-origin information disclosure via stale ANGLE Metal texture views (GPU process heap leak)", "url": "https://issues.chromium.org/issues/499006005", "status": "Assigned", "severity": "S3-Low", "component": "Internals>GPU, Internals>GPU>ANGLE", "reporter": "th...@gmail.com", "cve_ids": [], "bounty_amount": 10000.0, "reward_amount_meta": 10000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-04-03T08:34:19+00:00", "year": 2026, "attachment_count": 11, "local_path": "issues/499006005", "has_markdown": true }, { "id": "498904293", "title": "Arbitrary Memory Read and Write in ANGLE GL Backend via PBO Desync", "url": "https://issues.chromium.org/issues/498904293", "status": "New", "severity": "S3-Low", "component": "Internals>GPU>ANGLE", "reporter": "ki...@gmail.com", "cve_ids": [], "bounty_amount": 97000.0, "reward_amount_meta": 97000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-04-02T13:45:43+00:00", "year": 2026, "attachment_count": 7, "local_path": "issues/498904293", "has_markdown": true }, { "id": "498828605", "title": "Heap buffer over-read in Mesa RadeonSI noop-blend analysis for scalar fragment outputs leads to GPU process memory disclosure", "url": "https://issues.chromium.org/issues/498828605", "status": "Assigned", "severity": "S3-Low", "component": "Blink>WebGL, Internals>GPU>ANGLE", "reporter": "je...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-04-02T12:10:33+00:00", "year": 2026, "attachment_count": 3, "local_path": "issues/498828605", "has_markdown": true }, { "id": "498659375", "title": "Support SPIR-V 1.4", "url": "https://issues.chromium.org/issues/498659375", "status": "Accepted", "severity": "S3-Low", "component": "Dawn>Tint", "reporter": "al...@google.com", "cve_ids": [], "bounty_amount": 32000.0, "reward_amount_meta": null, "public_issue": true, "inclusion_reason": "award_text", "award_text_found": true, "created_date": "2026-04-01T22:27:17+00:00", "year": 2026, "attachment_count": 4, "local_path": "issues/498659375", "has_markdown": true }, { "id": "498494630", "title": "XNNPACK Workspace Size Overflow — Heap Buffer Overflow from WebNN", "url": "https://issues.chromium.org/issues/498494630", "status": "Verified", "severity": "S3-Low", "component": "Blink>WebML", "reporter": "to...@gmail.com", "cve_ids": [], "bounty_amount": 42000.0, "reward_amount_meta": 42000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-04-01T09:06:56+00:00", "year": 2026, "attachment_count": 6, "local_path": "issues/498494630", "has_markdown": true }, { "id": "498284498", "title": "OOB and UAF in pdfium lcms", "url": "https://issues.chromium.org/issues/498284498", "status": "Accepted", "severity": "S4-Minimal", "component": "Internals>Plugins>PDF", "reporter": "he...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-03-31T19:16:27+00:00", "year": 2026, "attachment_count": 5, "local_path": "issues/498284498", "has_markdown": true }, { "id": "498095290", "title": "V8 sandbox bypass: WasmDispatchTable swapping lead to use of not fully initialized WasmTrustedInstanceData", "url": "https://issues.chromium.org/issues/498095290", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript>WebAssembly", "reporter": "pv...@gmail.com", "cve_ids": [], "bounty_amount": 20000.0, "reward_amount_meta": 20000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-03-31T15:29:55+00:00", "year": 2026, "attachment_count": 1, "local_path": "issues/498095290", "has_markdown": true }, { "id": "498063923", "title": "TFLite castInt4ToFloat heap-buffer-overflow (OOB Write) via WebNN dequantizeLinear", "url": "https://issues.chromium.org/issues/498063923", "status": "Assigned", "severity": "S3-Low", "component": "Blink>WebML", "reporter": "to...@gmail.com", "cve_ids": [], "bounty_amount": 33000.0, "reward_amount_meta": 33000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-03-31T07:13:52+00:00", "year": 2026, "attachment_count": 5, "local_path": "issues/498063923", "has_markdown": true }, { "id": "497880137", "title": "REFILE: Browser-Process UAF in FileSystemAccessChangeSource::DidInitialize (Reliability-Improved PoC)", "url": "https://issues.chromium.org/issues/497880137", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Storage>FileSystem", "reporter": "as...@gmail.com", "cve_ids": [], "bounty_amount": 10000.0, "reward_amount_meta": 10000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-03-31T00:31:01+00:00", "year": 2026, "attachment_count": 5, "local_path": "issues/497880137", "has_markdown": true }, { "id": "497928952", "title": "Heap-buffer-overflow in VertexArrayGL::streamAttributes via shiftInstancedArrayDataWithOffset", "url": "https://issues.chromium.org/issues/497928952", "status": "Assigned", "severity": "S3-Low", "component": "Internals>GPU>ANGLE", "reporter": "ca...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-03-30T22:52:03+00:00", "year": 2026, "attachment_count": 2, "local_path": "issues/497928952", "has_markdown": true }, { "id": "497896137", "title": "Integer overflow in ANGLE D3D11 compressed 3D texture deferred-init leads to heap OOB read in GPU process", "url": "https://issues.chromium.org/issues/497896137", "status": "Assigned", "severity": "S3-Low", "component": "Internals>GPU>ANGLE", "reporter": "se...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-03-30T19:56:18+00:00", "year": 2026, "attachment_count": 2, "local_path": "issues/497896137", "has_markdown": true }, { "id": "497724490", "title": "UAF in Metal LibraryCache", "url": "https://issues.chromium.org/issues/497724490", "status": "Assigned", "severity": "S3-Low", "component": "Internals>GPU>ANGLE", "reporter": "he...@gmail.com", "cve_ids": [], "bounty_amount": 16000.0, "reward_amount_meta": 16000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-03-30T15:42:53+00:00", "year": 2026, "attachment_count": 3, "local_path": "issues/497724490", "has_markdown": true }, { "id": "497588858", "title": "Heap-Use-After-Free via stale set iterator dereference in HostResolverDnsTask::OnTransactionSorted", "url": "https://issues.chromium.org/issues/497588858", "status": "Assigned", "severity": "S3-Low", "component": "Internals>Network>DoH", "reporter": "pw...@gmail.com", "cve_ids": [], "bounty_amount": 4000.0, "reward_amount_meta": 4000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-03-30T09:16:50+00:00", "year": 2026, "attachment_count": 3, "local_path": "issues/497588858", "has_markdown": true }, { "id": "497456778", "title": "WebML Double-Free Via XNNPACK LUT-Fusion", "url": "https://issues.chromium.org/issues/497456778", "status": "Verified", "severity": "S3-Low", "component": "Blink>WebML", "reporter": "h2...@gmail.com", "cve_ids": [], "bounty_amount": 43000.0, "reward_amount_meta": 43000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-03-29T21:47:27+00:00", "year": 2026, "attachment_count": 3, "local_path": "issues/497456778", "has_markdown": true }, { "id": "497404188", "title": "Incorrect Optimization of ArrayConstructor by Maglev Leads to Creation of Malformed JSArray Objects", "url": "https://issues.chromium.org/issues/497404188", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript>Compiler>Maglev", "reporter": "hu...@gmail.com", "cve_ids": [], "bounty_amount": 50000.0, "reward_amount_meta": 50000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-03-29T19:45:17+00:00", "year": 2026, "attachment_count": 2, "local_path": "issues/497404188", "has_markdown": true }, { "id": "497442789", "title": "V8 Sandbox Bypass: Attacker manipulation of ArrayBufferSweeper linked lists results in dangling ArrayBufferExtension pointers", "url": "https://issues.chromium.org/issues/497442789", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Bindings, Blink>JavaScript>GarbageCollection, Infra>Client>V8", "reporter": "ma...@popax21.dev", "cve_ids": [], "bounty_amount": 20000.0, "reward_amount_meta": 20000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-03-29T13:19:25+00:00", "year": 2026, "attachment_count": 2, "local_path": "issues/497442789", "has_markdown": true }, { "id": "497202425", "title": "Integer overflow in ruy SumsBytes leads to heap OOB write in the GPU process via WebNN quantized Gemm", "url": "https://issues.chromium.org/issues/497202425", "status": "Assigned", "severity": "S3-Low", "component": "Blink>WebML", "reporter": "je...@gmail.com", "cve_ids": [], "bounty_amount": 11000.0, "reward_amount_meta": 11000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-03-29T03:26:32+00:00", "year": 2026, "attachment_count": 2, "local_path": "issues/497202425", "has_markdown": true }, { "id": "497159159", "title": "Integer overflow in ruy pack kernel offset leads to heap OOB write in the GPU process via WebNN quantized Gemm", "url": "https://issues.chromium.org/issues/497159159", "status": "Assigned", "severity": "S3-Low", "component": "Blink>WebML", "reporter": "je...@gmail.com", "cve_ids": [], "bounty_amount": 11000.0, "reward_amount_meta": 11000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-03-29T03:25:08+00:00", "year": 2026, "attachment_count": 2, "local_path": "issues/497159159", "has_markdown": true }, { "id": "496907110", "title": "OOB write in PDFium TIFF decoder via lossless JPEG data precision mismatch", "url": "https://issues.chromium.org/issues/496907110", "status": "Assigned", "severity": "S3-Low", "component": "PDFium", "reporter": "se...@gmail.com", "cve_ids": [], "bounty_amount": 50000.0, "reward_amount_meta": 50000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-03-27T19:16:00+00:00", "year": 2026, "attachment_count": 9, "local_path": "issues/496907110", "has_markdown": true }, { "id": "496807872", "title": "V8: Signed Integer Overflow in Maglev ValueNode use_count_", "url": "https://issues.chromium.org/issues/496807872", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript>Compiler>Maglev", "reporter": "ca...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-03-27T12:44:23+00:00", "year": 2026, "attachment_count": 2, "local_path": "issues/496807872", "has_markdown": true }, { "id": "496629079", "title": "V8 Sandbox Bypass: BigInt DivideBarrett Double Fetch causing Native Heap oob read/write", "url": "https://issues.chromium.org/issues/496629079", "status": "Accepted", "severity": "S4-Minimal", "component": "Blink>JavaScript", "reporter": "pi...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-03-27T09:19:29+00:00", "year": 2026, "attachment_count": 1, "local_path": "issues/496629079", "has_markdown": true }, { "id": "496807861", "title": "V8 Sandbox Bypass: BigInt DivideSchoolbook Native Heap OOB Write via Signed Scratch-Length Overflow", "url": "https://issues.chromium.org/issues/496807861", "status": "Accepted", "severity": "S4-Minimal", "component": "Blink>JavaScript", "reporter": "pi...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-03-27T09:17:03+00:00", "year": 2026, "attachment_count": 1, "local_path": "issues/496807861", "has_markdown": true }, { "id": "496618662", "title": "V8 Sandbox Bypass: BigInt CachedMod Native Heap OOB via Corrupted BigInt Length", "url": "https://issues.chromium.org/issues/496618662", "status": "Accepted", "severity": "S4-Minimal", "component": "Blink>JavaScript", "reporter": "pi...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-03-27T09:13:17+00:00", "year": 2026, "attachment_count": 2, "local_path": "issues/496618662", "has_markdown": true }, { "id": "496618639", "title": "Heap-buffer-overflow in PDFium via integer overflow in bundled lcms2 ICC CLUT allocation", "url": "https://issues.chromium.org/issues/496618639", "status": "Assigned", "severity": "S3-Low", "component": "PDFium", "reporter": "se...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-03-26T19:39:11+00:00", "year": 2026, "attachment_count": 3, "local_path": "issues/496618639", "has_markdown": true }, { "id": "496456528", "title": "Security: T0 Heap-Use-After-Free in views::Widget during Browser Teardown", "url": "https://issues.chromium.org/issues/496456528", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>UserEducation", "reporter": "ba...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-03-26T16:35:33+00:00", "year": 2026, "attachment_count": 5, "local_path": "issues/496456528", "has_markdown": true }, { "id": "496503799", "title": "heap-buffer-overflow in ANGLE VertexArrayVk::convertVertexBufferCPU", "url": "https://issues.chromium.org/issues/496503799", "status": "Assigned", "severity": "S3-Low", "component": "Internals>GPU>ANGLE", "reporter": "ki...@gmail.com", "cve_ids": [], "bounty_amount": 16000.0, "reward_amount_meta": 16000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-03-26T16:31:46+00:00", "year": 2026, "attachment_count": 4, "local_path": "issues/496503799", "has_markdown": true }, { "id": "496524586", "title": "setHTML() fails open on invalid SanitizerConfig, inserting unsanitized HTML with active scripts into the live DOM", "url": "https://issues.chromium.org/issues/496524586", "status": "Accepted", "severity": "S3-Low", "component": "Blink>SecurityFeature>SanitizerAPI", "reporter": "qw...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-03-26T13:45:51+00:00", "year": 2026, "attachment_count": 2, "local_path": "issues/496524586", "has_markdown": true }, { "id": "496266444", "title": "Non trivial number of AutoCloseableRouter finalizer exceptions", "url": "https://issues.chromium.org/issues/496266444", "status": "Assigned", "severity": "Unknown", "component": "Internals>Mojo>Bindings", "reporter": "ds...@chromium.org", "cve_ids": [], "bounty_amount": null, "reward_amount_meta": null, "public_issue": true, "inclusion_reason": "award_text", "award_text_found": true, "created_date": "2026-03-26T02:10:46+00:00", "year": 2026, "attachment_count": 5, "local_path": "issues/496266444", "has_markdown": true }, { "id": "495996858", "title": "UAF in WebRTC LibaomAv1Encoder sync issues triggered by frequent resolution changes", "url": "https://issues.chromium.org/issues/495996858", "status": "Accepted", "severity": "S3-Low", "component": "Internals>Media>Codecs", "reporter": "he...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-03-25T14:21:45+00:00", "year": 2026, "attachment_count": 3, "local_path": "issues/495996858", "has_markdown": true }, { "id": "495864183", "title": "Integer overflow in TFLite StridedSlice output dimension computation leads to heap buffer overflow in the GPU process", "url": "https://issues.chromium.org/issues/495864183", "status": "Accepted", "severity": "S4-Minimal", "component": "Blink>WebML", "reporter": "je...@gmail.com", "cve_ids": [], "bounty_amount": 43000.0, "reward_amount_meta": 43000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-03-25T04:27:02+00:00", "year": 2026, "attachment_count": 2, "local_path": "issues/495864183", "has_markdown": true }, { "id": "495973592", "title": "Heap-use-after-free in VerticalTabDragHandlerImpl::ContinueDrag", "url": "https://issues.chromium.org/issues/495973592", "status": "Verified", "severity": "S3-Low", "component": "UI>Browser>TopChrome>TabStrip", "reporter": "ch...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-03-25T03:23:02+00:00", "year": 2026, "attachment_count": 3, "local_path": "issues/495973592", "has_markdown": true }, { "id": "495864169", "title": "heap-use-after-free in XNNPACK widen_fp16_accumulators", "url": "https://issues.chromium.org/issues/495864169", "status": "Assigned", "severity": "S4-Minimal", "component": "Blink>WebML", "reporter": "ki...@gmail.com", "cve_ids": [], "bounty_amount": 43000.0, "reward_amount_meta": 43000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-03-24T21:27:34+00:00", "year": 2026, "attachment_count": 5, "local_path": "issues/495864169", "has_markdown": true }, { "id": "495700484", "title": "Security issue update: Heap-Buffer-Overflow in ResourceKey::Builder::finish via Canvas2D Dash Pattern Size Packing Truncation", "url": "https://issues.chromium.org/issues/495700484", "status": "New", "severity": "S3-Low", "component": "Internals>Skia", "reporter": "se...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-03-24T19:05:30+00:00", "year": 2026, "attachment_count": 2, "local_path": "issues/495700484", "has_markdown": true }, { "id": "495477995", "title": "UAF in SVC reconfiguration of AV1 encoder", "url": "https://issues.chromium.org/issues/495477995", "status": "Assigned", "severity": "S3-Low", "component": "Internals>Media>Video", "reporter": "he...@gmail.com", "cve_ids": [], "bounty_amount": 8000.0, "reward_amount_meta": 8000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-03-24T04:48:17+00:00", "year": 2026, "attachment_count": 2, "local_path": "issues/495477995", "has_markdown": true }, { "id": "495373657", "title": "GPU process arbitrary address read via unvalidated client pointer in passthrough `CompressedTexImage3D` / `CompressedTexSubImage3D` handlers", "url": "https://issues.chromium.org/issues/495373657", "status": "Accepted", "severity": "S3-Low", "component": "Internals>GPU>ANGLE", "reporter": "se...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-03-23T17:45:20+00:00", "year": 2026, "attachment_count": 4, "local_path": "issues/495373657", "has_markdown": true }, { "id": "495269751", "title": "Heap-use-after-free in TabHoverCardController::UpdateHoverCard", "url": "https://issues.chromium.org/issues/495269751", "status": "Accepted", "severity": "S4-Minimal", "component": "UI>Browser>TopChrome>TabStrip", "reporter": "ch...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-03-23T16:27:17+00:00", "year": 2026, "attachment_count": 3, "local_path": "issues/495269751", "has_markdown": true }, { "id": "495273999", "title": "V8 TurboFan contextAccess depth truncation cause type confusion in Module Variable Access", "url": "https://issues.chromium.org/issues/495273999", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript>Compiler>Turbofan", "reporter": "qy...@gmail.com", "cve_ids": [], "bounty_amount": 11000.0, "reward_amount_meta": 11000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-03-23T15:56:21+00:00", "year": 2026, "attachment_count": 1, "local_path": "issues/495273999", "has_markdown": true }, { "id": "495262779", "title": "Security: heap-use-after-free in gpu::SyncToken::operator=(gpu::SyncToken const&)", "url": "https://issues.chromium.org/issues/495262779", "status": "Accepted", "severity": "S3-Low", "component": "Internals>GPU>Internals", "reporter": "zh...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-03-23T12:35:23+00:00", "year": 2026, "attachment_count": 2, "local_path": "issues/495262779", "has_markdown": true }, { "id": "495052581", "title": "Heap OOB read in ANGLE via `CubeMapArray` texture upload due to `endByte` underestimation in `ValidImageDataSize`", "url": "https://issues.chromium.org/issues/495052581", "status": "Accepted", "severity": "S3-Low", "component": "Internals>GPU>ANGLE", "reporter": "se...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-03-22T21:01:31+00:00", "year": 2026, "attachment_count": 3, "local_path": "issues/495052581", "has_markdown": true }, { "id": "494823889", "title": "Heap OOB read in ANGLE via `CubeMapArray` texture upload due to `endByte` underestimation in `ValidImageDataSize`", "url": "https://issues.chromium.org/issues/494823889", "status": "Accepted", "severity": "S3-Low", "component": "Internals>GPU>ANGLE", "reporter": "se...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-03-22T15:29:57+00:00", "year": 2026, "attachment_count": 3, "local_path": "issues/494823889", "has_markdown": true }, { "id": "495046320", "title": "V8 Sandbox Bypass: Atomics TypedArray TOCTOU (Map/Length Mismatch)", "url": "https://issues.chromium.org/issues/495046320", "status": "Verified", "severity": "S4-Minimal", "component": "Blink>JavaScript", "reporter": "ki...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-03-22T12:39:22+00:00", "year": 2026, "attachment_count": 0, "local_path": "issues/495046320", "has_markdown": true }, { "id": "494823884", "title": "Disable WebNN Origin Trial for M147", "url": "https://issues.chromium.org/issues/494823884", "status": "New", "severity": "S3-Low", "component": "Blink>WebML", "reporter": "ph...@chromium.org", "cve_ids": [], "bounty_amount": 43000.0, "reward_amount_meta": null, "public_issue": true, "inclusion_reason": "award_text", "award_text_found": true, "created_date": "2026-03-22T06:00:04+00:00", "year": 2026, "attachment_count": 4, "local_path": "issues/494823884", "has_markdown": true }, { "id": "494764371", "title": "Unlocked MetafilePlayer access in OOP SpoolDocument leads to heap-use-after-free in the browser process", "url": "https://issues.chromium.org/issues/494764371", "status": "Fixed", "severity": "S3-Low", "component": "Internals>Printing", "reporter": "je...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-03-21T14:57:49+00:00", "year": 2026, "attachment_count": 3, "local_path": "issues/494764371", "has_markdown": true }, { "id": "494764370", "title": "Stale FedCM autofill suggestion triggers heap-use-after-free in the browser process via unchecked flat_map iterator dereference", "url": "https://issues.chromium.org/issues/494764370", "status": "New", "severity": "S3-Low", "component": "Blink>Identity>FedCM", "reporter": "je...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-03-21T14:22:27+00:00", "year": 2026, "attachment_count": 5, "local_path": "issues/494764370", "has_markdown": true }, { "id": "494823867", "title": "Security: double-free in blink::WebRtcVideoFrameAdapter::SharedResources::ScaleAndMapFrameAsync", "url": "https://issues.chromium.org/issues/494823867", "status": "Accepted", "severity": "S3-Low", "component": "Blink>WebRTC", "reporter": "zh...@gmail.com", "cve_ids": [], "bounty_amount": 11000.0, "reward_amount_meta": 11000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-03-21T14:01:01+00:00", "year": 2026, "attachment_count": 4, "local_path": "issues/494823867", "has_markdown": true }, { "id": "494800494", "title": "AreRequestHeadersSafe() missing Origin and Sec-* prefix blocking — compromised renderer forges Origin and Sec-Fetch-* headers via modified_headers in FollowRedirect", "url": "https://issues.chromium.org/issues/494800494", "status": "Fixed", "severity": "S3-Low", "component": "Internals>Network", "reporter": "os...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-03-21T11:25:03+00:00", "year": 2026, "attachment_count": 4, "local_path": "issues/494800494", "has_markdown": true }, { "id": "494740162", "title": "Use-after-free of std::list iterator in FormFiller::UndoAutofill via duplicate FieldGlobalIds", "url": "https://issues.chromium.org/issues/494740162", "status": "Accepted", "severity": "S3-Low", "component": "UI>Browser>Autofill", "reporter": "je...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-03-21T08:24:58+00:00", "year": 2026, "attachment_count": 5, "local_path": "issues/494740162", "has_markdown": true }, { "id": "494644471", "title": "UAF in UpdateShapeActive of PDF Ink V2", "url": "https://issues.chromium.org/issues/494644471", "status": "Verified", "severity": "S3-Low", "component": "Internals>Plugins>PDF>Ink Signatures", "reporter": "he...@gmail.com", "cve_ids": [], "bounty_amount": 4000.0, "reward_amount_meta": 4000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-03-21T06:19:52+00:00", "year": 2026, "attachment_count": 4, "local_path": "issues/494644471", "has_markdown": true }, { "id": "494464734", "title": "ChromeDriver Argument Sanitization Bypass — Positional Argument Injection", "url": "https://issues.chromium.org/issues/494464734", "status": "Fixed", "severity": "S3-Low", "component": "Platform>Browser Automation>ChromeDriver", "reporter": "ia...@gmail.com", "cve_ids": [], "bounty_amount": 500.0, "reward_amount_meta": 500.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-03-20T19:49:16+00:00", "year": 2026, "attachment_count": 0, "local_path": "issues/494464734", "has_markdown": true }, { "id": "494449806", "title": "RequestService::RequestToken() missing browser-side identity-credentials-get Permissions Policy enforcement", "url": "https://issues.chromium.org/issues/494449806", "status": "Fixed", "severity": "S3-Low", "component": "Blink>Identity>FedCM, Blink>PermissionsPolicy", "reporter": "os...@gmail.com", "cve_ids": [], "bounty_amount": 500.0, "reward_amount_meta": 500.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-03-20T07:22:18+00:00", "year": 2026, "attachment_count": 3, "local_path": "issues/494449806", "has_markdown": true }, { "id": "494352590", "title": "Heap UAF in Blink OffscreenCanvas", "url": "https://issues.chromium.org/issues/494352590", "status": "New", "severity": "S3-Low", "component": "Internals>Mojo", "reporter": "sh...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-03-20T02:32:06+00:00", "year": 2026, "attachment_count": 1, "local_path": "issues/494352590", "has_markdown": true }, { "id": "494341321", "title": "Extension access to passkeys (webauthn) bypasses runtime_blocked_hosts enterprise policy", "url": "https://issues.chromium.org/issues/494341321", "status": "Fixed", "severity": "S3-Low", "component": "Platform>Extensions", "reporter": "ro...@robwu.nl", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-03-20T00:57:47+00:00", "year": 2026, "attachment_count": 3, "local_path": "issues/494341321", "has_markdown": true }, { "id": "494248550", "title": "ORT DML EP: heap-buffer-overflow in CreateCpuResource via int4/uint4 constants", "url": "https://issues.chromium.org/issues/494248550", "status": "Assigned", "severity": "S3-Low", "component": "Blink>WebML", "reporter": "to...@gmail.com", "cve_ids": [], "bounty_amount": 10000.0, "reward_amount_meta": 10000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-03-19T17:04:37+00:00", "year": 2026, "attachment_count": 5, "local_path": "issues/494248550", "has_markdown": true }, { "id": "494158331", "title": "Heap OOB write in XNNPACK Pool2D via integer overflow", "url": "https://issues.chromium.org/issues/494158331", "status": "New", "severity": "S4-Minimal", "component": "Blink>WebML", "reporter": "ki...@gmail.com", "cve_ids": [], "bounty_amount": 43000.0, "reward_amount_meta": 43000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-03-19T16:18:46+00:00", "year": 2026, "attachment_count": 3, "local_path": "issues/494158331", "has_markdown": true }, { "id": "494089502", "title": "Missing size validation in WebNN TFLite quantize parameter serialization leads to out-of-bounds read in the GPU process", "url": "https://issues.chromium.org/issues/494089502", "status": "Assigned", "severity": "S3-Low", "component": "Blink>WebML", "reporter": "je...@gmail.com", "cve_ids": [], "bounty_amount": 43000.0, "reward_amount_meta": 43000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-03-19T12:25:26+00:00", "year": 2026, "attachment_count": 4, "local_path": "issues/494089502", "has_markdown": true }, { "id": "493955234", "title": "UXSS in Chrome for Android", "url": "https://issues.chromium.org/issues/493955234", "status": "Accepted", "severity": "S3-Low", "component": "UI>Browser>Mobile", "reporter": "ad...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-03-19T08:28:17+00:00", "year": 2026, "attachment_count": 1, "local_path": "issues/493955234", "has_markdown": true }, { "id": "493955227", "title": "Reentrant vector mutation during FrameSink invalidation causes heap use-after-free in Viz process", "url": "https://issues.chromium.org/issues/493955227", "status": "Assigned", "severity": "S3-Low", "component": "Internals>Services>Viz", "reporter": "je...@gmail.com", "cve_ids": [], "bounty_amount": 16000.0, "reward_amount_meta": 16000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-03-19T05:25:53+00:00", "year": 2026, "attachment_count": 5, "local_path": "issues/493955227", "has_markdown": true }, { "id": "493957495", "title": "DCHECK-only validation of WebRTC APM output buffer size leads to heap buffer overflow from compromised renderer", "url": "https://issues.chromium.org/issues/493957495", "status": "Assigned", "severity": "S3-Low", "component": "Blink>WebRTC", "reporter": "je...@gmail.com", "cve_ids": [], "bounty_amount": 4000.0, "reward_amount_meta": 4000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-03-19T05:16:19+00:00", "year": 2026, "attachment_count": 4, "local_path": "issues/493957495", "has_markdown": true }, { "id": "493952652", "title": "heap-use-after-free READ in ElementRuleCollector InputRules path, page load, MiraclePtr unprotected", "url": "https://issues.chromium.org/issues/493952652", "status": "Verified", "severity": "S3-Low", "component": "Blink>CSS", "reporter": "nn...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-03-18T20:47:40+00:00", "year": 2026, "attachment_count": 8, "local_path": "issues/493952652", "has_markdown": true }, { "id": "493900619", "title": "Dawn: Heap Use-After-Free in AsyncTaskManager::RunTask via premature WaitableEvent nullification", "url": "https://issues.chromium.org/issues/493900619", "status": "Assigned", "severity": "S3-Low", "component": "Dawn", "reporter": "sw...@gmail.com", "cve_ids": [], "bounty_amount": 10000.0, "reward_amount_meta": 10000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-03-18T16:10:19+00:00", "year": 2026, "attachment_count": 2, "local_path": "issues/493900619", "has_markdown": true }, { "id": "493837911", "title": "heap-use-after-free READ in ElementRuleCollector InputRules path, page load, MiraclePtr unprotected", "url": "https://issues.chromium.org/issues/493837911", "status": "Verified", "severity": "S3-Low", "component": "Blink>CSS", "reporter": "nn...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-03-18T11:50:39+00:00", "year": 2026, "attachment_count": 4, "local_path": "issues/493837911", "has_markdown": true }, { "id": "493747593", "title": "Qualcomm Wild exploited CVE-2025-27038 bypass", "url": "https://issues.chromium.org/issues/493747593", "status": "New", "severity": "S4-Minimal", "component": "Blink>WebGL", "reporter": "ha...@gmail.com", "cve_ids": [], "bounty_amount": 250000.0, "reward_amount_meta": 250000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-03-18T09:35:44+00:00", "year": 2026, "attachment_count": 9, "local_path": "issues/493747593", "has_markdown": true }, { "id": "493708171", "title": "Service-side UAF due to missing sync token update in C*RP:WillDrawInternal()", "url": "https://issues.chromium.org/issues/493708171", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Canvas", "reporter": "he...@gmail.com", "cve_ids": [], "bounty_amount": 10000.0, "reward_amount_meta": 10000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-03-18T07:59:02+00:00", "year": 2026, "attachment_count": 2, "local_path": "issues/493708171", "has_markdown": true }, { "id": "493652473", "title": "Use-after-free in DevToolsRendererChannel::ForceDetachWorkerSessions via duplicate ChildTargetCreated for dedicated workers", "url": "https://issues.chromium.org/issues/493652473", "status": "Assigned", "severity": "S3-Low", "component": "Platform>DevTools", "reporter": "je...@gmail.com", "cve_ids": [], "bounty_amount": 26000.0, "reward_amount_meta": 26000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-03-18T07:50:36+00:00", "year": 2026, "attachment_count": 8, "local_path": "issues/493652473", "has_markdown": true }, { "id": "493747582", "title": "Heap OOB write in XNNPACK Pool2D via integer overflow", "url": "https://issues.chromium.org/issues/493747582", "status": "New", "severity": "S4-Minimal", "component": "Blink>WebML", "reporter": "ki...@gmail.com", "cve_ids": [], "bounty_amount": 43000.0, "reward_amount_meta": 43000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-03-18T06:50:14+00:00", "year": 2026, "attachment_count": 2, "local_path": "issues/493747582", "has_markdown": true }, { "id": "493708165", "title": "Missing output channel divisibility check in grouped convolution leads to heap OOB read in the GPU process via WebNN", "url": "https://issues.chromium.org/issues/493708165", "status": "Assigned", "severity": "S4-Minimal", "component": "Blink>WebML", "reporter": "je...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-03-18T06:48:07+00:00", "year": 2026, "attachment_count": 2, "local_path": "issues/493708165", "has_markdown": true }, { "id": "493631402", "title": " heap-use-after-free in v8_inspector::V8DebuggerAgentImpl::setBreakpointByUrl", "url": "https://issues.chromium.org/issues/493631402", "status": "Accepted", "severity": "S3-Low", "component": "Platform>DevTools", "reporter": "sa...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-03-17T23:45:42+00:00", "year": 2026, "attachment_count": 4, "local_path": "issues/493631402", "has_markdown": true }, { "id": "493534964", "title": "Heap buffer overflow in Blink animation timing", "url": "https://issues.chromium.org/issues/493534964", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Animation", "reporter": "sh...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-03-17T23:02:39+00:00", "year": 2026, "attachment_count": 2, "local_path": "issues/493534964", "has_markdown": true }, { "id": "493628982", "title": "Heap UAF in HTTPS HTTP/2 proxy authentication flow", "url": "https://issues.chromium.org/issues/493628982", "status": "New", "severity": "S3-Low", "component": "Internals>Network>Proxy", "reporter": "sh...@gmail.com", "cve_ids": [], "bounty_amount": 10000.0, "reward_amount_meta": 10000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-03-17T22:47:01+00:00", "year": 2026, "attachment_count": 6, "local_path": "issues/493628982", "has_markdown": true }, { "id": "493315759", "title": "DCOMPSurfaceRegistry race in Media Foundation DirectComposition", "url": "https://issues.chromium.org/issues/493315759", "status": "Accepted", "severity": "S3-Low", "component": "Internals>GPU>Internals", "reporter": "ke...@gmail.com", "cve_ids": [], "bounty_amount": 4000.0, "reward_amount_meta": 4000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-03-17T18:02:47+00:00", "year": 2026, "attachment_count": 6, "local_path": "issues/493315759", "has_markdown": true }, { "id": "493534950", "title": "Maglev: unsound node replacement when inlining can lead to exploitable write barrier omission", "url": "https://issues.chromium.org/issues/493534950", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript>Compiler>Maglev", "reporter": "pj...@gmail.com", "cve_ids": [], "bounty_amount": 55000.0, "reward_amount_meta": 55000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-03-17T16:39:40+00:00", "year": 2026, "attachment_count": 6, "local_path": "issues/493534950", "has_markdown": true }, { "id": "493566347", "title": "ORT DML EP: heap-buffer-overflow in CreateCpuResource via int4/uint4 constants", "url": "https://issues.chromium.org/issues/493566347", "status": "Assigned", "severity": "S3-Low", "component": "Blink>WebML", "reporter": "to...@gmail.com", "cve_ids": [], "bounty_amount": 10000.0, "reward_amount_meta": 10000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-03-17T15:50:23+00:00", "year": 2026, "attachment_count": 10, "local_path": "issues/493566347", "has_markdown": true }, { "id": "493319454", "title": "Heap buffer overflow in TFLite FullyConnectedPerChannel via WebNN quantized GEMM with wrong per-axis quantization dimension", "url": "https://issues.chromium.org/issues/493319454", "status": "New", "severity": "S3-Low", "component": "Blink>WebML", "reporter": "je...@gmail.com", "cve_ids": [], "bounty_amount": 43000.0, "reward_amount_meta": 43000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-03-17T05:13:19+00:00", "year": 2026, "attachment_count": 3, "local_path": "issues/493319454", "has_markdown": true }, { "id": "493310462", "title": "Heap buffer overflow in TFLite StridedSlice via WebNN slice() due to float32 precision loss in output shape computation", "url": "https://issues.chromium.org/issues/493310462", "status": "New", "severity": "S4-Minimal", "component": "Blink>WebML", "reporter": "je...@gmail.com", "cve_ids": [], "bounty_amount": 43000.0, "reward_amount_meta": 43000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-03-17T03:48:14+00:00", "year": 2026, "attachment_count": 3, "local_path": "issues/493310462", "has_markdown": true }, { "id": "493310458", "title": "Heap buffer overflow in TFLite pooling via WebNN Pool2d windowDimensions uint32-to-int32 truncation", "url": "https://issues.chromium.org/issues/493310458", "status": "New", "severity": "S4-Minimal", "component": "Blink>WebML", "reporter": "je...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-03-17T02:48:39+00:00", "year": 2026, "attachment_count": 3, "local_path": "issues/493310458", "has_markdown": true }, { "id": "493256564", "title": "ANGLE Metal Stale mFormat Cache causes GPU OOB WRITE", "url": "https://issues.chromium.org/issues/493256564", "status": "Assigned", "severity": "S3-Low", "component": "Internals>GPU>ANGLE", "reporter": "ci...@gmail.com", "cve_ids": [], "bounty_amount": 77000.0, "reward_amount_meta": 77000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-03-16T18:38:16+00:00", "year": 2026, "attachment_count": 6, "local_path": "issues/493256564", "has_markdown": true }, { "id": "493082093", "title": "Integer overflow in XNNPACK MaxPool2d indirection buffer sizing leads to heap out-of-bounds write in GPU process", "url": "https://issues.chromium.org/issues/493082093", "status": "Assigned", "severity": "S4-Minimal", "component": "Internals>OptimizationGuide", "reporter": "je...@gmail.com", "cve_ids": [], "bounty_amount": 43000.0, "reward_amount_meta": 43000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-03-16T11:53:42+00:00", "year": 2026, "attachment_count": 3, "local_path": "issues/493082093", "has_markdown": true }, { "id": "493099940", "title": "Heap corruption in GPU process via unchecked tensor rank in WebNN constant transpose", "url": "https://issues.chromium.org/issues/493099940", "status": "New", "severity": "S3-Low", "component": "Blink>WebML", "reporter": "je...@gmail.com", "cve_ids": [], "bounty_amount": 36000.0, "reward_amount_meta": 36000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-03-16T11:43:31+00:00", "year": 2026, "attachment_count": 3, "local_path": "issues/493099940", "has_markdown": true }, { "id": "492899974", "title": "UAF in WebViewImpl::Minimize", "url": "https://issues.chromium.org/issues/492899974", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>WebAppInstalls", "reporter": "he...@gmail.com", "cve_ids": [], "bounty_amount": 11000.0, "reward_amount_meta": 11000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-03-16T08:06:46+00:00", "year": 2026, "attachment_count": 8, "local_path": "issues/492899974", "has_markdown": true }, { "id": "492963096", "title": "setHTML() Sanitizer API bypass via custom element callback execution during parsing", "url": "https://issues.chromium.org/issues/492963096", "status": "Accepted", "severity": "S3-Low", "component": "Blink>SecurityFeature>SanitizerAPI", "reporter": "ch...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-03-15T17:35:25+00:00", "year": 2026, "attachment_count": 2, "local_path": "issues/492963096", "has_markdown": true }, { "id": "492735384", "title": "Heap-use-after-free in CSS attribute rule matching via lazy style synchronization", "url": "https://issues.chromium.org/issues/492735384", "status": "Assigned", "severity": "S3-Low", "component": "Blink>CSS", "reporter": "je...@gmail.com", "cve_ids": [], "bounty_amount": 11000.0, "reward_amount_meta": 11000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-03-15T03:03:50+00:00", "year": 2026, "attachment_count": 4, "local_path": "issues/492735384", "has_markdown": true }, { "id": "492735383", "title": "Type confusion in CSSRepeatValue via IsValueList() range check leads to renderer crash", "url": "https://issues.chromium.org/issues/492735383", "status": "Verified", "severity": "S3-Low", "component": "Blink>CSS", "reporter": "je...@gmail.com", "cve_ids": [], "bounty_amount": 11000.0, "reward_amount_meta": 11000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-03-15T03:00:11+00:00", "year": 2026, "attachment_count": 2, "local_path": "issues/492735383", "has_markdown": true }, { "id": "492561170", "title": "V8 Sandbox Bypass: Atomics TypedArray TOCTOU (Map/Length Mismatch)", "url": "https://issues.chromium.org/issues/492561170", "status": "Verified", "severity": "S4-Minimal", "component": "Blink>JavaScript", "reporter": "ki...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-03-14T21:23:42+00:00", "year": 2026, "attachment_count": 3, "local_path": "issues/492561170", "has_markdown": true }, { "id": "492744328", "title": "Heap buffer overflow (read) in skcms curve table lookup via crafted ICC profile", "url": "https://issues.chromium.org/issues/492744328", "status": "Assigned", "severity": "S3-Low", "component": "Internals>Skia", "reporter": "ma...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-03-14T20:12:40+00:00", "year": 2026, "attachment_count": 6, "local_path": "issues/492744328", "has_markdown": true }, { "id": "492735369", "title": "Use-After-Free in AsyncTaskManager::WaitAllPendingTasks Due to Early Task Destruction in GPU Process", "url": "https://issues.chromium.org/issues/492735369", "status": "Assigned", "severity": "S3-Low", "component": "Dawn", "reporter": "se...@gmail.com", "cve_ids": [ "CVE-2026-5286" ], "bounty_amount": 11000.0, "reward_amount_meta": 11000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-03-14T16:48:28+00:00", "year": 2026, "attachment_count": 2, "local_path": "issues/492735369", "has_markdown": true }, { "id": "492668885", "title": "XNNPACK resizes output tensor", "url": "https://issues.chromium.org/issues/492668885", "status": "Accepted", "severity": "S4-Minimal", "component": "Blink>WebML", "reporter": "re...@chromium.org", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": null, "public_issue": true, "inclusion_reason": "award_text", "award_text_found": true, "created_date": "2026-03-14T11:29:03+00:00", "year": 2026, "attachment_count": 2, "local_path": "issues/492668885", "has_markdown": true }, { "id": "492450480", "title": "UAF in XNN reshape ", "url": "https://issues.chromium.org/issues/492450480", "status": "Verified", "severity": "S4-Minimal", "component": "Blink>WebML", "reporter": "he...@gmail.com", "cve_ids": [], "bounty_amount": 43000.0, "reward_amount_meta": 43000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-03-13T18:22:06+00:00", "year": 2026, "attachment_count": 2, "local_path": "issues/492450480", "has_markdown": true }, { "id": "492450478", "title": "OOB Write in GraphBuilderTflite::SerializeConv2d", "url": "https://issues.chromium.org/issues/492450478", "status": "Assigned", "severity": "S4-Minimal", "component": "Blink>WebML", "reporter": "he...@gmail.com", "cve_ids": [], "bounty_amount": 23000.0, "reward_amount_meta": 23000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-03-13T17:31:22+00:00", "year": 2026, "attachment_count": 3, "local_path": "issues/492450478", "has_markdown": true }, { "id": "492421936", "title": "Use-after-free in shared WordBreakIteratorPool via Proofreader API", "url": "https://issues.chromium.org/issues/492421936", "status": "Verified", "severity": "S3-Low", "component": "Blink>AI", "reporter": "je...@gmail.com", "cve_ids": [], "bounty_amount": 11000.0, "reward_amount_meta": 11000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-03-13T16:26:39+00:00", "year": 2026, "attachment_count": 2, "local_path": "issues/492421936", "has_markdown": true }, { "id": "492374380", "title": "[Linux] Cross-Thread Use-After-Free in FontLoader::openStream via Non-Owning MappedFontFile Cache", "url": "https://issues.chromium.org/issues/492374380", "status": "Accepted", "severity": "S3-Low", "component": "Blink>Fonts", "reporter": "je...@gmail.com", "cve_ids": [], "bounty_amount": 11000.0, "reward_amount_meta": 11000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-03-13T14:32:47+00:00", "year": 2026, "attachment_count": 3, "local_path": "issues/492374380", "has_markdown": true }, { "id": "492465356", "title": "SubAppsServiceImpl::Remove() use-after-free: ReportBadMessageAndDeleteThis() mid-loop deletes `this`, next iteration accesses freed memory", "url": "https://issues.chromium.org/issues/492465356", "status": "Verified", "severity": "S3-Low", "component": "UI>Browser>WebAppInstalls>Isolated", "reporter": "os...@gmail.com", "cve_ids": [], "bounty_amount": 36000.0, "reward_amount_meta": 36000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-03-13T13:14:00+00:00", "year": 2026, "attachment_count": 6, "local_path": "issues/492465356", "has_markdown": true }, { "id": "492421926", "title": "OOB read in TFLite TransposeConvV2", "url": "https://issues.chromium.org/issues/492421926", "status": "Assigned", "severity": "S4-Minimal", "component": "Blink>WebML", "reporter": "he...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-03-13T12:56:11+00:00", "year": 2026, "attachment_count": 2, "local_path": "issues/492421926", "has_markdown": true }, { "id": "492350406", "title": "CHECK failure: offset <= view.length() && length <= view.length() - offset in string_view.h", "url": "https://issues.chromium.org/issues/492350406", "status": "Assigned", "severity": "S3-Low", "component": "Platform", "reporter": "24...@project.gserviceaccount.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": null, "public_issue": true, "inclusion_reason": "award_text", "award_text_found": true, "created_date": "2026-03-13T12:25:16+00:00", "year": 2026, "attachment_count": 2, "local_path": "issues/492350406", "has_markdown": true }, { "id": "492350403", "title": "Heap Buffer Overflow in TFLite + XNNPack via WebNN", "url": "https://issues.chromium.org/issues/492350403", "status": "Assigned", "severity": "S4-Minimal", "component": "Blink>WebML", "reporter": "to...@gmail.com", "cve_ids": [], "bounty_amount": 33000.0, "reward_amount_meta": 33000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-03-13T12:11:13+00:00", "year": 2026, "attachment_count": 3, "local_path": "issues/492350403", "has_markdown": true }, { "id": "492350400", "title": "OOB Write in GraphBuilderTflite::SerializeConv2d", "url": "https://issues.chromium.org/issues/492350400", "status": "Assigned", "severity": "S4-Minimal", "component": "Blink>WebML", "reporter": "he...@gmail.com", "cve_ids": [], "bounty_amount": 23000.0, "reward_amount_meta": 23000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-03-13T11:20:18+00:00", "year": 2026, "attachment_count": 3, "local_path": "issues/492350400", "has_markdown": true }, { "id": "492218546", "title": "Chrome sandbox escape via libGLES_mali.so exploited in the wild", "url": "https://issues.chromium.org/issues/492218546", "status": "Assigned", "severity": "S3-Low", "component": "Internals>GPU", "reporter": "he...@google.com", "cve_ids": [], "bounty_amount": 25000.0, "reward_amount_meta": null, "public_issue": true, "inclusion_reason": "award_text", "award_text_found": true, "created_date": "2026-03-13T08:41:16+00:00", "year": 2026, "attachment_count": 8, "local_path": "issues/492218546", "has_markdown": true }, { "id": "492218537", "title": "Use-after-free in AudioRendererMixerInput via setSinkId/createMediaElementSource race", "url": "https://issues.chromium.org/issues/492218537", "status": "Assigned", "severity": "S3-Low", "component": "Internals>Media", "reporter": "je...@gmail.com", "cve_ids": [], "bounty_amount": 4000.0, "reward_amount_meta": 4000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-03-13T03:56:01+00:00", "year": 2026, "attachment_count": 3, "local_path": "issues/492218537", "has_markdown": true }, { "id": "492228019", "title": "Use-After-Free in ReadbackBufferShadowTracker via getBufferSubData with Non-Zero Offset", "url": "https://issues.chromium.org/issues/492228019", "status": "Assigned", "severity": "S3-Low", "component": "Blink>WebGL", "reporter": "je...@gmail.com", "cve_ids": [], "bounty_amount": 11000.0, "reward_amount_meta": 11000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-03-13T01:39:55+00:00", "year": 2026, "attachment_count": 2, "local_path": "issues/492228019", "has_markdown": true }, { "id": "492249619", "title": "ANGLE Metal Shadow Buffer Stale Size causes GPU OOB WRITE", "url": "https://issues.chromium.org/issues/492249619", "status": "Assigned", "severity": "S3-Low", "component": "Internals>GPU>ANGLE", "reporter": "ci...@gmail.com", "cve_ids": [], "bounty_amount": 18000.0, "reward_amount_meta": 18000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-03-12T20:59:36+00:00", "year": 2026, "attachment_count": 3, "local_path": "issues/492249619", "has_markdown": true }, { "id": "492209815", "title": "Heap buffer overflow write in renderer via crafted font in HarfBuzz apply_stch()", "url": "https://issues.chromium.org/issues/492209815", "status": "Verified", "severity": "Unknown", "component": "Unknown", "reporter": "ma...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": null, "public_issue": true, "inclusion_reason": "award_text", "award_text_found": true, "created_date": "2026-03-12T20:52:17+00:00", "year": 2026, "attachment_count": 0, "local_path": "issues/492209815", "has_markdown": true }, { "id": "492211919", "title": "Missing Browser-Side Sandbox Enforcement for kPointerLock", "url": "https://issues.chromium.org/issues/492211919", "status": "Fixed", "severity": "S3-Low", "component": "Blink>Input>PointerLock, Blink>SecurityFeature>IFrameSandbox, Internals>Sandbox>SiteIsolation", "reporter": "mi...@bountyy.fi", "cve_ids": [], "bounty_amount": 1500.0, "reward_amount_meta": 1500.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-03-12T18:58:31+00:00", "year": 2026, "attachment_count": 1, "local_path": "issues/492211919", "has_markdown": true }, { "id": "492153658", "title": "ANGLE Vulkan: invalidateFramebuffer Erases Pending robust_resource_init Clear, Leads to Cross-Origin GPU Texture Data Leak", "url": "https://issues.chromium.org/issues/492153658", "status": "Verified", "severity": "S3-Low", "component": "Internals>GPU>ANGLE, Internals>GPU>Vulkan", "reporter": "sw...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-03-12T16:01:40+00:00", "year": 2026, "attachment_count": 6, "local_path": "issues/492153658", "has_markdown": true }, { "id": "492139412", "title": "UAF write in Dawn wire server: BufferUpdateMappedData writes to freed GPU memory after DeviceDestroy", "url": "https://issues.chromium.org/issues/492139412", "status": "Assigned", "severity": "S3-Low", "component": "Dawn>Wire", "reporter": "se...@gmail.com", "cve_ids": [], "bounty_amount": 36000.0, "reward_amount_meta": 36000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-03-12T15:23:14+00:00", "year": 2026, "attachment_count": 2, "local_path": "issues/492139412", "has_markdown": true }, { "id": "492131521", "title": "ANGLE WebGL2: Missing Per-Layer Init Tracking in TEXTURE_2D_ARRAY Leaves Layers Uninitialized, Leads to Cross-Origin GPU Texture Data Leak", "url": "https://issues.chromium.org/issues/492131521", "status": "Verified", "severity": "S3-Low", "component": "Internals>GPU>ANGLE", "reporter": "sw...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-03-12T14:39:22+00:00", "year": 2026, "attachment_count": 8, "local_path": "issues/492131521", "has_markdown": true }, { "id": "492077213", "title": "V8 Sandbox Bypass: Fast API overload metadata corruption causes compiler-emitted mixed native call type confusion", "url": "https://issues.chromium.org/issues/492077213", "status": "Accepted", "severity": "S3-Low", "component": "Blink>JavaScript", "reporter": "gu...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-03-12T11:17:43+00:00", "year": 2026, "attachment_count": 1, "local_path": "issues/492077213", "has_markdown": true }, { "id": "491994185", "title": "Iterator Invalidation in LayoutSubtreeRootList During Container Query Interleaved Style Recalc Leads to Use-After-Free", "url": "https://issues.chromium.org/issues/491994185", "status": "New", "severity": "S3-Low", "component": "Blink>CSS", "reporter": "je...@gmail.com", "cve_ids": [], "bounty_amount": 11000.0, "reward_amount_meta": 11000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-03-12T07:25:22+00:00", "year": 2026, "attachment_count": 2, "local_path": "issues/491994185", "has_markdown": true }, { "id": "491869946", "title": "heap-use-after-free in blink::IdentityProvider::resolve", "url": "https://issues.chromium.org/issues/491869946", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Identity>FedCM", "reporter": "fa...@gmail.com", "cve_ids": [], "bounty_amount": 10000.0, "reward_amount_meta": 10000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-03-12T01:05:44+00:00", "year": 2026, "attachment_count": 7, "local_path": "issues/491869946", "has_markdown": true }, { "id": "491766258", "title": "Extensions without file URL access can use the `Page.navigate` CDP command to open `view-source:file:` URLs", "url": "https://issues.chromium.org/issues/491766258", "status": "Accepted", "severity": "S3-Low", "component": "Platform>DevTools, Platform>Extensions>API", "reporter": "al...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-03-11T18:23:49+00:00", "year": 2026, "attachment_count": 9, "local_path": "issues/491766258", "has_markdown": true }, { "id": "491655161", "title": "WebCodecs libaom, libvpx: OOB Read in AV1 and VP9 encoder when encoding I420 frames with mismatched U and V strides", "url": "https://issues.chromium.org/issues/491655161", "status": "Assigned", "severity": "S3-Low", "component": "Internals>Media>Video", "reporter": "eu...@chromium.org", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": null, "public_issue": true, "inclusion_reason": "award_text", "award_text_found": true, "created_date": "2026-03-11T15:42:01+00:00", "year": 2026, "attachment_count": 3, "local_path": "issues/491655161", "has_markdown": true }, { "id": "491760376", "title": "Integer overflow in ANGLE D3D11 TextureStorage11::setData() leads to heap buffer overflow via WebGL2", "url": "https://issues.chromium.org/issues/491760376", "status": "Assigned", "severity": "S3-Low", "component": "Internals>GPU>ANGLE", "reporter": "yu...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-03-11T15:10:56+00:00", "year": 2026, "attachment_count": 2, "local_path": "issues/491760376", "has_markdown": true }, { "id": "491685406", "title": "Update Poc: Container-Overflow in `SurfaceAllocationGroup::OnFirstSurfaceActivation` due to reentrant mutation of `active_embedders_` in GPU process", "url": "https://issues.chromium.org/issues/491685406", "status": "Assigned", "severity": "S3-Low", "component": "Internals>Compositing", "reporter": "se...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-03-11T09:50:46+00:00", "year": 2026, "attachment_count": 1, "local_path": "issues/491685406", "has_markdown": true }, { "id": "491676472", "title": "RenderFrameHostImpl::RunJavaScriptDialog() missing browser-side allow-modals sandbox flag check", "url": "https://issues.chromium.org/issues/491676472", "status": "Fixed", "severity": "S3-Low", "component": "Blink>HTML>Dialog, Blink>SecurityFeature>IFrameSandbox, Internals>Sandbox>SiteIsolation", "reporter": "os...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-03-11T06:59:03+00:00", "year": 2026, "attachment_count": 3, "local_path": "issues/491676472", "has_markdown": true }, { "id": "491515787", "title": "Heap UAF write in libyuv Convert8To16Row_Any_AVX2 via crafted raw VideoFrame input", "url": "https://issues.chromium.org/issues/491515787", "status": "Verified", "severity": "Unknown", "component": "Unknown", "reporter": "sh...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": null, "public_issue": true, "inclusion_reason": "award_text", "award_text_found": true, "created_date": "2026-03-11T03:28:55+00:00", "year": 2026, "attachment_count": 2, "local_path": "issues/491515787", "has_markdown": true }, { "id": "491518619", "title": "[PassAsSpan] ArrayBuffer.transfer() re-entrancy UAF / SEGV in TextDecoder.decode", "url": "https://issues.chromium.org/issues/491518619", "status": "Assigned", "severity": "S4-Minimal", "component": "Blink>TextEncoding", "reporter": "pk...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-03-11T02:27:55+00:00", "year": 2026, "attachment_count": 4, "local_path": "issues/491518619", "has_markdown": true }, { "id": "491516670", "title": "Integer overflow in HarfBuzz apply_stch() causes heap OOB write via crafted font + Arabic text", "url": "https://issues.chromium.org/issues/491516670", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Fonts", "reporter": "pw...@gmail.com", "cve_ids": [], "bounty_amount": 10000.0, "reward_amount_meta": 10000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-03-11T01:29:04+00:00", "year": 2026, "attachment_count": 2, "local_path": "issues/491516670", "has_markdown": true }, { "id": "491555187", "title": "Chromium / Chrome DevTools Protocol: WebSocket Endpoint Missing Host Header Validation (DNS Rebinding Bypass)", "url": "https://issues.chromium.org/issues/491555187", "status": "Accepted", "severity": "S3-Low", "component": "Platform>DevTools", "reporter": "ik...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-03-10T21:33:19+00:00", "year": 2026, "attachment_count": 2, "local_path": "issues/491555187", "has_markdown": true }, { "id": "491518608", "title": "Use-After-Free in Dawn Wire Server Uncaptured-Error Callback via Incomplete Device Unregistration Cleanup", "url": "https://issues.chromium.org/issues/491518608", "status": "Assigned", "severity": "S3-Low", "component": "Dawn>Wire", "reporter": "se...@gmail.com", "cve_ids": [], "bounty_amount": 70000.0, "reward_amount_meta": 70000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-03-10T20:00:04+00:00", "year": 2026, "attachment_count": 13, "local_path": "issues/491518608", "has_markdown": true }, { "id": "491422244", "title": "GPU sandbox escape on macOS via lsd.modifydb > RCE", "url": "https://issues.chromium.org/issues/491422244", "status": "Assigned", "severity": "S3-Low", "component": "Internals>GPU>Video", "reporter": "ma...@advert.com.au", "cve_ids": [], "bounty_amount": 25000.0, "reward_amount_meta": 25000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-03-10T17:01:02+00:00", "year": 2026, "attachment_count": 1, "local_path": "issues/491422244", "has_markdown": true }, { "id": "491358681", "title": "Heap buffer overflow write in libaom AV1 SVC encoding via WebRTC", "url": "https://issues.chromium.org/issues/491358681", "status": "New", "severity": "S3-Low", "component": "Internals>Media>Video", "reporter": "je...@gmail.com", "cve_ids": [], "bounty_amount": 11000.0, "reward_amount_meta": 11000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-03-10T14:44:42+00:00", "year": 2026, "attachment_count": 4, "local_path": "issues/491358681", "has_markdown": true }, { "id": "491191118", "title": "Heap OOB Write in Skia Ganesh Atlas Path Renderer via Signed Integer Overflow in PathStencilCoverOp", "url": "https://issues.chromium.org/issues/491191118", "status": "New", "severity": "S3-Low", "component": "Internals>Skia", "reporter": "qq...@calif.io", "cve_ids": [], "bounty_amount": 32000.0, "reward_amount_meta": 32000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-03-10T09:19:39+00:00", "year": 2026, "attachment_count": 6, "local_path": "issues/491191118", "has_markdown": true }, { "id": "491080830", "title": "Heap OOB read in Blink text shaping", "url": "https://issues.chromium.org/issues/491080830", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Fonts", "reporter": "sh...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-03-09T15:58:21+00:00", "year": 2026, "attachment_count": 2, "local_path": "issues/491080830", "has_markdown": true }, { "id": "490963038", "title": "Missing validation of linear timing function point count in Viz process DeserializeTimingFunction leads to OOB read in GPU process", "url": "https://issues.chromium.org/issues/490963038", "status": "Accepted", "severity": "S3-Low", "component": "Internals>Services>Viz", "reporter": "je...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-03-09T10:44:12+00:00", "year": 2026, "attachment_count": 2, "local_path": "issues/490963038", "has_markdown": true }, { "id": "490769268", "title": "V8 Sandbox Bypass: BigInt CachedMod Heap-Buffer-Overflow on C++ Heap", "url": "https://issues.chromium.org/issues/490769268", "status": "Assigned", "severity": "S4-Minimal", "component": "Blink>JavaScript", "reporter": "de...@gmail.com", "cve_ids": [], "bounty_amount": 20000.0, "reward_amount_meta": 20000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-03-08T22:06:17+00:00", "year": 2026, "attachment_count": 3, "local_path": "issues/490769268", "has_markdown": true }, { "id": "490889657", "title": "Fatal error in Bytecode mismatch at offset 8 in interpreter.cc", "url": "https://issues.chromium.org/issues/490889657", "status": "Assigned", "severity": "S4-Minimal", "component": "Blink>JavaScript, Blink>JavaScript>GarbageCollection, Blink>JavaScript>Parser, Blink>JavaScript>Runtime", "reporter": "ta...@gmail.com", "cve_ids": [], "bounty_amount": 8000.0, "reward_amount_meta": 8000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-03-08T22:05:36+00:00", "year": 2026, "attachment_count": 1, "local_path": "issues/490889657", "has_markdown": true }, { "id": "490727241", "title": "Use-after-poison in InspectorMediaEventHandler::SendQueuedMediaEvents via canvas.captureStream() (zero interaction)", "url": "https://issues.chromium.org/issues/490727241", "status": "Assigned", "severity": "S3-Low", "component": "Internals>Media", "reporter": "hu...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-03-08T17:55:47+00:00", "year": 2026, "attachment_count": 6, "local_path": "issues/490727241", "has_markdown": true }, { "id": "490773579", "title": "CSP doesn't block sourceMappingURL", "url": "https://issues.chromium.org/issues/490773579", "status": "Accepted", "severity": "S3-Low", "component": "Platform>DevTools>Sources", "reporter": "no...@applitools.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-03-08T12:51:24+00:00", "year": 2026, "attachment_count": 1, "local_path": "issues/490773579", "has_markdown": true }, { "id": "490805106", "title": "Heap-buffer-overflow in Skia PathStencilCoverOp via AtlasPathRenderer integer overflow", "url": "https://issues.chromium.org/issues/490805106", "status": "New", "severity": "S3-Low", "component": "Internals>Skia", "reporter": "si...@gmail.com", "cve_ids": [ "CVE-2026-3538" ], "bounty_amount": 32000.0, "reward_amount_meta": 32000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-03-08T11:45:55+00:00", "year": 2026, "attachment_count": 4, "local_path": "issues/490805106", "has_markdown": true }, { "id": "490642836", "title": "Rewriter stack overflow can corrupt AST and can cause wrong-scope bytecode generation", "url": "https://issues.chromium.org/issues/490642836", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript>Parser", "reporter": "gu...@gmail.com", "cve_ids": [], "bounty_amount": 8000.0, "reward_amount_meta": 8000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-03-08T09:21:16+00:00", "year": 2026, "attachment_count": 11, "local_path": "issues/490642836", "has_markdown": true }, { "id": "490588145", "title": "Heap-use-after-free in VerticalTabDragHandlerImpl::ContinueDrag", "url": "https://issues.chromium.org/issues/490588145", "status": "Verified", "severity": "S3-Low", "component": "UI>Browser>TopChrome>TabStrip", "reporter": "ch...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-03-07T20:36:57+00:00", "year": 2026, "attachment_count": 3, "local_path": "issues/490588145", "has_markdown": true }, { "id": "490533968", "title": "NaN poisoning in k-rate SetValueCurve leads to out-of-bounds read in DelayNode", "url": "https://issues.chromium.org/issues/490533968", "status": "Assigned", "severity": "S4-Minimal", "component": "Blink>WebAudio", "reporter": "je...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-03-07T15:44:08+00:00", "year": 2026, "attachment_count": 2, "local_path": "issues/490533968", "has_markdown": true }, { "id": "490254128", "title": "Use-after-free in MidiManagerAndroid due to incorrect member destruction order on Android", "url": "https://issues.chromium.org/issues/490254128", "status": "Assigned", "severity": "S4-Minimal", "component": "Blink>WebMIDI", "reporter": "je...@gmail.com", "cve_ids": [], "bounty_amount": 4000.0, "reward_amount_meta": 4000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-03-06T14:48:03+00:00", "year": 2026, "attachment_count": 5, "local_path": "issues/490254128", "has_markdown": true }, { "id": "490251701", "title": "Use-After-Free in DCOMPSurfaceRegistry due to data race on unsynchronized flat_map access in GPU Process", "url": "https://issues.chromium.org/issues/490251701", "status": "Assigned", "severity": "S3-Low", "component": "Internals>GPU>Video", "reporter": "se...@gmail.com", "cve_ids": [], "bounty_amount": 11000.0, "reward_amount_meta": 11000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-03-06T08:31:19+00:00", "year": 2026, "attachment_count": 8, "local_path": "issues/490251701", "has_markdown": true }, { "id": "490251699", "title": "OOB Write in CalculateNPOTTwiddleSparsePageMap3D cause android chrome gpu crash", "url": "https://issues.chromium.org/issues/490251699", "status": "New", "severity": "S3-Low", "component": "Internals>GPU>ANGLE", "reporter": "ha...@gmail.com", "cve_ids": [], "bounty_amount": 32000.0, "reward_amount_meta": 32000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-03-06T07:22:38+00:00", "year": 2026, "attachment_count": 2, "local_path": "issues/490251699", "has_markdown": true }, { "id": "490170083", "title": "ANGLE BlitGL copySubTextureCPUReadback Controlled Heap Overflow via Unsynchronized PACK_ROW_LENGTH", "url": "https://issues.chromium.org/issues/490170083", "status": "New", "severity": "S3-Low", "component": "Internals>GPU>ANGLE", "reporter": "ci...@gmail.com", "cve_ids": [], "bounty_amount": 90000.0, "reward_amount_meta": 90000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-03-05T22:31:40+00:00", "year": 2026, "attachment_count": 3, "local_path": "issues/490170083", "has_markdown": true }, { "id": "490023239", "title": "Type confusion in InspectorCSSAgent::setScopeText", "url": "https://issues.chromium.org/issues/490023239", "status": "Fixed", "severity": "S3-Low", "component": "Blink>CSS", "reporter": "he...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-03-05T18:00:40+00:00", "year": 2026, "attachment_count": 3, "local_path": "issues/490023239", "has_markdown": true }, { "id": "489791425", "title": "ANGLE D3D11: stale ID3D11Buffer pointer in TransformFeedback11 mBuffers leads to use-after-free in GPU process via SOSetTargets", "url": "https://issues.chromium.org/issues/489791425", "status": "Assigned", "severity": "S3-Low", "component": "Internals>GPU>ANGLE", "reporter": "je...@gmail.com", "cve_ids": [], "bounty_amount": 11000.0, "reward_amount_meta": 11000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-03-05T04:25:23+00:00", "year": 2026, "attachment_count": 4, "local_path": "issues/489791425", "has_markdown": true }, { "id": "489791424", "title": "Integer overflow in ANGLE D3D11 streaming vertex buffer leads to massive heap OOB write in the GPU process on Windows", "url": "https://issues.chromium.org/issues/489791424", "status": "Assigned", "severity": "S3-Low", "component": "Internals>GPU>ANGLE", "reporter": "je...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-03-05T04:20:52+00:00", "year": 2026, "attachment_count": 3, "local_path": "issues/489791424", "has_markdown": true }, { "id": "489755020", "title": "Out-of-bounds heap read in VP9 encoder via WebCodecs VideoEncoder dimension reconfiguration", "url": "https://issues.chromium.org/issues/489755020", "status": "Accepted", "severity": "S3-Low", "component": "Blink>Media>WebCodecs", "reporter": "ca...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-03-04T17:51:38+00:00", "year": 2026, "attachment_count": 0, "local_path": "issues/489755020", "has_markdown": true }, { "id": "489619753", "title": "heap-use-after-free in extensions::ChromeContentRulesRegistry::RemoveRulesImpl", "url": "https://issues.chromium.org/issues/489619753", "status": "Accepted", "severity": "S3-Low", "component": "Platform>Extensions", "reporter": "fa...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-03-04T15:40:47+00:00", "year": 2026, "attachment_count": 2, "local_path": "issues/489619753", "has_markdown": true }, { "id": "489711638", "title": "Security: WinUSB - multiple issues", "url": "https://issues.chromium.org/issues/489711638", "status": "Assigned", "severity": "S3-Low", "component": "Blink>USB", "reporter": "cn...@yubico.com", "cve_ids": [ "CVE-2018-6125", "CVE-2023-45866" ], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-03-04T15:05:35+00:00", "year": 2026, "attachment_count": 2, "local_path": "issues/489711638", "has_markdown": true }, { "id": "489585044", "title": "Insufficient bounds check in ANGLE Metal UBO bool conversion leads to heap OOB read in GPU process on Mac", "url": "https://issues.chromium.org/issues/489585044", "status": "Assigned", "severity": "S3-Low", "component": "Internals>GPU>ANGLE", "reporter": "je...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-03-04T13:00:46+00:00", "year": 2026, "attachment_count": 3, "local_path": "issues/489585044", "has_markdown": true }, { "id": "489633232", "title": "V8 Sandbox Bypass: AAW/PC Control via major GC between codegen and Code object creation", "url": "https://issues.chromium.org/issues/489633232", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript>Compiler>Maglev", "reporter": "kr...@gmail.com", "cve_ids": [], "bounty_amount": 20000.0, "reward_amount_meta": 20000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-03-04T12:55:15+00:00", "year": 2026, "attachment_count": 3, "local_path": "issues/489633232", "has_markdown": true }, { "id": "489585038", "title": "UAF in APICopyTextureToTexture of Dawn", "url": "https://issues.chromium.org/issues/489585038", "status": "Assigned", "severity": "S3-Low", "component": "Dawn", "reporter": "he...@gmail.com", "cve_ids": [], "bounty_amount": 11000.0, "reward_amount_meta": 11000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-03-04T10:18:06+00:00", "year": 2026, "attachment_count": 2, "local_path": "issues/489585038", "has_markdown": true }, { "id": "489624550", "title": "SpeechSynthesis audio can appear to originate from another domain after fast redirect (UI/Audio Spoofing – may trick users / tricky victim)", "url": "https://issues.chromium.org/issues/489624550", "status": "Accepted", "severity": "S3-Low", "component": "Blink>Speech", "reporter": "ec...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-03-04T08:21:32+00:00", "year": 2026, "attachment_count": 13, "local_path": "issues/489624550", "has_markdown": true }, { "id": "489369089", "title": "Integer truncation in ANGLE D3D11 VertexDataManager leads to heap OOB read from compromised renderer on Windows", "url": "https://issues.chromium.org/issues/489369089", "status": "Accepted", "severity": "S3-Low", "component": "Internals>GPU>ANGLE", "reporter": "je...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-03-04T07:58:59+00:00", "year": 2026, "attachment_count": 4, "local_path": "issues/489369089", "has_markdown": true }, { "id": "489579953", "title": "OOB Read in ANGLE Metal Backend During Block-Compressed PBO Texture Upload Crashes GPU Process on Mac", "url": "https://issues.chromium.org/issues/489579953", "status": "Accepted", "severity": "S3-Low", "component": "Blink>WebGL", "reporter": "je...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-03-04T07:39:31+00:00", "year": 2026, "attachment_count": 4, "local_path": "issues/489579953", "has_markdown": true }, { "id": "489482634", "title": "OOB Write in dawn::SlabAllocatorImpl", "url": "https://issues.chromium.org/issues/489482634", "status": "Assigned", "severity": "S4-Minimal", "component": "Dawn", "reporter": "he...@gmail.com", "cve_ids": [], "bounty_amount": 16000.0, "reward_amount_meta": 16000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-03-04T07:31:29+00:00", "year": 2026, "attachment_count": 2, "local_path": "issues/489482634", "has_markdown": true }, { "id": "489494032", "title": "V8 Sandbox Bypass: Use-After-Free in JSLocale::Language", "url": "https://issues.chromium.org/issues/489494032", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript>Runtime", "reporter": "gu...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-03-04T06:11:35+00:00", "year": 2026, "attachment_count": 4, "local_path": "issues/489494032", "has_markdown": true }, { "id": "489494022", "title": "Insufficient bounds check in ANGLE Metal UBO bool conversion leads to heap OOB read in GPU process on Mac", "url": "https://issues.chromium.org/issues/489494022", "status": "Assigned", "severity": "S3-Low", "component": "Internals>GPU>ANGLE", "reporter": "je...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-03-04T02:48:30+00:00", "year": 2026, "attachment_count": 9, "local_path": "issues/489494022", "has_markdown": true }, { "id": "489280531", "title": "Maglev phi untag incorrectly treats tagged pointer as SMI", "url": "https://issues.chromium.org/issues/489280531", "status": "Assigned", "severity": "S4-Minimal", "component": "Blink>JavaScript>Compiler>Maglev", "reporter": "ch...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-03-03T11:30:45+00:00", "year": 2026, "attachment_count": 0, "local_path": "issues/489280531", "has_markdown": true }, { "id": "489109720", "title": "heap-use-after-free in VerticalTabDragHandlerImpl::ViewFromTabSlot(TabSlotView*)", "url": "https://issues.chromium.org/issues/489109720", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>Mobile>TabStrip", "reporter": "ch...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-03-03T05:43:10+00:00", "year": 2026, "attachment_count": 4, "local_path": "issues/489109720", "has_markdown": true }, { "id": "489109716", "title": "Wasm Liftoff stack corruption on eager compilation + JS interop prototype setup optimization", "url": "https://issues.chromium.org/issues/489109716", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript>WebAssembly", "reporter": "se...@gmail.com", "cve_ids": [], "bounty_amount": 50000.0, "reward_amount_meta": 50000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-03-03T00:57:32+00:00", "year": 2026, "attachment_count": 3, "local_path": "issues/489109716", "has_markdown": true }, { "id": "489071023", "title": "Transform Feedback OOB Write via Multi-Draw Cumulative Overflow", "url": "https://issues.chromium.org/issues/489071023", "status": "Assigned", "severity": "S3-Low", "component": "Internals>GPU>ANGLE", "reporter": "sw...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-03-02T16:12:22+00:00", "year": 2026, "attachment_count": 5, "local_path": "issues/489071023", "has_markdown": true }, { "id": "488803429", "title": "Heap OOB read in RTCRtpTransport", "url": "https://issues.chromium.org/issues/488803429", "status": "Verified", "severity": "S4-Minimal", "component": "Blink>WebRTC>RtpTransport", "reporter": "sh...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-03-02T06:08:09+00:00", "year": 2026, "attachment_count": 1, "local_path": "issues/488803429", "has_markdown": true }, { "id": "488927521", "title": "V8 Sandbox Bypass: Atomics TypedArray TOCTOU (Map/Length Mismatch)", "url": "https://issues.chromium.org/issues/488927521", "status": "Verified", "severity": "S4-Minimal", "component": "Blink>JavaScript", "reporter": "ki...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-03-02T06:00:17+00:00", "year": 2026, "attachment_count": 0, "local_path": "issues/488927521", "has_markdown": true }, { "id": "488803413", "title": "Turboshaft saturated use-count misclassification causes Wasm compressed/tagged base mismatch SIGSEGV", "url": "https://issues.chromium.org/issues/488803413", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript>Compiler>Turboshaft", "reporter": "le...@depthfirst.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-03-01T23:11:17+00:00", "year": 2026, "attachment_count": 0, "local_path": "issues/488803413", "has_markdown": true }, { "id": "488585504", "title": "Heap buffer overflow in CFX_Face::RenderGlyph when expanding MONO bitmap glyphs under LCD anti-aliasing", "url": "https://issues.chromium.org/issues/488585504", "status": "Assigned", "severity": "S3-Low", "component": "PDFium", "reporter": "je...@gmail.com", "cve_ids": [], "bounty_amount": 11000.0, "reward_amount_meta": 11000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-03-01T10:19:06+00:00", "year": 2026, "attachment_count": 3, "local_path": "issues/488585504", "has_markdown": true }, { "id": "488613135", "title": "Use-after-free in Dawn wire server buffer map callback due to spontaneous callback race condition", "url": "https://issues.chromium.org/issues/488613135", "status": "Assigned", "severity": "S3-Low", "component": "Dawn", "reporter": "se...@gmail.com", "cve_ids": [], "bounty_amount": 16000.0, "reward_amount_meta": 16000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-03-01T04:44:42+00:00", "year": 2026, "attachment_count": 2, "local_path": "issues/488613135", "has_markdown": true }, { "id": "488596746", "title": "Skia JPEG MPF integer overflow in SkJpegMultiPictureParameters::Make leading to OOB Read/Write", "url": "https://issues.chromium.org/issues/488596746", "status": "Assigned", "severity": "S3-Low", "component": "Internals>Images>Codecs", "reporter": "sh...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-03-01T02:08:16+00:00", "year": 2026, "attachment_count": 1, "local_path": "issues/488596746", "has_markdown": true }, { "id": "488585490", "title": "Buffer overflow in vp9_get_token_cost via crafted VideoEncoder frame sequence", "url": "https://issues.chromium.org/issues/488585490", "status": "Assigned", "severity": "S4-Minimal", "component": "Internals>Media>Video", "reporter": "sh...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-03-01T01:54:13+00:00", "year": 2026, "attachment_count": 2, "local_path": "issues/488585490", "has_markdown": true }, { "id": "488585488", "title": "Heap UAF in `network::SharedDictionaryOnDisk::SetStat`", "url": "https://issues.chromium.org/issues/488585488", "status": "Assigned", "severity": "S3-Low", "component": "Internals>Network", "reporter": "sh...@gmail.com", "cve_ids": [], "bounty_amount": 15000.0, "reward_amount_meta": 15000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-03-01T01:16:30+00:00", "year": 2026, "attachment_count": 4, "local_path": "issues/488585488", "has_markdown": true }, { "id": "488617440", "title": "Browser Process Heap-Use-After-Free in Digital Credentials API (Renderer → Browser Memory Corruption)", "url": "https://issues.chromium.org/issues/488617440", "status": "New", "severity": "S3-Low", "component": "Blink>Identity>DigitalCredentials", "reporter": "wo...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-02-28T17:16:04+00:00", "year": 2026, "attachment_count": 4, "local_path": "issues/488617440", "has_markdown": true }, { "id": "488514078", "title": "EnterFullscreen() bypasses fullscreen Permissions Policy via missing browser-side check", "url": "https://issues.chromium.org/issues/488514078", "status": "Fixed", "severity": "S3-Low", "component": "Internals>Sandbox>SiteIsolation", "reporter": "os...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-02-28T05:31:26+00:00", "year": 2026, "attachment_count": 5, "local_path": "issues/488514078", "has_markdown": true }, { "id": "488408915", "title": "SharedStorage custom-data-origin authorization bypass via stale match state", "url": "https://issues.chromium.org/issues/488408915", "status": "Fixed", "severity": "S3-Low", "component": "Blink>Storage>SharedStorage", "reporter": "oj...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-02-27T20:20:51+00:00", "year": 2026, "attachment_count": 12, "local_path": "issues/488408915", "has_markdown": true }, { "id": "488400770", "title": "Security: Cross-tab GPU memory exfiltration via uint64 to uint32 truncation in Dawn's Metal vertex buffer length tracking", "url": "https://issues.chromium.org/issues/488400770", "status": "New", "severity": "S3-Low", "component": "Dawn>Native", "reporter": "sw...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-02-27T19:47:10+00:00", "year": 2026, "attachment_count": 5, "local_path": "issues/488400770", "has_markdown": true }, { "id": "488270257", "title": "Out-of-Bounds Read in `GLTextureHolder::Initialize` via Zero-Size `CreateSharedImageWithData` IPC in GPU Process", "url": "https://issues.chromium.org/issues/488270257", "status": "Assigned", "severity": "S3-Low", "component": "Internals>GPU>Internals", "reporter": "se...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-02-27T17:41:25+00:00", "year": 2026, "attachment_count": 6, "local_path": "issues/488270257", "has_markdown": true }, { "id": "488270255", "title": "css.ResolveValues() does not check validity of reserved values", "url": "https://issues.chromium.org/issues/488270255", "status": "Fixed", "severity": "S3-Low", "component": "Blink>CSS", "reporter": "he...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-02-27T17:34:27+00:00", "year": 2026, "attachment_count": 7, "local_path": "issues/488270255", "has_markdown": true }, { "id": "488292218", "title": "Not preflighting message/ad-auction-trusted-signals-request breaks CSRF prevention features", "url": "https://issues.chromium.org/issues/488292218", "status": "Fixed", "severity": "S3-Low", "component": "Blink>InterestGroups", "reporter": "gl...@apollographql.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-02-27T16:44:31+00:00", "year": 2026, "attachment_count": 0, "local_path": "issues/488292218", "has_markdown": true }, { "id": "488268854", "title": "Stack out-of-bounds write in CreateBufferFromHandle: unchecked DMA-BUF plane count from compromised renderer overflows fixed-size gbm_import_fd_modifier_data arrays in GPU process.", "url": "https://issues.chromium.org/issues/488268854", "status": "Assigned", "severity": "S3-Low", "component": "Internals>GPU>Internals", "reporter": "je...@gmail.com", "cve_ids": [], "bounty_amount": 11000.0, "reward_amount_meta": 11000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-02-27T15:40:25+00:00", "year": 2026, "attachment_count": 3, "local_path": "issues/488268854", "has_markdown": true }, { "id": "488306299", "title": "Turboshaft WLE correctness bug: stale StringPrepareForGetCodeUnit result survives calls, leaks V8 heap pointers via charCodeAt", "url": "https://issues.chromium.org/issues/488306299", "status": "Fixed", "severity": "S3-Low", "component": "Blink>JavaScript", "reporter": "fl...@outlook.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-02-27T14:54:48+00:00", "year": 2026, "attachment_count": 2, "local_path": "issues/488306299", "has_markdown": true }, { "id": "488072253", "title": "V8 Sandbox escape via String::Value::Value unsigned overflow", "url": "https://issues.chromium.org/issues/488072253", "status": "Verified", "severity": "S3-Low", "component": "Blink>JavaScript>Runtime", "reporter": "h2...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-02-27T13:22:32+00:00", "year": 2026, "attachment_count": 4, "local_path": "issues/488072253", "has_markdown": true }, { "id": "488188176", "title": "Security: heap-use-after-free in blink::WebAudioSourceProviderImpl::TeeFilter::Render", "url": "https://issues.chromium.org/issues/488188176", "status": "Accepted", "severity": "S3-Low", "component": "Blink>WebAudio", "reporter": "zh...@gmail.com", "cve_ids": [], "bounty_amount": 8000.0, "reward_amount_meta": 8000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-02-27T10:49:34+00:00", "year": 2026, "attachment_count": 3, "local_path": "issues/488188176", "has_markdown": true }, { "id": "488188166", "title": "UAF in blink RuleMap", "url": "https://issues.chromium.org/issues/488188166", "status": "Assigned", "severity": "S3-Low", "component": "Blink>CSS", "reporter": "he...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-02-27T07:55:23+00:00", "year": 2026, "attachment_count": 4, "local_path": "issues/488188166", "has_markdown": true }, { "id": "488089244", "title": "OOB in LinearTimingFunction::GetValue via Single-Point Linear Easing Deserialization in GPU Process", "url": "https://issues.chromium.org/issues/488089244", "status": "Assigned", "severity": "Unknown", "component": "Internals>Services>Viz", "reporter": "se...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-02-27T02:59:01+00:00", "year": 2026, "attachment_count": 5, "local_path": "issues/488089244", "has_markdown": true }, { "id": "487977696", "title": "ANGLE D3D11 drawLineLoop Integer Overflow causes GPU OOB Write", "url": "https://issues.chromium.org/issues/487977696", "status": "Assigned", "severity": "S3-Low", "component": "Internals>GPU>ANGLE", "reporter": "ci...@gmail.com", "cve_ids": [], "bounty_amount": 23000.0, "reward_amount_meta": 23000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-02-26T14:08:32+00:00", "year": 2026, "attachment_count": 2, "local_path": "issues/487977696", "has_markdown": true }, { "id": "487768779", "title": "Sandbox Escape: Arbitrary Local File Read via Missing CanReadRequestBody Validation in CreateNewWindow's opener_suppressed Path", "url": "https://issues.chromium.org/issues/487768779", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>Navigation", "reporter": "je...@gmail.com", "cve_ids": [], "bounty_amount": 26000.0, "reward_amount_meta": 26000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-02-26T13:31:43+00:00", "year": 2026, "attachment_count": 5, "local_path": "issues/487768779", "has_markdown": true }, { "id": "487746373", "title": "Concurrent GSAB Growth Causes OOB Write in Key Enumeration", "url": "https://issues.chromium.org/issues/487746373", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript>Runtime", "reporter": "qy...@gmail.com", "cve_ids": [], "bounty_amount": 8000.0, "reward_amount_meta": 8000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-02-26T10:00:40+00:00", "year": 2026, "attachment_count": 4, "local_path": "issues/487746373", "has_markdown": true }, { "id": "487768771", "title": "Debug check failed: IsInBounds(index).", "url": "https://issues.chromium.org/issues/487768771", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript>Runtime", "reporter": "qy...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-02-26T09:05:48+00:00", "year": 2026, "attachment_count": 2, "local_path": "issues/487768771", "has_markdown": true }, { "id": "487863654", "title": "One click Chrome Sanitizer API bypass via xlink:href:x", "url": "https://issues.chromium.org/issues/487863654", "status": "Accepted", "severity": "S4-Minimal", "component": "Blink>SecurityFeature>SanitizerAPI", "reporter": "ne...@akorlith.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-02-26T06:11:19+00:00", "year": 2026, "attachment_count": 2, "local_path": "issues/487863654", "has_markdown": true }, { "id": "487755344", "title": "OOB in GPU process: Missing negative length validation in Bucket::GetAsStrings.", "url": "https://issues.chromium.org/issues/487755344", "status": "Accepted", "severity": "S4-Minimal", "component": "Internals>GPU>ANGLE", "reporter": "se...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-02-26T04:35:00+00:00", "year": 2026, "attachment_count": 0, "local_path": "issues/487755344", "has_markdown": true }, { "id": "487821920", "title": "[HIGH] nameConstraints: excluded dNSName can be bypassed with wildcard SAN", "url": "https://issues.chromium.org/issues/487821920", "status": "Accepted", "severity": "S3-Low", "component": "BoringSSL", "reporter": "ko...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-02-26T02:59:14+00:00", "year": 2026, "attachment_count": 3, "local_path": "issues/487821920", "has_markdown": true }, { "id": "487820706", "title": "crypto/x509's URI name constraints parser is too permissive", "url": "https://issues.chromium.org/issues/487820706", "status": "Accepted", "severity": "S3-Low", "component": "BoringSSL>Crypto>X509", "reporter": "da...@google.com", "cve_ids": [ "CVE-2024-45341" ], "bounty_amount": 1000.0, "reward_amount_meta": null, "public_issue": true, "inclusion_reason": "award_text", "award_text_found": true, "created_date": "2026-02-26T02:50:33+00:00", "year": 2026, "attachment_count": 4, "local_path": "issues/487820706", "has_markdown": true }, { "id": "487522152", "title": "Dawn QueueWriteBufferXl / QueueWriteTextureXl OOB Heap Read via GetSourceData() Fast Path", "url": "https://issues.chromium.org/issues/487522152", "status": "Accepted", "severity": "S4-Minimal", "component": "Dawn", "reporter": "gr...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-02-25T19:22:32+00:00", "year": 2026, "attachment_count": 10, "local_path": "issues/487522152", "has_markdown": true }, { "id": "487357842", "title": "OOB in WaveShaper of WebAudio", "url": "https://issues.chromium.org/issues/487357842", "status": "Assigned", "severity": "S4-Minimal", "component": "Blink>WebAudio", "reporter": "he...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-02-25T13:25:29+00:00", "year": 2026, "attachment_count": 2, "local_path": "issues/487357842", "has_markdown": true }, { "id": "487495466", "title": "OOB Write in FFTConvolver of WebAudio", "url": "https://issues.chromium.org/issues/487495466", "status": "Assigned", "severity": "S4-Minimal", "component": "Blink>WebAudio", "reporter": "he...@gmail.com", "cve_ids": [], "bounty_amount": 11000.0, "reward_amount_meta": 11000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-02-25T13:06:44+00:00", "year": 2026, "attachment_count": 2, "local_path": "issues/487495466", "has_markdown": true }, { "id": "487357841", "title": "Reentrant socket destruction during ThrottlingP2PNetworkInterceptor timer callback leads to heap-use-after-free in the Network Service (browser process on Android)", "url": "https://issues.chromium.org/issues/487357841", "status": "Assigned", "severity": "S3-Low", "component": "Blink>WebRTC>Network", "reporter": "je...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-02-25T12:41:47+00:00", "year": 2026, "attachment_count": 10, "local_path": "issues/487357841", "has_markdown": true }, { "id": "487357838", "title": "Use-after-free in TextInputClientMac::GetFirstRectForRange via nested RunLoop reentry leads to browser process crash from a compromised renderer", "url": "https://issues.chromium.org/issues/487357838", "status": "Accepted", "severity": "S3-Low", "component": "Internals", "reporter": "je...@gmail.com", "cve_ids": [], "bounty_amount": 36000.0, "reward_amount_meta": 36000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-02-25T12:24:49+00:00", "year": 2026, "attachment_count": 1, "local_path": "issues/487357838", "has_markdown": true }, { "id": "487568011", "title": "WebInstallService InstallFromElement() bypasses WEB_APP_INSTALLATION permission prompt via renderer-callable Mojo method", "url": "https://issues.chromium.org/issues/487568011", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>WebAppInstalls", "reporter": "os...@gmail.com", "cve_ids": [], "bounty_amount": 4000.0, "reward_amount_meta": 4000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-02-25T12:12:58+00:00", "year": 2026, "attachment_count": 4, "local_path": "issues/487568011", "has_markdown": true }, { "id": "487564032", "title": "Refactor _unfencedTop MPArch code path", "url": "https://issues.chromium.org/issues/487564032", "status": "Accepted", "severity": "S1-High", "component": "Blink>FencedFrames, UI>Browser>Navigation", "reporter": "gt...@chromium.org", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": null, "public_issue": true, "inclusion_reason": "award_text", "award_text_found": true, "created_date": "2026-02-25T11:50:20+00:00", "year": 2026, "attachment_count": 5, "local_path": "issues/487564032", "has_markdown": true }, { "id": "487444472", "title": "Security: Heap-use-after-free in AILanguageModel::PromptState::OnResponse", "url": "https://issues.chromium.org/issues/487444472", "status": "Assigned", "severity": "S3-Low", "component": "Blink>AI>Prompt", "reporter": "me...@gmail.com", "cve_ids": [], "bounty_amount": 11000.0, "reward_amount_meta": 11000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-02-25T11:34:01+00:00", "year": 2026, "attachment_count": 4, "local_path": "issues/487444472", "has_markdown": true }, { "id": "487444459", "title": "OOB Write in CalculateNPOTTwiddleSparsePageMap3D cause android chrome gpu crash", "url": "https://issues.chromium.org/issues/487444459", "status": "New", "severity": "S3-Low", "component": "Internals>GPU>ANGLE", "reporter": "ha...@gmail.com", "cve_ids": [], "bounty_amount": 32000.0, "reward_amount_meta": 32000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-02-25T05:59:24+00:00", "year": 2026, "attachment_count": 3, "local_path": "issues/487444459", "has_markdown": true }, { "id": "487471101", "title": "Sandboxed iframe bypasses allow-popups restriction via CreateNewWindow Mojo IPC — browser has zero sandbox enforcement", "url": "https://issues.chromium.org/issues/487471101", "status": "Assigned", "severity": "S3-Low", "component": "Internals>Sandbox>SiteIsolation", "reporter": "os...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-02-25T05:18:42+00:00", "year": 2026, "attachment_count": 6, "local_path": "issues/487471101", "has_markdown": true }, { "id": "487336007", "title": "Detached ArrayBuffer UAF after AB view tracking was enabled", "url": "https://issues.chromium.org/issues/487336007", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript", "reporter": "er...@gmail.com", "cve_ids": [], "bounty_amount": 8000.0, "reward_amount_meta": 8000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-02-25T00:32:45+00:00", "year": 2026, "attachment_count": 3, "local_path": "issues/487336007", "has_markdown": true }, { "id": "487338366", "title": "Use-after-free in CreateNewWindow via SINGLETON_TAB disposition leads to sandbox escape", "url": "https://issues.chromium.org/issues/487338366", "status": "Assigned", "severity": "S3-Low", "component": "Blink>WindowDialog", "reporter": "je...@gmail.com", "cve_ids": [], "bounty_amount": 90000.0, "reward_amount_meta": 90000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-02-25T00:23:29+00:00", "year": 2026, "attachment_count": 9, "local_path": "issues/487338366", "has_markdown": true }, { "id": "487300831", "title": "VerifyInitiatorOrigin() skips HostsOrigin() process lock check for opaque origins in error documents and MHTML subframes", "url": "https://issues.chromium.org/issues/487300831", "status": "Accepted", "severity": "S3-Low", "component": "UI>Browser>Navigation", "reporter": "os...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-02-24T18:19:32+00:00", "year": 2026, "attachment_count": 6, "local_path": "issues/487300831", "has_markdown": true }, { "id": "487213150", "title": "V8 Sandbox Bypass: AAW/PC control via type confusion for wasm exports in DebugBreakTrampoline", "url": "https://issues.chromium.org/issues/487213150", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript>Runtime", "reporter": "kr...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-02-24T16:56:28+00:00", "year": 2026, "attachment_count": 2, "local_path": "issues/487213150", "has_markdown": true }, { "id": "487208468", "title": "Integer overflow in ANGLE TextureVk::reinitImageAsRenderable leads to heap buffer overflow in GPU process", "url": "https://issues.chromium.org/issues/487208468", "status": "Accepted", "severity": "S3-Low", "component": "Internals>GPU>Vulkan", "reporter": "yu...@gmail.com", "cve_ids": [], "bounty_amount": 17000.0, "reward_amount_meta": 17000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-02-24T16:16:34+00:00", "year": 2026, "attachment_count": 2, "local_path": "issues/487208468", "has_markdown": true }, { "id": "487259772", "title": "Out-of-bounds heap read in VP9 encoder via WebCodecs VideoEncoder dimension reconfiguration", "url": "https://issues.chromium.org/issues/487259772", "status": "Accepted", "severity": "S3-Low", "component": "Blink>Media>WebCodecs", "reporter": "ca...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-02-24T15:50:29+00:00", "year": 2026, "attachment_count": 5, "local_path": "issues/487259772", "has_markdown": true }, { "id": "487117772", "title": "UAF in blink::PendingInvalidations", "url": "https://issues.chromium.org/issues/487117772", "status": "Assigned", "severity": "S3-Low", "component": "Blink>CSS", "reporter": "he...@gmail.com", "cve_ids": [], "bounty_amount": 10000.0, "reward_amount_meta": 10000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-02-24T12:58:15+00:00", "year": 2026, "attachment_count": 2, "local_path": "issues/487117772", "has_markdown": true }, { "id": "486972661", "title": "Heap buffer overflow in ANGLE copyImageDataToBuffer", "url": "https://issues.chromium.org/issues/486972661", "status": "Assigned", "severity": "S3-Low", "component": "Internals>GPU>ANGLE", "reporter": "oj...@gmail.com", "cve_ids": [], "bounty_amount": 15000.0, "reward_amount_meta": 15000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-02-23T22:11:58+00:00", "year": 2026, "attachment_count": 7, "local_path": "issues/486972661", "has_markdown": true }, { "id": "486927780", "title": "Chrome V8 Inspector InjectedScript Use-After-Free Vulnerability", "url": "https://issues.chromium.org/issues/486927780", "status": "Assigned", "severity": "S3-Low", "component": "Platform>DevTools", "reporter": "tn...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-02-23T20:12:13+00:00", "year": 2026, "attachment_count": 4, "local_path": "issues/486927780", "has_markdown": true }, { "id": "486657483", "title": "Incorrect Maglev assumption leading to SIGSEGV ", "url": "https://issues.chromium.org/issues/486657483", "status": "Assigned", "severity": "S4-Minimal", "component": "Blink>JavaScript>Compiler>Maglev", "reporter": "er...@gmail.com", "cve_ids": [], "bounty_amount": 55000.0, "reward_amount_meta": 55000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-02-23T14:13:32+00:00", "year": 2026, "attachment_count": 4, "local_path": "issues/486657483", "has_markdown": true }, { "id": "486761172", "title": "Chrome on Windows can be tricked into saving a dangerous .url InternetShortcut without the .download", "url": "https://issues.chromium.org/issues/486761172", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>Downloads", "reporter": "ra...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-02-23T14:05:34+00:00", "year": 2026, "attachment_count": 2, "local_path": "issues/486761172", "has_markdown": true }, { "id": "486761170", "title": "`WindowOpenDisposition` should use mojo enum", "url": "https://issues.chromium.org/issues/486761170", "status": "Accepted", "severity": "S0-Critical", "component": "Internals", "reporter": "ha...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": null, "public_issue": true, "inclusion_reason": "award_text", "award_text_found": true, "created_date": "2026-02-23T12:16:26+00:00", "year": 2026, "attachment_count": 4, "local_path": "issues/486761170", "has_markdown": true }, { "id": "486551890", "title": "Debug check failed: Holder v8::internal::TrustedCast(Holder, SourceLocation) [To = v8::internal::SeqTwoByteString, From = v8::internal::String, Holder = v8::internal::Handl e] in src/json/json-parser.h, line 468", "url": "https://issues.chromium.org/issues/486551890", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript>Runtime", "reporter": "al...@goodmanemail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-02-22T12:23:52+00:00", "year": 2026, "attachment_count": 2, "local_path": "issues/486551890", "has_markdown": true }, { "id": "486498791", "title": "Signed integer overflow in UniqueTimestampCounter::Add leads to heap buffer underflow via negative array index", "url": "https://issues.chromium.org/issues/486498791", "status": "Accepted", "severity": "S3-Low", "component": "Blink>WebRTC>Video", "reporter": "je...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-02-22T11:40:33+00:00", "year": 2026, "attachment_count": 0, "local_path": "issues/486498791", "has_markdown": true }, { "id": "486505680", "title": "OOB Read in WebGL2 clearBufferuiv", "url": "https://issues.chromium.org/issues/486505680", "status": "Assigned", "severity": "S3-Low", "component": "Blink>WebGL", "reporter": "fa...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-02-22T08:48:06+00:00", "year": 2026, "attachment_count": 2, "local_path": "issues/486505680", "has_markdown": true }, { "id": "486505678", "title": "UAF in OnGpuControlReturnData", "url": "https://issues.chromium.org/issues/486505678", "status": "New", "severity": "S3-Low", "component": "Dawn", "reporter": "he...@gmail.com", "cve_ids": [], "bounty_amount": 8000.0, "reward_amount_meta": 8000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-02-22T08:41:59+00:00", "year": 2026, "attachment_count": 5, "local_path": "issues/486505678", "has_markdown": true }, { "id": "486495143", "title": "Use-After-Free in LegacyStatsCollector::AddCertificateReports via Duplicate DTLS Certificate Fingerprints Leads to Renderer Remote Code Execution", "url": "https://issues.chromium.org/issues/486495143", "status": "Assigned", "severity": "S3-Low", "component": "Blink>WebRTC", "reporter": "je...@gmail.com", "cve_ids": [], "bounty_amount": 11000.0, "reward_amount_meta": 11000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-02-22T06:14:20+00:00", "year": 2026, "attachment_count": 3, "local_path": "issues/486495143", "has_markdown": true }, { "id": "486506202", "title": "Uninitialized alpha-plane padding in VP9-with-alpha external frame buffer decode causes renderer heap data disclosure via WebCodecs VideoFrame.copyTo(codedRect)", "url": "https://issues.chromium.org/issues/486506202", "status": "Accepted", "severity": "S3-Low", "component": "Blink>Media>WebCodecs", "reporter": "gi...@octane.security", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-02-22T03:52:04+00:00", "year": 2026, "attachment_count": 7, "local_path": "issues/486506202", "has_markdown": true }, { "id": "486421954", "title": "Use-after-free in WebRTC ProxySink via unsignaled-to-signaled stream promotion leads to renderer compromise", "url": "https://issues.chromium.org/issues/486421954", "status": "New", "severity": "S3-Low", "component": "Blink>WebRTC", "reporter": "je...@gmail.com", "cve_ids": [], "bounty_amount": 11000.0, "reward_amount_meta": 11000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-02-22T00:39:10+00:00", "year": 2026, "attachment_count": 0, "local_path": "issues/486421954", "has_markdown": true }, { "id": "486421953", "title": "Use-after-free in WebRTC dav1d AV1 decoder due to missing buffer lifetime management leads to heap read of freed memory", "url": "https://issues.chromium.org/issues/486421953", "status": "Assigned", "severity": "S4-Minimal", "component": "Blink>WebRTC", "reporter": "je...@gmail.com", "cve_ids": [], "bounty_amount": 11000.0, "reward_amount_meta": 11000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-02-22T00:24:19+00:00", "year": 2026, "attachment_count": 2, "local_path": "issues/486421953", "has_markdown": true }, { "id": "486349161", "title": "Stack buffer overflow in WebRTC ResamplerHelper::MaybeResample leads to renderer process crash via crafted SDP and Insertable Streams", "url": "https://issues.chromium.org/issues/486349161", "status": "New", "severity": "S3-Low", "component": "Blink>WebRTC", "reporter": "je...@gmail.com", "cve_ids": [], "bounty_amount": 11000.0, "reward_amount_meta": 11000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-02-21T13:39:05+00:00", "year": 2026, "attachment_count": 0, "local_path": "issues/486349161", "has_markdown": true }, { "id": "486202614", "title": "Out-of-Bounds Read in EditContext::DeleteCurrentSelection via Stale Selection Offsets", "url": "https://issues.chromium.org/issues/486202614", "status": "Verified", "severity": "S3-Low", "component": "Blink>Editing>EditContext", "reporter": "je...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-02-21T00:07:39+00:00", "year": 2026, "attachment_count": 0, "local_path": "issues/486202614", "has_markdown": true }, { "id": "486167751", "title": "WebNN LiteRT: heap-buffer-overflow write in XNNPACK subconv2d via convTranspose2d", "url": "https://issues.chromium.org/issues/486167751", "status": "Verified", "severity": "S3-Low", "component": "Blink>WebML", "reporter": "to...@gmail.com", "cve_ids": [], "bounty_amount": 25000.0, "reward_amount_meta": 25000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-02-20T16:43:16+00:00", "year": 2026, "attachment_count": 3, "local_path": "issues/486167751", "has_markdown": true }, { "id": "486084137", "title": "V8 Sandbox Bypass: controlled OOB write to `Isolate` via RegExp source corruption during tier-up.", "url": "https://issues.chromium.org/issues/486084137", "status": "Verified", "severity": "S3-Low", "component": "Blink>JavaScript>Regexp", "reporter": "ma...@advert.com.au", "cve_ids": [], "bounty_amount": 20000.0, "reward_amount_meta": 20000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-02-20T15:43:29+00:00", "year": 2026, "attachment_count": 4, "local_path": "issues/486084137", "has_markdown": true }, { "id": "486079015", "title": ".lnk File Download Bypass Using \"Save As\" Link (Bypass of #444803530)", "url": "https://issues.chromium.org/issues/486079015", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>Downloads", "reporter": "mu...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-02-20T15:04:09+00:00", "year": 2026, "attachment_count": 2, "local_path": "issues/486079015", "has_markdown": true }, { "id": "485935314", "title": "Use-after-free in MIDIPortMap iterator due to untracked raw pointers surviving Oilpan compaction leads to renderer crash", "url": "https://issues.chromium.org/issues/485935314", "status": "Assigned", "severity": "S3-Low", "component": "Blink>WebMIDI", "reporter": "je...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-02-20T09:37:05+00:00", "year": 2026, "attachment_count": 0, "local_path": "issues/485935314", "has_markdown": true }, { "id": "485935305", "title": "Arbitrary Memory Read/Write via WebGLBuffer Created During Context Loss Combined with PBO Operations", "url": "https://issues.chromium.org/issues/485935305", "status": "New", "severity": "S4-Minimal", "component": "Internals>GPU>Internals", "reporter": "je...@gmail.com", "cve_ids": [], "bounty_amount": 90000.0, "reward_amount_meta": 90000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-02-20T04:00:18+00:00", "year": 2026, "attachment_count": 4, "local_path": "issues/485935305", "has_markdown": true }, { "id": "485945891", "title": "memory corruption in glsl::glslTypeGen::GetConstantByType leads to Android gpu crash", "url": "https://issues.chromium.org/issues/485945891", "status": "New", "severity": "S3-Low", "component": "Internals>GPU>Internals", "reporter": "ha...@gmail.com", "cve_ids": [], "bounty_amount": 32000.0, "reward_amount_meta": 32000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-02-20T03:07:32+00:00", "year": 2026, "attachment_count": 0, "local_path": "issues/485945891", "has_markdown": true }, { "id": "485935302", "title": "Use-After-Free in WebGPU Worker Multithreaded Dawn Wire Path Leading to Potential Remote Code Execution", "url": "https://issues.chromium.org/issues/485935302", "status": "Verified", "severity": "S3-Low", "component": "Dawn", "reporter": "je...@gmail.com", "cve_ids": [], "bounty_amount": 4000.0, "reward_amount_meta": 4000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-02-20T02:48:35+00:00", "year": 2026, "attachment_count": 0, "local_path": "issues/485935302", "has_markdown": true }, { "id": "485785246", "title": "static `import` declarations in service workers do not respect `worker-src` CSP directive", "url": "https://issues.chromium.org/issues/485785246", "status": "Fixed", "severity": "S3-Low", "component": "Blink>SecurityFeature>ContentSecurityPolicy", "reporter": "al...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-02-19T14:03:44+00:00", "year": 2026, "attachment_count": 3, "local_path": "issues/485785246", "has_markdown": true }, { "id": "485677960", "title": "Use-After-Free in Canvas2D beginLayer Filter Parsing Leads to Renderer Crash and Potential RCE", "url": "https://issues.chromium.org/issues/485677960", "status": "Verified", "severity": "S4-Minimal", "component": "Blink>Canvas", "reporter": "je...@gmail.com", "cve_ids": [], "bounty_amount": 50000.0, "reward_amount_meta": 50000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-02-19T10:22:32+00:00", "year": 2026, "attachment_count": 3, "local_path": "issues/485677960", "has_markdown": true }, { "id": "485784597", "title": "V8 Sandbox Bypass: V8 JSPI StackMemory use-after-free via EPT entry not invalidated on retirement", "url": "https://issues.chromium.org/issues/485784597", "status": "Accepted", "severity": "S3-Low", "component": "Blink>JavaScript>WebAssembly", "reporter": "ad...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-02-19T10:02:40+00:00", "year": 2026, "attachment_count": 8, "local_path": "issues/485784597", "has_markdown": true }, { "id": "485683110", "title": "Heap Buffer Overflow in BackgroundReadback GPU Readback with Non-Zero visibleRect Offset Leads to Renderer Process Memory Corruption", "url": "https://issues.chromium.org/issues/485683110", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Media>WebCodecs", "reporter": "je...@gmail.com", "cve_ids": [], "bounty_amount": 50000.0, "reward_amount_meta": 50000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-02-19T07:52:40+00:00", "year": 2026, "attachment_count": 6, "local_path": "issues/485683110", "has_markdown": true }, { "id": "485683099", "title": "Missing Payload Length Check in DTLS-SRTP Send Path Leads to Heap Out-of-Bounds Read in the Renderer Process", "url": "https://issues.chromium.org/issues/485683099", "status": "Verified", "severity": "S4-Minimal", "component": "Internals>Core", "reporter": "je...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-02-19T02:23:26+00:00", "year": 2026, "attachment_count": 0, "local_path": "issues/485683099", "has_markdown": true }, { "id": "485622239", "title": "ANGLE Vulkan reinitImageAsRenderable uint32 Overflow causes GPU OOB Write", "url": "https://issues.chromium.org/issues/485622239", "status": "New", "severity": "S3-Low", "component": "Internals>GPU>ANGLE", "reporter": "ci...@gmail.com", "cve_ids": [], "bounty_amount": 33000.0, "reward_amount_meta": 33000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-02-18T21:13:50+00:00", "year": 2026, "attachment_count": 1, "local_path": "issues/485622239", "has_markdown": true }, { "id": "485397139", "title": "Use-After-Free in WebAudioMediaStreamAudioSink Destructor via Data Race with OnSetFormat", "url": "https://issues.chromium.org/issues/485397139", "status": "Assigned", "severity": "S3-Low", "component": "Blink>MediaStream", "reporter": "je...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-02-18T16:40:37+00:00", "year": 2026, "attachment_count": 0, "local_path": "issues/485397139", "has_markdown": true }, { "id": "485397284", "title": "Heap Buffer Overflow in ScriptProcessorHandler::Process via Configurable Render Quantum Leads to Out-of-Bounds Read and Write", "url": "https://issues.chromium.org/issues/485397284", "status": "Assigned", "severity": "S4-Minimal", "component": "Blink>WebAudio", "reporter": "je...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-02-18T16:06:16+00:00", "year": 2026, "attachment_count": 0, "local_path": "issues/485397284", "has_markdown": true }, { "id": "485397283", "title": "Out-of-Bounds Read in Biquad::Process on macOS", "url": "https://issues.chromium.org/issues/485397283", "status": "Assigned", "severity": "S3-Low", "component": "Blink>WebAudio", "reporter": "je...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-02-18T15:26:16+00:00", "year": 2026, "attachment_count": 0, "local_path": "issues/485397283", "has_markdown": true }, { "id": "485292589", "title": "Heap Buffer Overflow in RealtimeAnalyser::WriteInput via Configurable Render Quantum Leads to Renderer Remote Code Execution", "url": "https://issues.chromium.org/issues/485292589", "status": "Assigned", "severity": "S4-Minimal", "component": "Blink>WebAudio", "reporter": "je...@gmail.com", "cve_ids": [], "bounty_amount": 11000.0, "reward_amount_meta": 11000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-02-18T14:51:16+00:00", "year": 2026, "attachment_count": 0, "local_path": "issues/485292589", "has_markdown": true }, { "id": "485397279", "title": "Security: Heap-use-after-free in SecureChannelImpl::OnDecryptedResponse", "url": "https://issues.chromium.org/issues/485397279", "status": "Assigned", "severity": "S3-Low", "component": "Privacy", "reporter": "me...@gmail.com", "cve_ids": [], "bounty_amount": 11000.0, "reward_amount_meta": 11000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-02-18T13:38:36+00:00", "year": 2026, "attachment_count": 2, "local_path": "issues/485397279", "has_markdown": true }, { "id": "485286897", "title": "Intl.Collator/PluralRules/DateTimeFormat still use Managed<>->raw() not ->get()", "url": "https://issues.chromium.org/issues/485286897", "status": "Verified", "severity": "S3-Low", "component": "Blink>JavaScript>Runtime", "reporter": "k1...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-02-18T06:17:58+00:00", "year": 2026, "attachment_count": 0, "local_path": "issues/485286897", "has_markdown": true }, { "id": "485267831", "title": "Debug check failed: visited_->find(lit) != visited_->end()", "url": "https://issues.chromium.org/issues/485267831", "status": "Assigned", "severity": "S4-Minimal", "component": "Blink>JavaScript>Parser", "reporter": "qy...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-02-18T02:51:22+00:00", "year": 2026, "attachment_count": 1, "local_path": "issues/485267831", "has_markdown": true }, { "id": "485287859", "title": "Authorization Bypass in Target.exposeDevToolsProtocol via Missing Early Return", "url": "https://issues.chromium.org/issues/485287859", "status": "Assigned", "severity": "S3-Low", "component": "Platform>DevTools", "reporter": "oj...@gmail.com", "cve_ids": [], "bounty_amount": 4000.0, "reward_amount_meta": 4000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-02-17T20:17:31+00:00", "year": 2026, "attachment_count": 16, "local_path": "issues/485287859", "has_markdown": true }, { "id": "485203821", "title": "Signed Integer overflow in H264 SEI Parsing", "url": "https://issues.chromium.org/issues/485203821", "status": "Accepted", "severity": "S3-Low", "component": "Internals>Media", "reporter": "b....@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-02-17T18:23:49+00:00", "year": 2026, "attachment_count": 1, "local_path": "issues/485203821", "has_markdown": true }, { "id": "485212874", "title": "Integer Overflow in H265 Slice Header Parsing", "url": "https://issues.chromium.org/issues/485212874", "status": "Accepted", "severity": "S3-Low", "component": "Internals>Media", "reporter": "am...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-02-17T17:35:08+00:00", "year": 2026, "attachment_count": 1, "local_path": "issues/485212874", "has_markdown": true }, { "id": "485115554", "title": "Integer Overflow in H265 SEI Parsing", "url": "https://issues.chromium.org/issues/485115554", "status": "Accepted", "severity": "S3-Low", "component": "Internals>Media", "reporter": "am...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-02-17T17:14:50+00:00", "year": 2026, "attachment_count": 1, "local_path": "issues/485115554", "has_markdown": true }, { "id": "485152421", "title": "use-after-poison write in WasmFunctionBuilder::WriteBody", "url": "https://issues.chromium.org/issues/485152421", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript>WebAssembly", "reporter": "qy...@gmail.com", "cve_ids": [], "bounty_amount": 10000.0, "reward_amount_meta": 10000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-02-17T17:01:43+00:00", "year": 2026, "attachment_count": 6, "local_path": "issues/485152421", "has_markdown": true }, { "id": "484983991", "title": "Heap-buffer-overflow in Skia PathStencilCoverOp via AtlasPathRenderer integer overflow", "url": "https://issues.chromium.org/issues/484983991", "status": "New", "severity": "S3-Low", "component": "Internals>Skia", "reporter": "si...@gmail.com", "cve_ids": [], "bounty_amount": 32000.0, "reward_amount_meta": 32000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-02-17T10:25:05+00:00", "year": 2026, "attachment_count": 1, "local_path": "issues/484983991", "has_markdown": true }, { "id": "485056787", "title": "UAF in RouteMatching", "url": "https://issues.chromium.org/issues/485056787", "status": "Assigned", "severity": "S3-Low", "component": "Internals>Images>Codecs", "reporter": "he...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-02-17T06:38:48+00:00", "year": 2026, "attachment_count": 2, "local_path": "issues/485056787", "has_markdown": true }, { "id": "484946544", "title": "[PassAsSpan] ArrayBuffer.transfer() re-entrancy UAF / SEGV in TextDecoder.decode", "url": "https://issues.chromium.org/issues/484946544", "status": "Assigned", "severity": "S4-Minimal", "component": "Blink>TextEncoding", "reporter": "pk...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-02-17T04:42:56+00:00", "year": 2026, "attachment_count": 1, "local_path": "issues/484946544", "has_markdown": true }, { "id": "484986863", "title": "ANGLE Metal ProvokingVertexHelper uint32 Overflow causes GPU OOB Write", "url": "https://issues.chromium.org/issues/484986863", "status": "Assigned", "severity": "S3-Low", "component": "Internals>GPU>ANGLE", "reporter": "ci...@gmail.com", "cve_ids": [], "bounty_amount": 4000.0, "reward_amount_meta": 4000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-02-16T18:18:02+00:00", "year": 2026, "attachment_count": 3, "local_path": "issues/484986863", "has_markdown": true }, { "id": "484811719", "title": "Heap-buffer-overflow in CSSUnparsedValue::FindVariableName", "url": "https://issues.chromium.org/issues/484811719", "status": "Assigned", "severity": "S3-Low", "component": "Unknown", "reporter": "he...@gmail.com", "cve_ids": [], "bounty_amount": 11000.0, "reward_amount_meta": 11000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-02-16T06:07:46+00:00", "year": 2026, "attachment_count": 2, "local_path": "issues/484811719", "has_markdown": true }, { "id": "484751092", "title": "Heap-buffer-overflow in StyleCascade::ConsumeVariableName", "url": "https://issues.chromium.org/issues/484751092", "status": "Assigned", "severity": "S3-Low", "component": "Unknown", "reporter": "he...@gmail.com", "cve_ids": [], "bounty_amount": 11000.0, "reward_amount_meta": 11000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-02-16T06:06:31+00:00", "year": 2026, "attachment_count": 2, "local_path": "issues/484751092", "has_markdown": true }, { "id": "484789568", "title": "V8: Instruction Stream Corruption in Sparkplug+ via Missing `is_short_builtin_calls_enabled()` Guard in `Runtime_PatchLoadICUninitializedBaseline`", "url": "https://issues.chromium.org/issues/484789568", "status": "Verified", "severity": "S3-Low", "component": "Blink>JavaScript>Compiler>Sparkplug", "reporter": "ca...@gmail.com", "cve_ids": [], "bounty_amount": 11000.0, "reward_amount_meta": 11000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-02-16T03:39:45+00:00", "year": 2026, "attachment_count": 1, "local_path": "issues/484789568", "has_markdown": true }, { "id": "484756087", "title": "Implement an IR for ANGLE's translator", "url": "https://issues.chromium.org/issues/484756087", "status": "Accepted", "severity": "S1-High", "component": "Unknown", "reporter": "sy...@chromium.org", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": null, "public_issue": true, "inclusion_reason": "award_text", "award_text_found": true, "created_date": "2026-02-15T17:34:00+00:00", "year": 2026, "attachment_count": 2, "local_path": "issues/484756087", "has_markdown": true }, { "id": "484547633", "title": "VideoFrame Mojo deserialization accepts negative stride → OOB read in video encoders \n", "url": "https://issues.chromium.org/issues/484547633", "status": "Accepted", "severity": "S3-Low", "component": "Internals>Media", "reporter": "ha...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-02-15T10:17:00+00:00", "year": 2026, "attachment_count": 11, "local_path": "issues/484547633", "has_markdown": true }, { "id": "484665123", "title": "Missing range validation on slice_qp_delta", "url": "https://issues.chromium.org/issues/484665123", "status": "Accepted", "severity": "S3-Low", "component": "Internals>Media", "reporter": "lu...@icloud.com", "cve_ids": [ "CVE-2022-21813", "CVE-2022-21814" ], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-02-15T04:24:11+00:00", "year": 2026, "attachment_count": 2, "local_path": "issues/484665123", "has_markdown": true }, { "id": "484088917", "title": "Heap-buffer-overflow in blink::FFTFrame 146.0.7670.0", "url": "https://issues.chromium.org/issues/484088917", "status": "Assigned", "severity": "S3-Low", "component": "Blink>WebAudio", "reporter": "da...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-02-14T00:02:19+00:00", "year": 2026, "attachment_count": 5, "local_path": "issues/484088917", "has_markdown": true }, { "id": "484319071", "title": "WebNN DirectML Constant Tensor Use-After-Free", "url": "https://issues.chromium.org/issues/484319071", "status": "Verified", "severity": "S3-Low", "component": "Blink>WebML", "reporter": "ci...@gmail.com", "cve_ids": [], "bounty_amount": 16000.0, "reward_amount_meta": 16000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-02-13T16:18:05+00:00", "year": 2026, "attachment_count": 3, "local_path": "issues/484319071", "has_markdown": true }, { "id": "484054137", "title": "V8 Sandbox Bypass: UAF via Temporal.Duration.prototype.total", "url": "https://issues.chromium.org/issues/484054137", "status": "Assigned", "severity": "Unknown", "component": "Blink>JavaScript>Runtime", "reporter": "0x...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": null, "public_issue": true, "inclusion_reason": "award_text", "award_text_found": true, "created_date": "2026-02-13T08:13:40+00:00", "year": 2026, "attachment_count": 0, "local_path": "issues/484054137", "has_markdown": true }, { "id": "484082189", "title": "Security Regression: Trusted UI (Omnibox) fails to render/disappears due to CoordinatorLayout migration logic failure.", "url": "https://issues.chromium.org/issues/484082189", "status": "Accepted", "severity": "S3-Low", "component": "UI>Browser>Omnibox>SecurityIndicators", "reporter": "mo...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-02-13T01:19:14+00:00", "year": 2026, "attachment_count": 16, "local_path": "issues/484082189", "has_markdown": true }, { "id": "484078869", "title": "Heap Buffer Overflow (READ) in TFLite + XNNPack via WebNN", "url": "https://issues.chromium.org/issues/484078869", "status": "Assigned", "severity": "S3-Low", "component": "Blink>WebML", "reporter": "to...@gmail.com", "cve_ids": [], "bounty_amount": 43000.0, "reward_amount_meta": 43000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-02-12T21:04:02+00:00", "year": 2026, "attachment_count": 2, "local_path": "issues/484078869", "has_markdown": true }, { "id": "484027094", "title": "WebNN ScatterND integer overflow in TFLite bounds check allows for 512MB controlled heap OOB write", "url": "https://issues.chromium.org/issues/484027094", "status": "Assigned", "severity": "S3-Low", "component": "Blink>WebML", "reporter": "ci...@gmail.com", "cve_ids": [], "bounty_amount": 43000.0, "reward_amount_meta": 43000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-02-12T18:02:36+00:00", "year": 2026, "attachment_count": 8, "local_path": "issues/484027094", "has_markdown": true }, { "id": "483899628", "title": "URL Spoofing on Block or allow pop-ups in Chrome", "url": "https://issues.chromium.org/issues/483899628", "status": "Fixed", "severity": "S3-Low", "component": "Services (Use Subcomponents)>Safebrowsing", "reporter": "mu...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-02-12T17:37:49+00:00", "year": 2026, "attachment_count": 3, "local_path": "issues/483899628", "has_markdown": true }, { "id": "483956252", "title": "Use-After-Free in ipcz message deserialization via overlapping DriverObjectData handle ranges", "url": "https://issues.chromium.org/issues/483956252", "status": "Assigned", "severity": "S3-Low", "component": "Internals>Mojo", "reporter": "ps...@gmail.com", "cve_ids": [], "bounty_amount": 25000.0, "reward_amount_meta": 25000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-02-12T16:56:13+00:00", "year": 2026, "attachment_count": 11, "local_path": "issues/483956252", "has_markdown": true }, { "id": "483971526", "title": "Heap Buffer Overflow (READ) in TFLite + XNNPack via WebNN", "url": "https://issues.chromium.org/issues/483971526", "status": "Assigned", "severity": "S3-Low", "component": "Blink>WebML", "reporter": "to...@gmail.com", "cve_ids": [], "bounty_amount": 43000.0, "reward_amount_meta": 43000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-02-12T14:06:31+00:00", "year": 2026, "attachment_count": 2, "local_path": "issues/483971526", "has_markdown": true }, { "id": "483853103", "title": "UAF in ModelContext::ForEachScriptTool", "url": "https://issues.chromium.org/issues/483853103", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Agentic Platform>WebMCP", "reporter": "he...@gmail.com", "cve_ids": [], "bounty_amount": 10000.0, "reward_amount_meta": 10000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-02-12T08:31:41+00:00", "year": 2026, "attachment_count": 2, "local_path": "issues/483853103", "has_markdown": true }, { "id": "483853098", "title": "UAF in v8_inspector DomainDispatcherImpl", "url": "https://issues.chromium.org/issues/483853098", "status": "Assigned", "severity": "S3-Low", "component": "Platform>DevTools>Extensions", "reporter": "he...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-02-12T07:29:30+00:00", "year": 2026, "attachment_count": 0, "local_path": "issues/483853098", "has_markdown": true }, { "id": "483771899", "title": "HTML5 Sandbox Security Model Violation with auxiliary browsing contexts being created despite the lack of \"allow-popups\" keyword within iframes", "url": "https://issues.chromium.org/issues/483771899", "status": "Assigned", "severity": "S3-Low", "component": "Blink>SecurityFeature>IFrameSandbox", "reporter": "ci...@exploit.cat", "cve_ids": [ "CVE-2017-2371" ], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-02-11T22:16:33+00:00", "year": 2026, "attachment_count": 5, "local_path": "issues/483771899", "has_markdown": true }, { "id": "483751167", "title": "WebGPU (Dawn/Tint Metal) SubstituteOverrides integer overflow causes threadgroup OOB read/write", "url": "https://issues.chromium.org/issues/483751167", "status": "Assigned", "severity": "S3-Low", "component": "Dawn>Tint", "reporter": "ci...@gmail.com", "cve_ids": [], "bounty_amount": 16000.0, "reward_amount_meta": 16000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-02-11T20:39:40+00:00", "year": 2026, "attachment_count": 5, "local_path": "issues/483751167", "has_markdown": true }, { "id": "483569511", "title": "Heap-use-after-free in blink::FontFeatureValuesMapIterationSource::FetchNextItem", "url": "https://issues.chromium.org/issues/483569511", "status": "New", "severity": "S3-Low", "component": "Blink>CSS", "reporter": "fa...@gmail.com", "cve_ids": [], "bounty_amount": 50000.0, "reward_amount_meta": 50000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-02-11T11:57:18+00:00", "year": 2026, "attachment_count": 6, "local_path": "issues/483569511", "has_markdown": true }, { "id": "483423893", "title": "WebSocketConnector.Connect() passes renderer-controlled site_for_cookies and storage_access_api_status unvalidated, enabling third-party cookie blocking bypass", "url": "https://issues.chromium.org/issues/483423893", "status": "Accepted", "severity": "S3-Low", "component": "Blink>Network>WebSockets", "reporter": "ke...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-02-10T21:18:38+00:00", "year": 2026, "attachment_count": 2, "local_path": "issues/483423893", "has_markdown": true }, { "id": "483445078", "title": "Heap Buffer Overflow in TFLite + XNNPack via WebNN", "url": "https://issues.chromium.org/issues/483445078", "status": "Assigned", "severity": "S4-Minimal", "component": "Blink>WebML", "reporter": "to...@gmail.com", "cve_ids": [], "bounty_amount": 33000.0, "reward_amount_meta": 33000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-02-10T21:09:45+00:00", "year": 2026, "attachment_count": 1, "local_path": "issues/483445078", "has_markdown": true }, { "id": "483220222", "title": "V8 sandbox bypass: reuse `protected_uses` of `WasmDispatchTable` after grow", "url": "https://issues.chromium.org/issues/483220222", "status": "Accepted", "severity": "S3-Low", "component": "Blink>JavaScript>Sandbox, Blink>JavaScript>WebAssembly", "reporter": "pv...@gmail.com", "cve_ids": [], "bounty_amount": 20000.0, "reward_amount_meta": 20000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-02-10T10:22:15+00:00", "year": 2026, "attachment_count": 1, "local_path": "issues/483220222", "has_markdown": true }, { "id": "483101823", "title": "Mojo’s ChannelPosix incorrectly handles >128 file descriptors in a message, leading to fd confusion", "url": "https://issues.chromium.org/issues/483101823", "status": "Assigned", "severity": "S3-Low", "component": "Internals>Mojo", "reporter": "sa...@gmail.com", "cve_ids": [], "bounty_amount": 30000.0, "reward_amount_meta": 30000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-02-09T20:13:10+00:00", "year": 2026, "attachment_count": 14, "local_path": "issues/483101823", "has_markdown": true }, { "id": "482828615", "title": "Heap OOB read in SpeechRecognizerImpl::AddAudioFromRenderer ", "url": "https://issues.chromium.org/issues/482828615", "status": "Assigned", "severity": "S4-Minimal", "component": "Internals>Mojo", "reporter": "gr...@gmail.com", "cve_ids": [], "bounty_amount": 36000.0, "reward_amount_meta": 36000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-02-09T17:56:05+00:00", "year": 2026, "attachment_count": 4, "local_path": "issues/482828615", "has_markdown": true }, { "id": "482958590", "title": "Use-After-Free in WMPI", "url": "https://issues.chromium.org/issues/482958590", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Media", "reporter": "ss...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-02-09T15:09:26+00:00", "year": 2026, "attachment_count": 4, "local_path": "issues/482958590", "has_markdown": true }, { "id": "482839657", "title": "Security Check failed: Cannot create a handle without a HandleScope in v8::HandleScope::CreateHandle()", "url": "https://issues.chromium.org/issues/482839657", "status": "Assigned", "severity": "S4-Minimal", "component": "Blink>JavaScript>API", "reporter": "je...@gmail.com", "cve_ids": [], "bounty_amount": 8000.0, "reward_amount_meta": 8000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-02-09T03:01:23+00:00", "year": 2026, "attachment_count": 0, "local_path": "issues/482839657", "has_markdown": true }, { "id": "482862710", "title": "Missing range validation on second_chroma_qp_index_offset in H.264 PPS parser (h264_parser.cc:1151) allows out-of-spec values to reach kernel GPU drivers", "url": "https://issues.chromium.org/issues/482862710", "status": "Assigned", "severity": "S3-Low", "component": "Internals>Media", "reporter": "lu...@icloud.com", "cve_ids": [ "CVE-2022-21813", "CVE-2022-21814" ], "bounty_amount": 10000.0, "reward_amount_meta": 10000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-02-09T01:32:49+00:00", "year": 2026, "attachment_count": 12, "local_path": "issues/482862710", "has_markdown": true }, { "id": "482713603", "title": "Sandbox escape from extensions due to insufficent checks in chrome.devtools.inspectedWindow.reload and chrome://policy", "url": "https://issues.chromium.org/issues/482713603", "status": "Assigned", "severity": "S3-Low", "component": "Platform>DevTools", "reporter": "ad...@gmail.com", "cve_ids": [], "bounty_amount": 20000.0, "reward_amount_meta": 20000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-02-08T05:56:36+00:00", "year": 2026, "attachment_count": 2, "local_path": "issues/482713603", "has_markdown": true }, { "id": "482433856", "title": "Spoof on virtual keyboard", "url": "https://issues.chromium.org/issues/482433856", "status": "Accepted", "severity": "S3-Low", "component": "UI>Browser>Omnibox", "reporter": "sa...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-02-07T23:01:51+00:00", "year": 2026, "attachment_count": 8, "local_path": "issues/482433856", "has_markdown": true }, { "id": "482261044", "title": "Maglev Phi Untag Incorrectly Uses Type Information, Leading to Type Confusion", "url": "https://issues.chromium.org/issues/482261044", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript>Compiler>Maglev", "reporter": "hu...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-02-06T14:18:10+00:00", "year": 2026, "attachment_count": 0, "local_path": "issues/482261044", "has_markdown": true }, { "id": "482096215", "title": "WebNN BlockwiseExpandConstant FlatBuffers overflow allows for controlled heap OOB write in GPU process", "url": "https://issues.chromium.org/issues/482096215", "status": "New", "severity": "S4-Minimal", "component": "Blink>WebML", "reporter": "ci...@gmail.com", "cve_ids": [], "bounty_amount": 36000.0, "reward_amount_meta": 36000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-02-05T20:55:44+00:00", "year": 2026, "attachment_count": 2, "local_path": "issues/482096215", "has_markdown": true }, { "id": "481920229", "title": "UAF in JsCommunication, leading to RCE", "url": "https://issues.chromium.org/issues/481920229", "status": "Accepted", "severity": "S3-Low", "component": "Mobile>WebView", "reporter": "po...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-02-05T10:51:58+00:00", "year": 2026, "attachment_count": 3, "local_path": "issues/481920229", "has_markdown": true }, { "id": "481749436", "title": "## V8 Sandbox Bypass: Native stack OOB write in arm64 `Generate_PushBoundArguments`", "url": "https://issues.chromium.org/issues/481749436", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript>Sandbox", "reporter": "pi...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-02-05T08:15:33+00:00", "year": 2026, "attachment_count": 1, "local_path": "issues/481749436", "has_markdown": true }, { "id": "481882038", "title": "Cross-origin PDF placeholder download misclassified as browser-initiated request", "url": "https://issues.chromium.org/issues/481882038", "status": "Assigned", "severity": "S3-Low", "component": "Internals>Plugins>PDF", "reporter": "po...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-02-05T06:27:17+00:00", "year": 2026, "attachment_count": 2, "local_path": "issues/481882038", "has_markdown": true }, { "id": "481776048", "title": "WebNN ScatterND integer overflow in TFLite bounds check allows for 512MB controlled heap OOB write", "url": "https://issues.chromium.org/issues/481776048", "status": "Assigned", "severity": "S3-Low", "component": "Blink>WebML", "reporter": "ci...@gmail.com", "cve_ids": [ "CVE-2022-35939" ], "bounty_amount": 43000.0, "reward_amount_meta": 43000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-02-04T22:02:19+00:00", "year": 2026, "attachment_count": 8, "local_path": "issues/481776048", "has_markdown": true }, { "id": "481373475", "title": "Security DCHECK failure: i < length() in 201", "url": "https://issues.chromium.org/issues/481373475", "status": "Assigned", "severity": "S3-Low", "component": "Blink>SVG", "reporter": "je...@jvfam.ca", "cve_ids": [], "bounty_amount": 9000.0, "reward_amount_meta": 9000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-02-03T21:42:04+00:00", "year": 2026, "attachment_count": 0, "local_path": "issues/481373475", "has_markdown": true }, { "id": "481295170", "title": "V8 Sandbox Bypass: AAW/PC Control via code marked for deopt (ARM64 only)", "url": "https://issues.chromium.org/issues/481295170", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript>Sandbox", "reporter": "kr...@gmail.com", "cve_ids": [], "bounty_amount": 20000.0, "reward_amount_meta": 20000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-02-03T17:48:10+00:00", "year": 2026, "attachment_count": 1, "local_path": "issues/481295170", "has_markdown": true }, { "id": "481277120", "title": "ipcz bug can allow renderer duplicate browser process handle to escape sandbox", "url": "https://issues.chromium.org/issues/481277120", "status": "Assigned", "severity": "S3-Low", "component": "Internals>Mojo>Core", "reporter": "ha...@gmail.com", "cve_ids": [ "CVE-2025-4609" ], "bounty_amount": 250000.0, "reward_amount_meta": 250000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-02-03T13:25:05+00:00", "year": 2026, "attachment_count": 2, "local_path": "issues/481277120", "has_markdown": true }, { "id": "481152738", "title": "Heap buffer overflow WRITE in FFmpeg mov_read_sample_encryption_info via crafted MP4 CENC/SENC atoms (renderer, no user interaction)", "url": "https://issues.chromium.org/issues/481152738", "status": "Assigned", "severity": "S3-Low", "component": "Internals>Media", "reporter": "da...@gmail.com", "cve_ids": [], "bounty_amount": 11000.0, "reward_amount_meta": 11000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-02-03T04:58:57+00:00", "year": 2026, "attachment_count": 41, "local_path": "issues/481152738", "has_markdown": true }, { "id": "481074858", "title": "V8: Integer Truncation in Turboshaft PhiOp input_count via WASM br_table", "url": "https://issues.chromium.org/issues/481074858", "status": "Assigned", "severity": "S4-Minimal", "component": "Blink>JavaScript>WebAssembly", "reporter": "ca...@gmail.com", "cve_ids": [], "bounty_amount": 11000.0, "reward_amount_meta": 11000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-02-03T04:46:16+00:00", "year": 2026, "attachment_count": 2, "local_path": "issues/481074858", "has_markdown": true }, { "id": "480730094", "title": "Android Chrome External Navigation Bubble Tapjacking", "url": "https://issues.chromium.org/issues/480730094", "status": "Assigned", "severity": "S3-Low", "component": "Mobile>Intents", "reporter": "sh...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-02-02T07:22:14+00:00", "year": 2026, "attachment_count": 2, "local_path": "issues/480730094", "has_markdown": true }, { "id": "480548427", "title": "D3D10Warp!JITCopyContext::ExecuteResourceCopy memory heap overflow based on Integer overflow in gpu", "url": "https://issues.chromium.org/issues/480548427", "status": "Assigned", "severity": "S3-Low", "component": "Internals>GPU", "reporter": "do...@gmail.com", "cve_ids": [ "CVE-2026-26178" ], "bounty_amount": 17000.0, "reward_amount_meta": 17000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-02-02T04:01:17+00:00", "year": 2026, "attachment_count": 5, "local_path": "issues/480548427", "has_markdown": true }, { "id": "480442279", "title": "V8 Sandbox Bypass: UB in MessageHandler::GetMessage because of invalid MessageTemplate variant", "url": "https://issues.chromium.org/issues/480442279", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript>Sandbox", "reporter": "v8...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-02-01T12:17:29+00:00", "year": 2026, "attachment_count": 4, "local_path": "issues/480442279", "has_markdown": true }, { "id": "480438199", "title": "Improper handling of side-effects of CopyFastSmiOrObjectElements in LateLoadElimination leads to a fake object / arbitrary write primitive", "url": "https://issues.chromium.org/issues/480438199", "status": "Assigned", "severity": "S4-Minimal", "component": "Blink>JavaScript>Compiler>Maglev", "reporter": "bj...@neodyme.io", "cve_ids": [], "bounty_amount": 11000.0, "reward_amount_meta": 11000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-02-01T07:59:56+00:00", "year": 2026, "attachment_count": 2, "local_path": "issues/480438199", "has_markdown": true }, { "id": "480450473", "title": "use-after-free at browser_user_education_service.cc:120", "url": "https://issues.chromium.org/issues/480450473", "status": "Assigned", "severity": "S3-Low", "component": "Unknown", "reporter": "xp...@gmail.com", "cve_ids": [ "CVE-2024-6998" ], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-01-31T22:24:09+00:00", "year": 2026, "attachment_count": 2, "local_path": "issues/480450473", "has_markdown": true }, { "id": "480122167", "title": "V8 Sandbox Bypass: UAF in Temporal.PlainDate.prototype.with", "url": "https://issues.chromium.org/issues/480122167", "status": "Assigned", "severity": "S4-Minimal", "component": "Blink>JavaScript>Sandbox", "reporter": "er...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-01-31T14:01:20+00:00", "year": 2026, "attachment_count": 2, "local_path": "issues/480122167", "has_markdown": true }, { "id": "480195317", "title": "WebGPU: Heap Use-After-Free in GPUShaderModule via OnCompilationInfoCallback", "url": "https://issues.chromium.org/issues/480195317", "status": "Assigned", "severity": "S3-Low", "component": "Blink>WebGPU", "reporter": "fa...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-01-31T03:11:49+00:00", "year": 2026, "attachment_count": 8, "local_path": "issues/480195317", "has_markdown": true }, { "id": "480074849", "title": "Previous page executes JS after navigation, allowing history.back() tab hijack", "url": "https://issues.chromium.org/issues/480074849", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>Navigation>BFCache", "reporter": "mr...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-01-30T20:13:01+00:00", "year": 2026, "attachment_count": 3, "local_path": "issues/480074849", "has_markdown": true }, { "id": "479934140", "title": "Heap-buffer-overflow in FFmpeg (mov.c) via malformed stsd atom in MP4/DASH", "url": "https://issues.chromium.org/issues/479934140", "status": "Assigned", "severity": "S3-Low", "component": "Internals>Media>FFmpeg", "reporter": "da...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-01-30T01:25:13+00:00", "year": 2026, "attachment_count": 5, "local_path": "issues/479934140", "has_markdown": true }, { "id": "479726070", "title": "Hole leak in MaglevGraphBuilder", "url": "https://issues.chromium.org/issues/479726070", "status": "Assigned", "severity": "S4-Minimal", "component": "Blink>JavaScript>Compiler>Maglev", "reporter": "ha...@gmail.com", "cve_ids": [], "bounty_amount": 10000.0, "reward_amount_meta": 10000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-01-29T12:53:31+00:00", "year": 2026, "attachment_count": 6, "local_path": "issues/479726070", "has_markdown": true }, { "id": "479326680", "title": "Incorrect Origin Display in PWA Install Prompt When Using RTL Characters", "url": "https://issues.chromium.org/issues/479326680", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>WebAppInstalls", "reporter": "se...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-01-28T02:53:51+00:00", "year": 2026, "attachment_count": 3, "local_path": "issues/479326680", "has_markdown": true }, { "id": "479203484", "title": "Intersection Observer v2 API fails to reliably determine target's visibility, which enables clickjacking against Google One Tap", "url": "https://issues.chromium.org/issues/479203484", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Geometry", "reporter": "lo...@icloud.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-01-27T17:55:56+00:00", "year": 2026, "attachment_count": 7, "local_path": "issues/479203484", "has_markdown": true }, { "id": "479122455", "title": "Mini bar not rendering when omnibox is hidden on Pixel 8 and 9", "url": "https://issues.chromium.org/issues/479122455", "status": "Accepted", "severity": "S3-Low", "component": "UI>Browser>Mobile>Toolbar", "reporter": "ch...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-01-27T16:49:19+00:00", "year": 2026, "attachment_count": 2, "local_path": "issues/479122455", "has_markdown": true }, { "id": "478659010", "title": "RegExp.escape byteness mismatch OOB read ", "url": "https://issues.chromium.org/issues/478659010", "status": "Assigned", "severity": "S4-Minimal", "component": "Blink>JavaScript, Blink>JavaScript>Runtime", "reporter": "qy...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-01-26T03:38:31+00:00", "year": 2026, "attachment_count": 1, "local_path": "issues/478659010", "has_markdown": true }, { "id": "477876507", "title": "TWA Origin Spoofing & UI Redressing via Intent Injection", "url": "https://issues.chromium.org/issues/477876507", "status": "Accepted", "severity": "S4-Minimal", "component": "Services (Use Subcomponents)>Chromoting", "reporter": "ha...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-01-22T13:46:30+00:00", "year": 2026, "attachment_count": 5, "local_path": "issues/477876507", "has_markdown": true }, { "id": "477180001", "title": "Service Worker subresource responses expose detailed resource timing information for cross-origin resources that are normally restricted, leading to an information leak in the Resource Timing API", "url": "https://issues.chromium.org/issues/477180001", "status": "Accepted", "severity": "S3-Low", "component": "Blink>PerformanceAPIs>ResourceTiming", "reporter": "po...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-01-20T09:44:50+00:00", "year": 2026, "attachment_count": 2, "local_path": "issues/477180001", "has_markdown": true }, { "id": "477033835", "title": "PDFium heap-buffer-overflow at opj_j2k_read_sod", "url": "https://issues.chromium.org/issues/477033835", "status": "Assigned", "severity": "S3-Low", "component": "PDFium", "reporter": "ke...@gmail.com", "cve_ids": [], "bounty_amount": 11000.0, "reward_amount_meta": 11000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-01-19T21:15:03+00:00", "year": 2026, "attachment_count": 1, "local_path": "issues/477033835", "has_markdown": true }, { "id": "476898368", "title": "Privileged `chrome://` navigation via reload-triggered server redirect in iOS Chrome", "url": "https://issues.chromium.org/issues/476898368", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>Navigation", "reporter": "po...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-01-19T06:42:29+00:00", "year": 2026, "attachment_count": 2, "local_path": "issues/476898368", "has_markdown": true }, { "id": "476862276", "title": "Chrome (Windows): Opening download “demo. txt” executes sibling “demo. txt.exe” (object-level target confusion / unsafe Shell fallback)", "url": "https://issues.chromium.org/issues/476862276", "status": "Fixed", "severity": "S3-Low", "component": "Internals>PlatformIntegration", "reporter": "li...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-01-19T03:24:16+00:00", "year": 2026, "attachment_count": 3, "local_path": "issues/476862276", "has_markdown": true }, { "id": "475877320", "title": "memory corruption in llvm::UFWriterVolcanic::GenerateKernels casue chrome sandbox escape", "url": "https://issues.chromium.org/issues/475877320", "status": "Assigned", "severity": "S3-Low", "component": "Dawn>Tint, Internals>GPU>Internals", "reporter": "ha...@gmail.com", "cve_ids": [], "bounty_amount": 25000.0, "reward_amount_meta": 25000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-01-15T05:38:16+00:00", "year": 2026, "attachment_count": 0, "local_path": "issues/475877320", "has_markdown": true }, { "id": "475893566", "title": "use-after-poison on address thread T0", "url": "https://issues.chromium.org/issues/475893566", "status": "Assigned", "severity": "S4-Minimal", "component": "Speed>Tracing", "reporter": "mu...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-01-14T21:12:24+00:00", "year": 2026, "attachment_count": 1, "local_path": "issues/475893566", "has_markdown": true }, { "id": "475613896", "title": "use-after-poison on address thread T0", "url": "https://issues.chromium.org/issues/475613896", "status": "Assigned", "severity": "S4-Minimal", "component": "Speed>Tracing", "reporter": "mu...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-01-13T22:52:21+00:00", "year": 2026, "attachment_count": 2, "local_path": "issues/475613896", "has_markdown": true }, { "id": "475396626", "title": "UAF in KEGLGetPoolBuffers cause chrome sandbox escape", "url": "https://issues.chromium.org/issues/475396626", "status": "Assigned", "severity": "S3-Low", "component": "Internals>GPU", "reporter": "ha...@gmail.com", "cve_ids": [], "bounty_amount": 25000.0, "reward_amount_meta": 25000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-01-13T12:01:59+00:00", "year": 2026, "attachment_count": 1, "local_path": "issues/475396626", "has_markdown": true }, { "id": "475265304", "title": "NetError's page AutoReloader leads to multi-download blocker bypass", "url": "https://issues.chromium.org/issues/475265304", "status": "Accepted", "severity": "S3-Low", "component": "UI>Browser>Downloads", "reporter": "he...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-01-13T04:42:58+00:00", "year": 2026, "attachment_count": 3, "local_path": "issues/475265304", "has_markdown": true }, { "id": "474817168", "title": "Unviersal CSP Bypass/XSS & Privileged chrome:// page XSS via Browser History Sidebar navigation", "url": "https://issues.chromium.org/issues/474817168", "status": "Assigned", "severity": "S3-Low", "component": "Blink>SecurityFeature", "reporter": "is...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-01-11T21:16:39+00:00", "year": 2026, "attachment_count": 7, "local_path": "issues/474817168", "has_markdown": true }, { "id": "474948986", "title": "Chrome Windows - PIP Window Displays Incorrect Origin When Domain Uses RTL Characters", "url": "https://issues.chromium.org/issues/474948986", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Media>PictureInPicture", "reporter": "se...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-01-11T14:25:17+00:00", "year": 2026, "attachment_count": 5, "local_path": "issues/474948986", "has_markdown": true }, { "id": "474763968", "title": "ClipboardHost custom format methods bypass IsClipboardPasteAllowed (Issue 40051481 incomplete)", "url": "https://issues.chromium.org/issues/474763968", "status": "Assigned", "severity": "S3-Low", "component": "Blink>DataTransfer", "reporter": "vi...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-01-10T18:54:55+00:00", "year": 2026, "attachment_count": 4, "local_path": "issues/474763968", "has_markdown": true }, { "id": "474583539", "title": "Regression 440523110: User Activation Bypass via showOpenFilePicker and contextmenu delay", "url": "https://issues.chromium.org/issues/474583539", "status": "Accepted", "severity": "S3-Low", "component": "UI>Browser>TopChrome>TabStrip>SplitView", "reporter": "az...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-01-10T13:40:58+00:00", "year": 2026, "attachment_count": 4, "local_path": "issues/474583539", "has_markdown": true }, { "id": "474670215", "title": "Bypass for console.log %c formatter url filter", "url": "https://issues.chromium.org/issues/474670215", "status": "Assigned", "severity": "S3-Low", "component": "Platform>DevTools>Console", "reporter": "re...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-01-10T13:26:48+00:00", "year": 2026, "attachment_count": 4, "local_path": "issues/474670215", "has_markdown": true }, { "id": "474435504", "title": "Leaking size of cross-origin resources via rangeless opaque responses using Service Workers and the Fetch API", "url": "https://issues.chromium.org/issues/474435504", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Network>FetchAPI", "reporter": "he...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-01-09T05:01:30+00:00", "year": 2026, "attachment_count": 3, "local_path": "issues/474435504", "has_markdown": true }, { "id": "474266014", "title": "Chrome sandbox escape via libGLESv2_powervr.so", "url": "https://issues.chromium.org/issues/474266014", "status": "New", "severity": "S3-Low", "component": "Blink>WebGL", "reporter": "ha...@gmail.com", "cve_ids": [], "bounty_amount": 32000.0, "reward_amount_meta": 32000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-01-08T14:32:16+00:00", "year": 2026, "attachment_count": 0, "local_path": "issues/474266014", "has_markdown": true }, { "id": "473851441", "title": "Data race in Map::bit_field2 access", "url": "https://issues.chromium.org/issues/473851441", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript>Runtime", "reporter": "p1...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-01-07T00:25:54+00:00", "year": 2026, "attachment_count": 1, "local_path": "issues/473851441", "has_markdown": true }, { "id": "473118648", "title": "Download origin spoofing using hostname in data uri.", "url": "https://issues.chromium.org/issues/473118648", "status": "Accepted", "severity": "S3-Low", "component": "UI>Browser>Downloads", "reporter": "x4...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-01-03T12:33:29+00:00", "year": 2026, "attachment_count": 5, "local_path": "issues/473118648", "has_markdown": true }, { "id": "472892246", "title": "Chrome Android address bar shows stale eTLD when navigating to longer attacker-controlled domains", "url": "https://issues.chromium.org/issues/472892246", "status": "Accepted", "severity": "S3-Low", "component": "UI>Browser>Omnibox", "reporter": "ga...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-01-02T13:14:49+00:00", "year": 2026, "attachment_count": 4, "local_path": "issues/472892246", "has_markdown": true }, { "id": "472921872", "title": "[Critical] Unresolved Google Bugs Leak ", "url": "https://issues.chromium.org/issues/472921872", "status": "Fixed", "severity": "S3-Low", "component": "Unknown", "reporter": "am...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2026-01-02T03:56:02+00:00", "year": 2026, "attachment_count": 0, "local_path": "issues/472921872", "has_markdown": true }, { "id": "472376568", "title": "WebGLOnWebGPU: draw allowed with invalid vertex / index buffer state", "url": "https://issues.chromium.org/issues/472376568", "status": "Verified", "severity": "S3-Low", "component": "Blink>WebGPU", "reporter": "le...@gmail.com", "cve_ids": [], "bounty_amount": 8000.0, "reward_amount_meta": 8000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2025-12-30T08:15:19+00:00", "year": 2025, "attachment_count": 2, "local_path": "issues/472376568", "has_markdown": true }, { "id": "472139305", "title": "V8 Sandbox Bypass: Use-After-Free in ICU NumberFormatter", "url": "https://issues.chromium.org/issues/472139305", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript>Internationalization, Blink>JavaScript>Sandbox", "reporter": "vs...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2025-12-29T12:42:29+00:00", "year": 2025, "attachment_count": 0, "local_path": "issues/472139305", "has_markdown": true }, { "id": "472181383", "title": "V8 Sandbox Bypass: Use-After-Free in Intl.Segmenter BreakIterator", "url": "https://issues.chromium.org/issues/472181383", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript, Blink>JavaScript>Sandbox", "reporter": "vs...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2025-12-29T12:37:07+00:00", "year": 2025, "attachment_count": 0, "local_path": "issues/472181383", "has_markdown": true }, { "id": "471580187", "title": "CSA_DCHECK failed: IsNotCleared(value)", "url": "https://issues.chromium.org/issues/471580187", "status": "Accepted", "severity": "S4-Minimal", "component": "Blink>JavaScript>Runtime", "reporter": "je...@gmail.com", "cve_ids": [], "bounty_amount": 8000.0, "reward_amount_meta": 8000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2025-12-25T14:07:36+00:00", "year": 2025, "attachment_count": 0, "local_path": "issues/471580187", "has_markdown": true }, { "id": "471363817", "title": "UAF Vulnerability in TrustedSpace Due To Turboshaft's Optimization of TrustedPointers in WebAssembly", "url": "https://issues.chromium.org/issues/471363817", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript>WebAssembly", "reporter": "hu...@gmail.com", "cve_ids": [], "bounty_amount": 10000.0, "reward_amount_meta": 10000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2025-12-24T16:29:41+00:00", "year": 2025, "attachment_count": 0, "local_path": "issues/471363817", "has_markdown": true }, { "id": "471257336", "title": "Security: heap-use-after-free in v8::Isolate::SuppressMicrotaskExecutionScope::~SuppressMicrotaskExe", "url": "https://issues.chromium.org/issues/471257336", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript", "reporter": "zh...@gmail.com", "cve_ids": [], "bounty_amount": 11000.0, "reward_amount_meta": 11000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2025-12-24T11:58:59+00:00", "year": 2025, "attachment_count": 9, "local_path": "issues/471257336", "has_markdown": true }, { "id": "470831166", "title": "Crash in Maglev due to Stale ScopeInfo Cache with Async Generators", "url": "https://issues.chromium.org/issues/470831166", "status": "Assigned", "severity": "S4-Minimal", "component": "Blink>JavaScript>Runtime", "reporter": "hu...@gmail.com", "cve_ids": [], "bounty_amount": 10000.0, "reward_amount_meta": 10000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2025-12-22T16:17:44+00:00", "year": 2025, "attachment_count": 0, "local_path": "issues/470831166", "has_markdown": true }, { "id": "470928605", "title": "On Ubuntu (or other Linux-based systems) an attacker can steal files uploaded to other sites with little user interaction.", "url": "https://issues.chromium.org/issues/470928605", "status": "Accepted", "severity": "S3-Low", "component": "UI>Linux Toolkit Theming", "reporter": "va...@hotmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2025-12-22T13:10:05+00:00", "year": 2025, "attachment_count": 2, "local_path": "issues/470928605", "has_markdown": true }, { "id": "470574526", "title": "DevTools Sources panel with Service Worker causes POST to be resent bypassing SameSite=Strict", "url": "https://issues.chromium.org/issues/470574526", "status": "Accepted", "severity": "S3-Low", "component": "Internals>Network>Cookies, Platform>DevTools>Sources", "reporter": "j....@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2025-12-21T15:09:31+00:00", "year": 2025, "attachment_count": 6, "local_path": "issues/470574526", "has_markdown": true }, { "id": "470295118", "title": "Blank Address Bar Spoofing on Chrome for iOS", "url": "https://issues.chromium.org/issues/470295118", "status": "Accepted", "severity": "S3-Low", "component": "UI>Browser>Omnibox", "reporter": "sa...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2025-12-19T16:59:32+00:00", "year": 2025, "attachment_count": 3, "local_path": "issues/470295118", "has_markdown": true }, { "id": "469878492", "title": "V8 sandbox bypass: arbitrary bytecode execution with replaced bytecode array in lazy deoptimization throw", "url": "https://issues.chromium.org/issues/469878492", "status": "Verified", "severity": "S3-Low", "component": "Blink>JavaScript>Runtime", "reporter": "pv...@gmail.com", "cve_ids": [], "bounty_amount": 20000.0, "reward_amount_meta": 20000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2025-12-18T10:44:03+00:00", "year": 2025, "attachment_count": 1, "local_path": "issues/469878492", "has_markdown": true }, { "id": "469143679", "title": "JSON.parse(): Out-of-bounds access on DescriptorArray", "url": "https://issues.chromium.org/issues/469143679", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript>Runtime", "reporter": "hu...@gmail.com", "cve_ids": [], "bounty_amount": 4000.0, "reward_amount_meta": 4000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2025-12-16T09:20:32+00:00", "year": 2025, "attachment_count": 0, "local_path": "issues/469143679", "has_markdown": true }, { "id": "468027781", "title": "Path traversal using \\.. causes sourceMappingURL to still load UNC paths on Windows", "url": "https://issues.chromium.org/issues/468027781", "status": "Assigned", "severity": "S3-Low", "component": "Platform>DevTools>Sources", "reporter": "o....@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2025-12-12T10:25:16+00:00", "year": 2025, "attachment_count": 1, "local_path": "issues/468027781", "has_markdown": true }, { "id": "467448811", "title": "Mini bar not rendered when omnibox is hidden (similar to issue 461532432)", "url": "https://issues.chromium.org/issues/467448811", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>Mobile>Toolbar", "reporter": "ch...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2025-12-10T14:41:17+00:00", "year": 2025, "attachment_count": 2, "local_path": "issues/467448811", "has_markdown": true }, { "id": "467442136", "title": "when the filename contains a very long with special character can break/remove the extension of file in download buble", "url": "https://issues.chromium.org/issues/467442136", "status": "Fixed", "severity": "S3-Low", "component": "UI>Browser>Downloads", "reporter": "sa...@gmail.com", "cve_ids": [], "bounty_amount": 500.0, "reward_amount_meta": 500.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2025-12-10T07:52:02+00:00", "year": 2025, "attachment_count": 5, "local_path": "issues/467442136", "has_markdown": true }, { "id": "467474391", "title": "Use-after-poison in base::MemoryConsumer::UpdateMemoryLimit", "url": "https://issues.chromium.org/issues/467474391", "status": "Assigned", "severity": "S4-Minimal", "component": "Internals>MemoryCoordinator", "reporter": "m....@gmail.com", "cve_ids": [], "bounty_amount": 9000.0, "reward_amount_meta": 9000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2025-12-10T05:19:53+00:00", "year": 2025, "attachment_count": 0, "local_path": "issues/467474391", "has_markdown": true }, { "id": "467270655", "title": "V8 SBX bypass: Perfetto Heap-Buffer-Overflow", "url": "https://issues.chromium.org/issues/467270655", "status": "Accepted", "severity": "S3-Low", "component": "Blink>JavaScript>Runtime", "reporter": "am...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2025-12-09T15:17:11+00:00", "year": 2025, "attachment_count": 1, "local_path": "issues/467270655", "has_markdown": true }, { "id": "467297219", "title": "Use-After-Poison in RouteMap::UpdateActiveRoutes", "url": "https://issues.chromium.org/issues/467297219", "status": "Accepted", "severity": "S3-Low", "component": "Blink>CSS", "reporter": "an...@gmail.com", "cve_ids": [], "bounty_amount": 8000.0, "reward_amount_meta": 8000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2025-12-09T13:48:25+00:00", "year": 2025, "attachment_count": 3, "local_path": "issues/467297219", "has_markdown": true }, { "id": "467247247", "title": "Maglev's handling of target and new.target is incorrect", "url": "https://issues.chromium.org/issues/467247247", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript>Runtime", "reporter": "hu...@gmail.com", "cve_ids": [], "bounty_amount": 50000.0, "reward_amount_meta": 50000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2025-12-09T11:32:56+00:00", "year": 2025, "attachment_count": 0, "local_path": "issues/467247247", "has_markdown": true }, { "id": "466786677", "title": " v8 incorrect Integer Overflow Elimination leads to potential OOB R/W", "url": "https://issues.chromium.org/issues/466786677", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript, Blink>JavaScript>Compiler>Maglev", "reporter": "fa...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2025-12-08T06:56:21+00:00", "year": 2025, "attachment_count": 0, "local_path": "issues/466786677", "has_markdown": true }, { "id": "464725735", "title": "[WebGLOnWebGPU] Incorrect count passed to glUniformMatrix* functions", "url": "https://issues.chromium.org/issues/464725735", "status": "Accepted", "severity": "S3-Low", "component": "Blink>WebGPU", "reporter": "le...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2025-11-30T12:49:36+00:00", "year": 2025, "attachment_count": 0, "local_path": "issues/464725735", "has_markdown": true }, { "id": "464459404", "title": "V8: OOB memmove in FixedArray::MoveElements triggered via Array.shift leads to negative-size copy", "url": "https://issues.chromium.org/issues/464459404", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript>Runtime", "reporter": "am...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2025-11-29T12:13:49+00:00", "year": 2025, "attachment_count": 3, "local_path": "issues/464459404", "has_markdown": true }, { "id": "464217867", "title": "Insufficient URL Scheme Validation in regex_rules_matcher.cc", "url": "https://issues.chromium.org/issues/464217867", "status": "Assigned", "severity": "S3-Low", "component": "Platform>Extensions>API", "reporter": "dj...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2025-11-28T11:40:00+00:00", "year": 2025, "attachment_count": 6, "local_path": "issues/464217867", "has_markdown": true }, { "id": "464296297", "title": "V8 Sandbox Bypass: AAW due to JSArrayBuffer extension handle double fetch", "url": "https://issues.chromium.org/issues/464296297", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript>Sandbox", "reporter": "h3...@gmail.com", "cve_ids": [], "bounty_amount": 20000.0, "reward_amount_meta": 20000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2025-11-28T09:14:03+00:00", "year": 2025, "attachment_count": 3, "local_path": "issues/464296297", "has_markdown": true }, { "id": "464173573", "title": "KeyframeEffect constructor leaks UA shadow root.", "url": "https://issues.chromium.org/issues/464173573", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Animation", "reporter": "dr...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2025-11-28T03:11:53+00:00", "year": 2025, "attachment_count": 1, "local_path": "issues/464173573", "has_markdown": true }, { "id": "463155954", "title": "Extensions can hijack Gemini in the browser webview process to perform PE attacks by abusing DNR permissions, allowing stealing prompts, PII leakage, unrestricted access to camera-microphone and more", "url": "https://issues.chromium.org/issues/463155954", "status": "Assigned", "severity": "S3-Low", "component": "Blink>SecurityFeature>ContentSecurityPolicy", "reporter": "we...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2025-11-23T21:47:50+00:00", "year": 2025, "attachment_count": 14, "local_path": "issues/463155954", "has_markdown": true }, { "id": "462217236", "title": "V8 Sandbox Bypass: AAW/PC control via dispatch entry UAF during InstantiateAsmJs by hijacking start", "url": "https://issues.chromium.org/issues/462217236", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript>GarbageCollection, Blink>JavaScript>Sandbox", "reporter": "kr...@gmail.com", "cve_ids": [], "bounty_amount": 20000.0, "reward_amount_meta": 20000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2025-11-20T00:23:44+00:00", "year": 2025, "attachment_count": 1, "local_path": "issues/462217236", "has_markdown": true }, { "id": "461532432", "title": "Bottom Minibar Fails to Display URL – Potential Phishing via Spoof Bar", "url": "https://issues.chromium.org/issues/461532432", "status": "Accepted", "severity": "S3-Low", "component": "UI>Browser>Mobile>Toolbar", "reporter": "ch...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2025-11-18T06:34:28+00:00", "year": 2025, "attachment_count": 3, "local_path": "issues/461532432", "has_markdown": true }, { "id": "461214000", "title": "Cross thread stack corruption caused by RTCVideoDecoderAdapter::InitializeSync ", "url": "https://issues.chromium.org/issues/461214000", "status": "Accepted", "severity": "S3-Low", "component": "Internals>Media", "reporter": "al...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2025-11-16T23:33:20+00:00", "year": 2025, "attachment_count": 0, "local_path": "issues/461214000", "has_markdown": true }, { "id": "460678755", "title": "Security: SEGV_ACCERR 000044332211 in V8", "url": "https://issues.chromium.org/issues/460678755", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript>Compiler>Maglev", "reporter": "je...@gmail.com", "cve_ids": [], "bounty_amount": 8000.0, "reward_amount_meta": 8000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2025-11-14T11:05:50+00:00", "year": 2025, "attachment_count": 0, "local_path": "issues/460678755", "has_markdown": true }, { "id": "460599518", "title": "Security: Heap-use-after-free in LoginStateChecker::OnExecutionResponseCallback ", "url": "https://issues.chromium.org/issues/460599518", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>Passwords", "reporter": "me...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2025-11-14T07:22:54+00:00", "year": 2025, "attachment_count": 4, "local_path": "issues/460599518", "has_markdown": true }, { "id": "458914193", "title": "Dcheck failure in fixed-array-inl.h", "url": "https://issues.chromium.org/issues/458914193", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript>Runtime", "reporter": "p1...@gmail.com", "cve_ids": [], "bounty_amount": 8000.0, "reward_amount_meta": 8000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2025-11-08T19:13:55+00:00", "year": 2025, "attachment_count": 1, "local_path": "issues/458914193", "has_markdown": true }, { "id": "458442542", "title": " Popup window tab doesn't show the origin correctly", "url": "https://issues.chromium.org/issues/458442542", "status": "Accepted", "severity": "S3-Low", "component": "UI>Browser>TopChrome>TabStrip>HoverCards", "reporter": "sa...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2025-11-07T02:45:43+00:00", "year": 2025, "attachment_count": 2, "local_path": "issues/458442542", "has_markdown": true }, { "id": "458101580", "title": "Bypass :// Characters in Download Security UI lead to Origin Spoofing", "url": "https://issues.chromium.org/issues/458101580", "status": "Accepted", "severity": "S3-Low", "component": "UI>Browser>Downloads", "reporter": "fr...@gmail.com", "cve_ids": [], "bounty_amount": 500.0, "reward_amount_meta": 500.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2025-11-06T02:00:48+00:00", "year": 2025, "attachment_count": 3, "local_path": "issues/458101580", "has_markdown": true }, { "id": "457771782", "title": "STTF allows to leaking text char by char from cross-origin page.", "url": "https://issues.chromium.org/issues/457771782", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Scroll", "reporter": "se...@gmail.com", "cve_ids": [], "bounty_amount": 10000.0, "reward_amount_meta": 10000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2025-11-04T19:18:20+00:00", "year": 2025, "attachment_count": 5, "local_path": "issues/457771782", "has_markdown": true }, { "id": "457351015", "title": "DCHECK Fail when Maglev Generates Exception Handler Trampoline Instructions", "url": "https://issues.chromium.org/issues/457351015", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript>Compiler>Maglev", "reporter": "hu...@gmail.com", "cve_ids": [], "bounty_amount": 10000.0, "reward_amount_meta": 10000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2025-11-03T14:45:31+00:00", "year": 2025, "attachment_count": 0, "local_path": "issues/457351015", "has_markdown": true }, { "id": "456547591", "title": "Maglev - CallBuiltin (input @0 = LoadHoleyFixedDoubleArrayElement) type HoleyFloat64 is not Tagged ", "url": "https://issues.chromium.org/issues/456547591", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript>Compiler>Maglev", "reporter": "sh...@gmail.com", "cve_ids": [], "bounty_amount": 11000.0, "reward_amount_meta": 11000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2025-10-31T06:56:11+00:00", "year": 2025, "attachment_count": 1, "local_path": "issues/456547591", "has_markdown": true }, { "id": "455899538", "title": "Bypass #443948855 - Allows Arbitrary Code Execution via \"Copy as cURL (cmd)\" in DevTools", "url": "https://issues.chromium.org/issues/455899538", "status": "Accepted", "severity": "S3-Low", "component": "Platform>DevTools>Network", "reporter": "we...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2025-10-29T01:47:09+00:00", "year": 2025, "attachment_count": 2, "local_path": "issues/455899538", "has_markdown": true }, { "id": "454927471", "title": "V8 Sandbox Bypass: AAW/PC control via CallKnownJSFunction reduction for builtins", "url": "https://issues.chromium.org/issues/454927471", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript>Sandbox", "reporter": "kr...@gmail.com", "cve_ids": [], "bounty_amount": 22000.0, "reward_amount_meta": 22000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2025-10-25T02:05:07+00:00", "year": 2025, "attachment_count": 2, "local_path": "issues/454927471", "has_markdown": true }, { "id": "454485895", "title": "Incorrect Optimization of ArrayConstructor by Maglev Leads to Creation of Malformed JSArray Objects", "url": "https://issues.chromium.org/issues/454485895", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript>Compiler>Maglev", "reporter": "hu...@gmail.com", "cve_ids": [], "bounty_amount": 50000.0, "reward_amount_meta": 50000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2025-10-23T14:39:58+00:00", "year": 2025, "attachment_count": 0, "local_path": "issues/454485895", "has_markdown": true }, { "id": "454354281", "title": "Chrome on Android: spoofing issue caused by bottom address bar", "url": "https://issues.chromium.org/issues/454354281", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>Omnibox", "reporter": "ch...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2025-10-23T05:48:17+00:00", "year": 2025, "attachment_count": 3, "local_path": "issues/454354281", "has_markdown": true }, { "id": "454162508", "title": "Service Worker Navigation bypass LNA checks for localhost", "url": "https://issues.chromium.org/issues/454162508", "status": "Assigned", "severity": "S3-Low", "component": "Blink>SecurityFeature>LocalNetworkAccess", "reporter": "0x...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2025-10-22T07:31:32+00:00", "year": 2025, "attachment_count": 3, "local_path": "issues/454162508", "has_markdown": true }, { "id": "453147449", "title": "DCHECK failure in TCPReadableStreamWrapper::Pull()", "url": "https://issues.chromium.org/issues/453147449", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Network>DirectSockets", "reporter": "i....@gmail.com", "cve_ids": [], "bounty_amount": 4000.0, "reward_amount_meta": 4000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2025-10-18T19:45:46+00:00", "year": 2025, "attachment_count": 6, "local_path": "issues/453147449", "has_markdown": true }, { "id": "453094710", "title": "Out-of-bound read in the jmp table of ActiveMediaSessionController leads to sandbox escape.", "url": "https://issues.chromium.org/issues/453094710", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Media>Session", "reporter": "bl...@gmail.com", "cve_ids": [], "bounty_amount": 250000.0, "reward_amount_meta": 250000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2025-10-18T18:46:32+00:00", "year": 2025, "attachment_count": 5, "local_path": "issues/453094710", "has_markdown": true }, { "id": "452605804", "title": "V8 Sandbox Bypass: Wasm streaming compilation cache confusion via \"double streaming\"", "url": "https://issues.chromium.org/issues/452605804", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript>WebAssembly", "reporter": "se...@gmail.com", "cve_ids": [], "bounty_amount": 20000.0, "reward_amount_meta": 20000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2025-10-16T17:05:33+00:00", "year": 2025, "attachment_count": 3, "local_path": "issues/452605804", "has_markdown": true }, { "id": "452605803", "title": "V8 Sandbox Bypass: WasmCPT handle UAF by import dispatch table corruption (multiple variants of b/446113730)", "url": "https://issues.chromium.org/issues/452605803", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript>WebAssembly", "reporter": "se...@gmail.com", "cve_ids": [], "bounty_amount": 20000.0, "reward_amount_meta": 20000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2025-10-16T16:28:19+00:00", "year": 2025, "attachment_count": 1, "local_path": "issues/452605803", "has_markdown": true }, { "id": "452541294", "title": "Type confusion in v8 caused by incorrect unregistration of prototype users", "url": "https://issues.chromium.org/issues/452541294", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript", "reporter": "my...@gmail.com", "cve_ids": [], "bounty_amount": 10000.0, "reward_amount_meta": 10000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2025-10-16T15:11:48+00:00", "year": 2025, "attachment_count": 3, "local_path": "issues/452541294", "has_markdown": true }, { "id": "452392032", "title": "When in split-view mode, the mini address bar does not appear above the virtual keyboard, leading to a spoof.", "url": "https://issues.chromium.org/issues/452392032", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>Omnibox", "reporter": "sa...@gmail.com", "cve_ids": [], "bounty_amount": 500.0, "reward_amount_meta": 500.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2025-10-16T04:01:34+00:00", "year": 2025, "attachment_count": 4, "local_path": "issues/452392032", "has_markdown": true }, { "id": "452209503", "title": "ANGLE HandleAllocator: Invalid iterator access on empty vector → UAF + OOB (double-free plausible)", "url": "https://issues.chromium.org/issues/452209503", "status": "Accepted", "severity": "S3-Low", "component": "Internals>GPU>ANGLE", "reporter": "gl...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2025-10-15T17:27:35+00:00", "year": 2025, "attachment_count": 3, "local_path": "issues/452209503", "has_markdown": true }, { "id": "452209495", "title": "truncated long domain on Digital Credentials API prompt lead to spoof", "url": "https://issues.chromium.org/issues/452209495", "status": "Accepted", "severity": "S3-Low", "component": "Blink>Payments", "reporter": "sa...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2025-10-15T14:22:57+00:00", "year": 2025, "attachment_count": 1, "local_path": "issues/452209495", "has_markdown": true }, { "id": "452071845", "title": "Potential out-of-bounds read in Transform::ColMajorF on undersized buffer", "url": "https://issues.chromium.org/issues/452071845", "status": "Accepted", "severity": "S3-Low", "component": "Blink>WebXR", "reporter": "ig...@aisle.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2025-10-15T11:32:02+00:00", "year": 2025, "attachment_count": 1, "local_path": "issues/452071845", "has_markdown": true }, { "id": "452071826", "title": "HTTP-Auth Passwords are not secured on MacOS", "url": "https://issues.chromium.org/issues/452071826", "status": "Fixed", "severity": "S3-Low", "component": "UI>Browser>Passwords", "reporter": "bu...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2025-10-14T19:23:21+00:00", "year": 2025, "attachment_count": 0, "local_path": "issues/452071826", "has_markdown": true }, { "id": "451355210", "title": "V8 Sandbox Bypass: AAW/PC control via OOB builtin in SharedFunctionInfo", "url": "https://issues.chromium.org/issues/451355210", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript>Runtime", "reporter": "kr...@gmail.com", "cve_ids": [], "bounty_amount": 20000.0, "reward_amount_meta": 20000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2025-10-13T10:19:27+00:00", "year": 2025, "attachment_count": 2, "local_path": "issues/451355210", "has_markdown": true }, { "id": "450618029", "title": "TDZ check elision leading to hole leak", "url": "https://issues.chromium.org/issues/450618029", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript>Runtime", "reporter": "ry...@gmail.com", "cve_ids": [ "CVE-2025-6554" ], "bounty_amount": 50000.0, "reward_amount_meta": 50000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2025-10-10T07:58:42+00:00", "year": 2025, "attachment_count": 0, "local_path": "issues/450618029", "has_markdown": true }, { "id": "450044213", "title": "BluetoothAdapterWin UAF Issue", "url": "https://issues.chromium.org/issues/450044213", "status": "Assigned", "severity": "S4-Minimal", "component": "Unknown", "reporter": "va...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2025-10-08T02:58:02+00:00", "year": 2025, "attachment_count": 5, "local_path": "issues/450044213", "has_markdown": true }, { "id": "449753178", "title": "DCHECK failure in !value->properties().is_conversion() in maglev-interpreter-frame-state.h", "url": "https://issues.chromium.org/issues/449753178", "status": "Assigned", "severity": "S4-Minimal", "component": "Blink>JavaScript, Blink>JavaScript>Compiler>Maglev", "reporter": "de...@googlemail.com", "cve_ids": [], "bounty_amount": 9000.0, "reward_amount_meta": 9000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2025-10-06T20:16:50+00:00", "year": 2025, "attachment_count": 0, "local_path": "issues/449753178", "has_markdown": true }, { "id": "449341185", "title": "SEGV_ACCERR in V8", "url": "https://issues.chromium.org/issues/449341185", "status": "Verified", "severity": "S3-Low", "component": "Blink>JavaScript, Blink>JavaScript>Regexp", "reporter": "je...@gmail.com", "cve_ids": [], "bounty_amount": 8000.0, "reward_amount_meta": 8000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2025-10-06T00:38:31+00:00", "year": 2025, "attachment_count": 1, "local_path": "issues/449341185", "has_markdown": true }, { "id": "448421954", "title": "Security: Popup window tab doesn't show the origin elided from the right", "url": "https://issues.chromium.org/issues/448421954", "status": "Accepted", "severity": "S3-Low", "component": "UI>Browser>TopChrome>TabStrip>HoverCards", "reporter": "ch...@gmail.com", "cve_ids": [], "bounty_amount": 500.0, "reward_amount_meta": 500.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2025-10-01T01:34:50+00:00", "year": 2025, "attachment_count": 1, "local_path": "issues/448421954", "has_markdown": true }, { "id": "448294721", "title": "[bugSWAT] GPU process crash via WebGPU shader - wild-deref in Mesa aco::combine_instruction", "url": "https://issues.chromium.org/issues/448294721", "status": "Assigned", "severity": "S3-Low", "component": "Blink>WebGPU", "reporter": "a7...@gmail.com", "cve_ids": [], "bounty_amount": 10000.0, "reward_amount_meta": 10000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2025-09-30T15:15:33+00:00", "year": 2025, "attachment_count": 4, "local_path": "issues/448294721", "has_markdown": true }, { "id": "448113221", "title": "LPE - Arbitrary File Write in Google Chrome Enterprise (MacOS): The GoogleUpdater, which is executed by root, follows symlinks when writing the file settings.dat in the user folder", "url": "https://issues.chromium.org/issues/448113221", "status": "Assigned", "severity": "S3-Low", "component": "Internals>Updater", "reporter": "jo...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2025-09-29T16:53:28+00:00", "year": 2025, "attachment_count": 4, "local_path": "issues/448113221", "has_markdown": true }, { "id": "448046109", "title": "Use-After-Free in WebMediaPlayerMS::OnFirstFrameReceived", "url": "https://issues.chromium.org/issues/448046109", "status": "Assigned", "severity": "S3-Low", "component": "Blink>MediaStream", "reporter": "ss...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2025-09-29T11:50:44+00:00", "year": 2025, "attachment_count": 4, "local_path": "issues/448046109", "has_markdown": true }, { "id": "447613219", "title": "Debug check failed: has_latin1_bytecode().", "url": "https://issues.chromium.org/issues/447613219", "status": "Assigned", "severity": "S4-Minimal", "component": "Blink>JavaScript>Runtime", "reporter": "je...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2025-09-27T10:11:33+00:00", "year": 2025, "attachment_count": 0, "local_path": "issues/447613219", "has_markdown": true }, { "id": "447613211", "title": "Type confusion in inline cache prototype loading with Webassembly object prototype", "url": "https://issues.chromium.org/issues/447613211", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript>WebAssembly", "reporter": "m-...@github.com", "cve_ids": [], "bounty_amount": 50000.0, "reward_amount_meta": 50000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2025-09-26T21:54:54+00:00", "year": 2025, "attachment_count": 5, "local_path": "issues/447613211", "has_markdown": true }, { "id": "447307165", "title": "Sandbox violation: Still UAF in RemoveFromAsyncWaiterQueueList", "url": "https://issues.chromium.org/issues/447307165", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript>Sandbox", "reporter": "pi...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2025-09-25T11:43:24+00:00", "year": 2025, "attachment_count": 1, "local_path": "issues/447307165", "has_markdown": true }, { "id": "447172715", "title": "Security: Compromised renderer can control mouse after single tap (UXSS, sandbox escape, and more)", "url": "https://issues.chromium.org/issues/447172715", "status": "Assigned", "severity": "S3-Low", "component": "Internals>Views", "reporter": "al...@alesandroortiz.com", "cve_ids": [], "bounty_amount": 30000.0, "reward_amount_meta": 30000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2025-09-25T06:51:00+00:00", "year": 2025, "attachment_count": 22, "local_path": "issues/447172715", "has_markdown": true }, { "id": "447192722", "title": "UAF in safe_browsing::RendererURLLoaderThrottle::WillRedirectRequest due to Mojo Remote being freed during resource load lifecycle", "url": "https://issues.chromium.org/issues/447192722", "status": "Assigned", "severity": "S3-Low", "component": "Services (Use Subcomponents)>Safebrowsing", "reporter": "0x...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2025-09-25T02:21:46+00:00", "year": 2025, "attachment_count": 3, "local_path": "issues/447192722", "has_markdown": true }, { "id": "446722008", "title": "heap-use-after-free in content::indexed_db::Database::connections_ when force_closing_ is true", "url": "https://issues.chromium.org/issues/446722008", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Storage>IndexedDB", "reporter": "so...@gmail.com", "cve_ids": [], "bounty_amount": 100000.0, "reward_amount_meta": 100000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2025-09-23T01:40:44+00:00", "year": 2025, "attachment_count": 23, "local_path": "issues/446722008", "has_markdown": true }, { "id": "446463993", "title": "Spoof on virtual keyboard", "url": "https://issues.chromium.org/issues/446463993", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>Omnibox", "reporter": "sa...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2025-09-21T23:08:32+00:00", "year": 2025, "attachment_count": 12, "local_path": "issues/446463993", "has_markdown": true }, { "id": "446463984", "title": "Check failed: !WriteBarrier::IsRequired(heap_object, Tagged(value)).", "url": "https://issues.chromium.org/issues/446463984", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript>GarbageCollection", "reporter": "je...@gmail.com", "cve_ids": [], "bounty_amount": 10000.0, "reward_amount_meta": 10000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2025-09-21T14:22:47+00:00", "year": 2025, "attachment_count": 1, "local_path": "issues/446463984", "has_markdown": true }, { "id": "446294487", "title": "heap-use-after-free C:\\b\\s\\w\\ir\\cache\\builder\\src\\chrome\\browser\\ui\\page_info\\page_info_infobar_dele", "url": "https://issues.chromium.org/issues/446294487", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>Bubbles>PageInfo", "reporter": "pu...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2025-09-20T12:25:17+00:00", "year": 2025, "attachment_count": 5, "local_path": "issues/446294487", "has_markdown": true }, { "id": "446113732", "title": "Wasm type confusion due to spec unsoundness in `cast_desc` operations", "url": "https://issues.chromium.org/issues/446113732", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript>WebAssembly", "reporter": "se...@gmail.com", "cve_ids": [], "bounty_amount": 55000.0, "reward_amount_meta": 55000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2025-09-19T13:58:19+00:00", "year": 2025, "attachment_count": 2, "local_path": "issues/446113732", "has_markdown": true }, { "id": "446122633", "title": "Wasm type confusion due to wrong reachability analysis in `WasmGCTypeAnalyzer::ProcessBranchOnTarget()` with custom descriptor casts", "url": "https://issues.chromium.org/issues/446122633", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript>WebAssembly", "reporter": "se...@gmail.com", "cve_ids": [], "bounty_amount": 55000.0, "reward_amount_meta": 55000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2025-09-19T13:58:14+00:00", "year": 2025, "attachment_count": 2, "local_path": "issues/446122633", "has_markdown": true }, { "id": "446124893", "title": "Wasm type confusion due to custom descriptors spec ambiguity in `ref.get_desc` exactness typing", "url": "https://issues.chromium.org/issues/446124893", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript>WebAssembly", "reporter": "se...@gmail.com", "cve_ids": [], "bounty_amount": 55000.0, "reward_amount_meta": 55000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2025-09-19T13:58:08+00:00", "year": 2025, "attachment_count": 2, "local_path": "issues/446124893", "has_markdown": true }, { "id": "446113731", "title": "Wasm type confusion due to custom descriptors spec unsoundness on `ref.func` exact typing", "url": "https://issues.chromium.org/issues/446113731", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript>WebAssembly", "reporter": "se...@gmail.com", "cve_ids": [], "bounty_amount": 55000.0, "reward_amount_meta": 55000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2025-09-19T13:58:03+00:00", "year": 2025, "attachment_count": 2, "local_path": "issues/446113731", "has_markdown": true }, { "id": "446124892", "title": "Wasm type confusion due to missing exactness check on JS-Wasm boundary", "url": "https://issues.chromium.org/issues/446124892", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript>WebAssembly", "reporter": "se...@gmail.com", "cve_ids": [], "bounty_amount": 55000.0, "reward_amount_meta": 55000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2025-09-19T13:57:58+00:00", "year": 2025, "attachment_count": 2, "local_path": "issues/446124892", "has_markdown": true }, { "id": "446113730", "title": "V8 Sandbox Bypass: WasmCPT handle UAF by import dispatch table growth", "url": "https://issues.chromium.org/issues/446113730", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript>WebAssembly", "reporter": "se...@gmail.com", "cve_ids": [], "bounty_amount": 20000.0, "reward_amount_meta": 20000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2025-09-19T13:57:45+00:00", "year": 2025, "attachment_count": 1, "local_path": "issues/446113730", "has_markdown": true }, { "id": "445966259", "title": "V8 Sandbox Bypass: AAW/PC control via DebugBreakTrampoline", "url": "https://issues.chromium.org/issues/445966259", "status": "Verified", "severity": "S4-Minimal", "component": "Blink>JavaScript>Sandbox", "reporter": "kr...@gmail.com", "cve_ids": [], "bounty_amount": 20000.0, "reward_amount_meta": 20000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2025-09-18T23:39:56+00:00", "year": 2025, "attachment_count": 1, "local_path": "issues/445966259", "has_markdown": true }, { "id": "445738066", "title": "Google Chrome on iOS sad tabs with the following testcase.", "url": "https://issues.chromium.org/issues/445738066", "status": "Accepted", "severity": "S3-Low", "component": "Mobile>iOSWeb>Security", "reporter": "nt...@gmail.com", "cve_ids": [ "CVE-2025-43427" ], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2025-09-18T10:56:43+00:00", "year": 2025, "attachment_count": 3, "local_path": "issues/445738066", "has_markdown": true }, { "id": "445209324", "title": "V8 Sandbox Bypass: AAW/PC control by dispatching CEntry and CCall functions", "url": "https://issues.chromium.org/issues/445209324", "status": "Assigned", "severity": "S4-Minimal", "component": "Blink>JavaScript>Sandbox", "reporter": "kr...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2025-09-16T02:45:15+00:00", "year": 2025, "attachment_count": 1, "local_path": "issues/445209324", "has_markdown": true }, { "id": "444865195", "title": "V8 Sandbox Bypass: Referencing non-shared heap data across isolates leads to UAF -> AAW/PC control", "url": "https://issues.chromium.org/issues/444865195", "status": "Assigned", "severity": "S4-Minimal", "component": "Blink>JavaScript>Sandbox", "reporter": "kr...@gmail.com", "cve_ids": [], "bounty_amount": 20000.0, "reward_amount_meta": 20000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2025-09-13T23:13:32+00:00", "year": 2025, "attachment_count": 1, "local_path": "issues/444865195", "has_markdown": true }, { "id": "444803530", "title": "Windows download logic flaw: % triggers double extension sanitization bypass (.lnk .lnk, .scf .scf)", "url": "https://issues.chromium.org/issues/444803530", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>Downloads", "reporter": "br...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2025-09-13T20:15:46+00:00", "year": 2025, "attachment_count": 1, "local_path": "issues/444803530", "has_markdown": true }, { "id": "444755026", "title": "Buffer Overflow in Y16 Video Capture", "url": "https://issues.chromium.org/issues/444755026", "status": "Assigned", "severity": "S3-Low", "component": "Internals>Media>CameraCapture", "reporter": "el...@cryptosearch.tools", "cve_ids": [], "bounty_amount": 4000.0, "reward_amount_meta": 4000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2025-09-12T23:59:28+00:00", "year": 2025, "attachment_count": 10, "local_path": "issues/444755026", "has_markdown": true }, { "id": "444653104", "title": "File picker dialog can be shown over on different tab when focused on it (on split view)", "url": "https://issues.chromium.org/issues/444653104", "status": "Accepted", "severity": "S3-Low", "component": "UI>Browser>TopChrome>TabStrip>SplitView", "reporter": "sa...@gmail.com", "cve_ids": [], "bounty_amount": 500.0, "reward_amount_meta": 500.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2025-09-12T19:57:15+00:00", "year": 2025, "attachment_count": 2, "local_path": "issues/444653104", "has_markdown": true }, { "id": "444176961", "title": "use-after-poison in ContextInvalidationListener", "url": "https://issues.chromium.org/issues/444176961", "status": "Assigned", "severity": "S3-Low", "component": "Platform>Extensions", "reporter": "vm...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2025-09-10T16:18:53+00:00", "year": 2025, "attachment_count": 17, "local_path": "issues/444176961", "has_markdown": true }, { "id": "444048032", "title": "V8 Sandbox Bypass: OOB write in v8::bigint::AddAndReturnOverflow", "url": "https://issues.chromium.org/issues/444048032", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript", "reporter": "vs...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2025-09-10T12:45:03+00:00", "year": 2025, "attachment_count": 1, "local_path": "issues/444048032", "has_markdown": true }, { "id": "443948855", "title": "Allows Arbitrary Code Execution via \"Copy as cURL (cmd)\" in DevTools", "url": "https://issues.chromium.org/issues/443948855", "status": "Assigned", "severity": "S3-Low", "component": "Platform>DevTools>Network", "reporter": "we...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2025-09-09T20:04:11+00:00", "year": 2025, "attachment_count": 6, "local_path": "issues/443948855", "has_markdown": true }, { "id": "443772809", "title": "V8 Sandbox Bypass: AAW/PC control via JSDispatchEntry UAF", "url": "https://issues.chromium.org/issues/443772809", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript>Sandbox", "reporter": "kr...@gmail.com", "cve_ids": [], "bounty_amount": 20000.0, "reward_amount_meta": 20000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2025-09-08T22:04:22+00:00", "year": 2025, "attachment_count": 1, "local_path": "issues/443772809", "has_markdown": true }, { "id": "443475183", "title": "V8 Sandbox Bypass: OOB write to controlled address", "url": "https://issues.chromium.org/issues/443475183", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript>Runtime", "reporter": "vs...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2025-09-07T16:50:29+00:00", "year": 2025, "attachment_count": 1, "local_path": "issues/443475183", "has_markdown": true }, { "id": "443408317", "title": "Spoof on Address Bar", "url": "https://issues.chromium.org/issues/443408317", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>Omnibox", "reporter": "sa...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2025-09-06T14:13:07+00:00", "year": 2025, "attachment_count": 6, "local_path": "issues/443408317", "has_markdown": true }, { "id": "443196747", "title": "out of bound in function ECPublicKeyFromBytes", "url": "https://issues.chromium.org/issues/443196747", "status": "Assigned", "severity": "S3-Low", "component": "Services (Use Subcomponents)>Sync", "reporter": "wx...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2025-09-05T14:19:18+00:00", "year": 2025, "attachment_count": 3, "local_path": "issues/443196747", "has_markdown": true }, { "id": "443182220", "title": "V8 Sandbox violation: UAF in RemoveFromAsyncWaiterQueueList", "url": "https://issues.chromium.org/issues/443182220", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript>Sandbox", "reporter": "pi...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2025-09-05T11:39:30+00:00", "year": 2025, "attachment_count": 1, "local_path": "issues/443182220", "has_markdown": true }, { "id": "442860473", "title": "File Source Origin Spoofing via Extension Name", "url": "https://issues.chromium.org/issues/442860473", "status": "Assigned", "severity": "S3-Low", "component": "Platform>Extensions, UI>Browser>Downloads", "reporter": "fr...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2025-09-04T01:39:24+00:00", "year": 2025, "attachment_count": 7, "local_path": "issues/442860473", "has_markdown": true }, { "id": "442444724", "title": "Heap-buffer-overflow/wild-read in dawn::native::`anonymous namespace'::ReflectEntryPointUsingTint ", "url": "https://issues.chromium.org/issues/442444724", "status": "Assigned", "severity": "S4-Minimal", "component": "Dawn", "reporter": "at...@gmail.com", "cve_ids": [], "bounty_amount": 25000.0, "reward_amount_meta": 25000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2025-09-02T09:03:22+00:00", "year": 2025, "attachment_count": 1, "local_path": "issues/442444724", "has_markdown": true }, { "id": "442273697", "title": "libGLES_mali UAF via WebGPU shaders at llvm::BasicBlock::getTerminator", "url": "https://issues.chromium.org/issues/442273697", "status": "Assigned", "severity": "S3-Low", "component": "Dawn>Tint", "reporter": "a7...@gmail.com", "cve_ids": [], "bounty_amount": 25000.0, "reward_amount_meta": 25000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2025-09-01T11:03:56+00:00", "year": 2025, "attachment_count": 3, "local_path": "issues/442273697", "has_markdown": true }, { "id": "442065550", "title": "libusc UAF via WebGPU shaders at MergeConsecutiveBarriersBP", "url": "https://issues.chromium.org/issues/442065550", "status": "Assigned", "severity": "S3-Low", "component": "Dawn>Tint", "reporter": "a7...@gmail.com", "cve_ids": [], "bounty_amount": 25000.0, "reward_amount_meta": 25000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2025-08-30T18:29:57+00:00", "year": 2025, "attachment_count": 3, "local_path": "issues/442065550", "has_markdown": true }, { "id": "441949792", "title": "V8 Sandbox Bypass: Control flow hijack via Torque function type corruption", "url": "https://issues.chromium.org/issues/441949792", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript>Sandbox", "reporter": "se...@gmail.com", "cve_ids": [], "bounty_amount": 20000.0, "reward_amount_meta": 20000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2025-08-29T16:13:56+00:00", "year": 2025, "attachment_count": 1, "local_path": "issues/441949792", "has_markdown": true }, { "id": "441917796", "title": "WebCodecs VideoFrame constructor crashes browser when non-even width and height are used", "url": "https://issues.chromium.org/issues/441917796", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Media>WebCodecs", "reporter": "ko...@gmail.com", "cve_ids": [ "CVE-2025-11211" ], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2025-08-29T12:33:41+00:00", "year": 2025, "attachment_count": 0, "local_path": "issues/441917796", "has_markdown": true }, { "id": "441668149", "title": "Maglev type confusion via corrupted Phi node metadata", "url": "https://issues.chromium.org/issues/441668149", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript>Compiler>Maglev", "reporter": "fa...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2025-08-28T17:41:49+00:00", "year": 2025, "attachment_count": 1, "local_path": "issues/441668149", "has_markdown": true }, { "id": "441427753", "title": "Debug check failed: isolate()->CurrentLocalHeap()->IsRunning()", "url": "https://issues.chromium.org/issues/441427753", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript>Compiler>Maglev", "reporter": "fa...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2025-08-27T16:56:10+00:00", "year": 2025, "attachment_count": 1, "local_path": "issues/441427753", "has_markdown": true }, { "id": "440737137", "title": "Use-After-Free in MediaStreamDescriptor", "url": "https://issues.chromium.org/issues/440737137", "status": "Assigned", "severity": "S3-Low", "component": "Blink>WebRTC", "reporter": "ss...@gmail.com", "cve_ids": [], "bounty_amount": 10000.0, "reward_amount_meta": 10000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2025-08-23T14:50:57+00:00", "year": 2025, "attachment_count": 4, "local_path": "issues/440737137", "has_markdown": true }, { "id": "440523110", "title": "(Split View) UI spoofing Upload leads leaking confidential files, Photos to Attacker", "url": "https://issues.chromium.org/issues/440523110", "status": "Accepted", "severity": "S3-Low", "component": "UI>Browser>TopChrome>TabStrip>SplitView", "reporter": "pu...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2025-08-22T20:32:38+00:00", "year": 2025, "attachment_count": 5, "local_path": "issues/440523110", "has_markdown": true }, { "id": "440454442", "title": "Use After Free in ServiceWorkerVersion::FinishRequestWithFetchCount() in browser process.", "url": "https://issues.chromium.org/issues/440454442", "status": "New", "severity": "S3-Low", "component": "Blink>ServiceWorker", "reporter": "lo...@gmail.com", "cve_ids": [], "bounty_amount": 43000.0, "reward_amount_meta": 43000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2025-08-22T10:33:45+00:00", "year": 2025, "attachment_count": 6, "local_path": "issues/440454442", "has_markdown": true }, { "id": "439474032", "title": "Arbitrary OOB read and write with WebGL via SwiftShader", "url": "https://issues.chromium.org/issues/439474032", "status": "Assigned", "severity": "S3-Low", "component": "Blink>WebGL, Internals>GPU>ANGLE", "reporter": "ma...@gmail.com", "cve_ids": [], "bounty_amount": 10000.0, "reward_amount_meta": 10000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2025-08-18T16:29:56+00:00", "year": 2025, "attachment_count": 0, "local_path": "issues/439474032", "has_markdown": true }, { "id": "439305148", "title": "Mojo’s ChannelPosix incorrectly handles >128 file descriptors in a message, leading to fd confusion", "url": "https://issues.chromium.org/issues/439305148", "status": "Assigned", "severity": "S3-Low", "component": "Internals>Mojo", "reporter": "sa...@gmail.com", "cve_ids": [], "bounty_amount": 30000.0, "reward_amount_meta": 30000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2025-08-18T01:13:13+00:00", "year": 2025, "attachment_count": 7, "local_path": "issues/439305148", "has_markdown": true }, { "id": "439380004", "title": "V8 Sandbox Bypass: In-sandbox corruption allows execution of arbitrary runtime functions / intrinsics", "url": "https://issues.chromium.org/issues/439380004", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript>Sandbox", "reporter": "se...@gmail.com", "cve_ids": [], "bounty_amount": 20000.0, "reward_amount_meta": 20000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2025-08-17T23:32:25+00:00", "year": 2025, "attachment_count": 1, "local_path": "issues/439380004", "has_markdown": true }, { "id": "439058242", "title": "Extensions can run JS on any privileged origin by exploiting already-patched vulnerabilities under devtools:// scheme.", "url": "https://issues.chromium.org/issues/439058242", "status": "Assigned", "severity": "S3-Low", "component": "Platform>DevTools>Extensions", "reporter": "le...@gmail.com", "cve_ids": [], "bounty_amount": 4000.0, "reward_amount_meta": 4000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2025-08-16T00:44:01+00:00", "year": 2025, "attachment_count": 17, "local_path": "issues/439058242", "has_markdown": true }, { "id": "438226517", "title": "Address Bar Spoofing on Android", "url": "https://issues.chromium.org/issues/438226517", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>Omnibox", "reporter": "sa...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2025-08-13T04:14:20+00:00", "year": 2025, "attachment_count": 15, "local_path": "issues/438226517", "has_markdown": true }, { "id": "437147699", "title": "Chrome on Android: Spoof issue triggered by bottom address bar", "url": "https://issues.chromium.org/issues/437147699", "status": "Accepted", "severity": "S3-Low", "component": "UI>Browser>Omnibox", "reporter": "ch...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2025-08-07T20:27:28+00:00", "year": 2025, "attachment_count": 3, "local_path": "issues/437147699", "has_markdown": true }, { "id": "436887350", "title": "Security: Extension can download file by resuming interrupted download", "url": "https://issues.chromium.org/issues/436887350", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>Downloads", "reporter": "al...@alesandroortiz.com", "cve_ids": [], "bounty_amount": 4000.0, "reward_amount_meta": 4000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2025-08-06T19:38:23+00:00", "year": 2025, "attachment_count": 11, "local_path": "issues/436887350", "has_markdown": true }, { "id": "436623746", "title": "Signal SIGABRT in v8", "url": "https://issues.chromium.org/issues/436623746", "status": "Accepted", "severity": "S3-Low", "component": "Blink>JavaScript>Compiler>Turbofan", "reporter": "ki...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2025-08-06T02:31:01+00:00", "year": 2025, "attachment_count": 1, "local_path": "issues/436623746", "has_markdown": true }, { "id": "435980394", "title": "Third party installed extensions can silently increase permissions on update", "url": "https://issues.chromium.org/issues/435980394", "status": "Assigned", "severity": "S3-Low", "component": "Platform>Extensions", "reporter": "po...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2025-08-03T12:37:20+00:00", "year": 2025, "attachment_count": 3, "local_path": "issues/435980394", "has_markdown": true }, { "id": "435875050", "title": "WebGPU dawn::native::d3d12::ResourceAllocatorManager::Tick Heap-Use-After-Free", "url": "https://issues.chromium.org/issues/435875050", "status": "Assigned", "severity": "S3-Low", "component": "Dawn", "reporter": "wl...@gmail.com", "cve_ids": [], "bounty_amount": 15000.0, "reward_amount_meta": 15000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2025-08-03T03:54:17+00:00", "year": 2025, "attachment_count": 2, "local_path": "issues/435875050", "has_markdown": true }, { "id": "435630467", "title": "V8 Sandbox Bypass: In-sandbox corruption allows execution of DebugBreakTrampoline, leading to invalid tail call", "url": "https://issues.chromium.org/issues/435630467", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript>Sandbox", "reporter": "se...@gmail.com", "cve_ids": [], "bounty_amount": 20000.0, "reward_amount_meta": 20000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2025-08-02T05:40:21+00:00", "year": 2025, "attachment_count": 1, "local_path": "issues/435630467", "has_markdown": true }, { "id": "435684924", "title": "Security: Compromised renderer can read files through file picker dialog with kSave mode + prefilled filename", "url": "https://issues.chromium.org/issues/435684924", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Storage>FileAPI", "reporter": "al...@alesandroortiz.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2025-08-02T01:33:05+00:00", "year": 2025, "attachment_count": 5, "local_path": "issues/435684924", "has_markdown": true }, { "id": "435630464", "title": "VULNERABILITY DETAILS", "url": "https://issues.chromium.org/issues/435630464", "status": "Unknown", "severity": "Unknown", "component": "Unknown", "reporter": "Unknown", "cve_ids": [], "bounty_amount": 20000.0, "reward_amount_meta": null, "public_issue": true, "inclusion_reason": "award_text", "award_text_found": true, "created_date": "2025-08-02T00:53:57+00:00", "year": 2025, "attachment_count": 1, "local_path": "issues/435630464", "has_markdown": true }, { "id": "435630461", "title": "V8 Sandbox Bypass: OOB Write using %TypedArray%.prototype.set due to element type/size TOCTOU", "url": "https://issues.chromium.org/issues/435630461", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript>Sandbox", "reporter": "kr...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2025-08-01T22:46:47+00:00", "year": 2025, "attachment_count": 1, "local_path": "issues/435630461", "has_markdown": true }, { "id": "435683799", "title": "heap-buffer-overflow in ANGLE for Chromium on MacOS", "url": "https://issues.chromium.org/issues/435683799", "status": "Assigned", "severity": "S3-Low", "component": "Internals>GPU>ANGLE", "reporter": "ul...@gmail.com", "cve_ids": [], "bounty_amount": 10000.0, "reward_amount_meta": 10000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2025-08-01T16:27:41+00:00", "year": 2025, "attachment_count": 2, "local_path": "issues/435683799", "has_markdown": true }, { "id": "433800617", "title": "Security: Compromised renderer can steal cross-site data with minimal user interaction", "url": "https://issues.chromium.org/issues/433800617", "status": "Assigned", "severity": "S3-Low", "component": "Internals>Sandbox>SiteIsolation, UI>Browser>Downloads", "reporter": "al...@alesandroortiz.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2025-07-23T22:13:43+00:00", "year": 2025, "attachment_count": 7, "local_path": "issues/433800617", "has_markdown": true }, { "id": "433533359", "title": "Consumers of ReadableStream subject to data race with SharedArrayBuffer, leading to RCE + V8 Sandbox bypass", "url": "https://issues.chromium.org/issues/433533359", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript>WebAssembly", "reporter": "se...@gmail.com", "cve_ids": [], "bounty_amount": 70000.0, "reward_amount_meta": 70000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2025-07-23T07:06:44+00:00", "year": 2025, "attachment_count": 4, "local_path": "issues/433533359", "has_markdown": true }, { "id": "433407763", "title": "V8 sandbox bypass due to NativeModule swapping while module instantiation was ongoing", "url": "https://issues.chromium.org/issues/433407763", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript>WebAssembly", "reporter": "pv...@gmail.com", "cve_ids": [], "bounty_amount": 20000.0, "reward_amount_meta": 20000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2025-07-22T09:34:13+00:00", "year": 2025, "attachment_count": 1, "local_path": "issues/433407763", "has_markdown": true }, { "id": "433027577", "title": "heap-use-after-free in wl_proxy_marshal_array_flags", "url": "https://issues.chromium.org/issues/433027577", "status": "Accepted", "severity": "S3-Low", "component": "Internals>Ozone", "reporter": "yu...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2025-07-20T15:06:55+00:00", "year": 2025, "attachment_count": 2, "local_path": "issues/433027577", "has_markdown": true }, { "id": "432497641", "title": "Security: heap-use-after-free on aura::Window::CleanupGestureState", "url": "https://issues.chromium.org/issues/432497641", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Input", "reporter": "xp...@gmail.com", "cve_ids": [], "bounty_amount": 11000.0, "reward_amount_meta": 11000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2025-07-17T20:15:53+00:00", "year": 2025, "attachment_count": 4, "local_path": "issues/432497641", "has_markdown": true }, { "id": "432289371", "title": "V8 sandbox bypass due to recreating funcref for imported wasm function", "url": "https://issues.chromium.org/issues/432289371", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript>WebAssembly", "reporter": "pv...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2025-07-17T06:24:14+00:00", "year": 2025, "attachment_count": 3, "local_path": "issues/432289371", "has_markdown": true }, { "id": "432035817", "title": "Crash with three-way self Jitsi Meet call", "url": "https://issues.chromium.org/issues/432035817", "status": "Assigned", "severity": "S3-Low", "component": "Internals>Media>Codecs", "reporter": "jo...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2025-07-15T20:12:21+00:00", "year": 2025, "attachment_count": 4, "local_path": "issues/432035817", "has_markdown": true }, { "id": "431309019", "title": "Bypassing Mark of the Web with an HTML File and User Interaction", "url": "https://issues.chromium.org/issues/431309019", "status": "Accepted", "severity": "S3-Low", "component": "UI>Browser>Downloads", "reporter": "to...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2025-07-12T00:35:33+00:00", "year": 2025, "attachment_count": 9, "local_path": "issues/431309019", "has_markdown": true }, { "id": "430960844", "title": "V8 Sandbox Bypass: InstantiateAsmJs builtin doesn't protect against mid-builtin dispatch handle swaps", "url": "https://issues.chromium.org/issues/430960844", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript>WebAssembly", "reporter": "ma...@popax21.dev", "cve_ids": [], "bounty_amount": 20000.0, "reward_amount_meta": 20000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2025-07-11T01:56:10+00:00", "year": 2025, "attachment_count": 1, "local_path": "issues/430960844", "has_markdown": true }, { "id": "430635213", "title": "UAF in content::protocol::InputHandler::InputInjector::InjectMouseEvent through DevTools", "url": "https://issues.chromium.org/issues/430635213", "status": "Assigned", "severity": "S3-Low", "component": "Platform>DevTools", "reporter": "xu...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2025-07-10T10:18:25+00:00", "year": 2025, "attachment_count": 4, "local_path": "issues/430635213", "has_markdown": true }, { "id": "430572435", "title": "JIT type confusion via corrupted inlining metadata", "url": "https://issues.chromium.org/issues/430572435", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript>Compiler>Maglev", "reporter": "fa...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2025-07-09T19:10:15+00:00", "year": 2025, "attachment_count": 1, "local_path": "issues/430572435", "has_markdown": true }, { "id": "430498032", "title": "V8 Sandbox Bypass: Heap Buffer Overflow while Changing the Length of a Corrupted Array", "url": "https://issues.chromium.org/issues/430498032", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript>Sandbox", "reporter": "da...@hirsch.cx", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2025-07-09T13:30:03+00:00", "year": 2025, "attachment_count": 1, "local_path": "issues/430498032", "has_markdown": true }, { "id": "430336833", "title": "Cross-context string leakage via V8 string_table", "url": "https://issues.chromium.org/issues/430336833", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Bindings", "reporter": "sh...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2025-07-09T10:05:22+00:00", "year": 2025, "attachment_count": 12, "local_path": "issues/430336833", "has_markdown": true }, { "id": "430344952", "title": "Debug check failed: IsInBounds(index)", "url": "https://issues.chromium.org/issues/430344952", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript>Parser", "reporter": "fa...@gmail.com", "cve_ids": [], "bounty_amount": 8000.0, "reward_amount_meta": 8000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2025-07-09T08:49:49+00:00", "year": 2025, "attachment_count": 1, "local_path": "issues/430344952", "has_markdown": true }, { "id": "430198264", "title": "IntersectionObserver's visibility check can be bypassed through SVG filters", "url": "https://issues.chromium.org/issues/430198264", "status": "Accepted", "severity": "S3-Low", "component": "Blink>Geometry", "reporter": "re...@gmail.com", "cve_ids": [], "bounty_amount": 4000.0, "reward_amount_meta": 4000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2025-07-08T08:18:34+00:00", "year": 2025, "attachment_count": 5, "local_path": "issues/430198264", "has_markdown": true }, { "id": "429703123", "title": "V8 Sandbox Bypass: Arbitrary code execution via interpreter-to-baseline OSR Code type confusion", "url": "https://issues.chromium.org/issues/429703123", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript>WebAssembly", "reporter": "se...@gmail.com", "cve_ids": [], "bounty_amount": 20000.0, "reward_amount_meta": 20000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2025-07-05T13:23:01+00:00", "year": 2025, "attachment_count": 1, "local_path": "issues/429703123", "has_markdown": true }, { "id": "428515091", "title": " GPU process crash via WebGPU shader - heap-use-after-free in Mesa aco:do_pack_2x16 ", "url": "https://issues.chromium.org/issues/428515091", "status": "Assigned", "severity": "S3-Low", "component": "Dawn>Tint", "reporter": "a7...@gmail.com", "cve_ids": [], "bounty_amount": 10000.0, "reward_amount_meta": 10000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2025-06-29T16:19:47+00:00", "year": 2025, "attachment_count": 3, "local_path": "issues/428515091", "has_markdown": true }, { "id": "428484827", "title": "Confusion on permission prompt lead to spoof (using split view)", "url": "https://issues.chromium.org/issues/428484827", "status": "Verified", "severity": "S3-Low", "component": "UI>Browser>Permissions>Prompts, UI>Browser>TopChrome>TabStrip>SplitView", "reporter": "sa...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2025-06-29T14:44:16+00:00", "year": 2025, "attachment_count": 3, "local_path": "issues/428484827", "has_markdown": true }, { "id": "428455319", "title": "Permission element inner div with style text-emphasis:꧁; and text-emphasis-position: over right; can be abused if no element in the parent chain has any text-emphasis:꧁; and text-emphasis-position: over right; are set.", "url": "https://issues.chromium.org/issues/428455319", "status": "Accepted", "severity": "S3-Low", "component": "Internals>Permissions>PermissionElement", "reporter": "sa...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2025-06-29T13:59:55+00:00", "year": 2025, "attachment_count": 2, "local_path": "issues/428455319", "has_markdown": true }, { "id": "428397712", "title": "Files of extensions with developer tools page are exposed to other extensions", "url": "https://issues.chromium.org/issues/428397712", "status": "Assigned", "severity": "S3-Low", "component": "Platform>Extensions", "reporter": "gr...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2025-06-29T01:44:18+00:00", "year": 2025, "attachment_count": 1, "local_path": "issues/428397712", "has_markdown": true }, { "id": "428189824", "title": "Security: PiP window obscures FSA API file picker dialog (env var leak)", "url": "https://issues.chromium.org/issues/428189824", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Media>PictureInPicture, Blink>Storage>FileSystem", "reporter": "al...@alesandroortiz.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2025-06-27T22:25:13+00:00", "year": 2025, "attachment_count": 15, "local_path": "issues/428189824", "has_markdown": true }, { "id": "428131118", "title": " V8 Sandbox Bypass: OOB write in wasm::WellKnownImportsList::Update", "url": "https://issues.chromium.org/issues/428131118", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript>WebAssembly", "reporter": "vs...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2025-06-27T11:04:51+00:00", "year": 2025, "attachment_count": 1, "local_path": "issues/428131118", "has_markdown": true }, { "id": "427918760", "title": "V8 Sandbox Bypass: OOB write in the WasmFullDecoder EndControl handler", "url": "https://issues.chromium.org/issues/427918760", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript>WebAssembly", "reporter": "vs...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2025-06-26T13:56:28+00:00", "year": 2025, "attachment_count": 1, "local_path": "issues/427918760", "has_markdown": true }, { "id": "427662337", "title": "V8 Sandbox Bypass: Heap Use-After-Free in v8::internal::HeapLayout::CheckYoungGenerationConsistency", "url": "https://issues.chromium.org/issues/427662337", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript", "reporter": "da...@hirsch.cx", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2025-06-25T17:49:49+00:00", "year": 2025, "attachment_count": 0, "local_path": "issues/427662337", "has_markdown": true }, { "id": "427681143", "title": "P2PSocket(this) object is freed, causing Use-After-Free vulnerability", "url": "https://issues.chromium.org/issues/427681143", "status": "Assigned", "severity": "S3-Low", "component": "Blink>WebRTC", "reporter": "ja...@gmail.com", "cve_ids": [], "bounty_amount": 25000.0, "reward_amount_meta": 25000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2025-06-25T15:01:56+00:00", "year": 2025, "attachment_count": 3, "local_path": "issues/427681143", "has_markdown": true }, { "id": "427600180", "title": "V8 Sandbox Bypass: OOB write in bigint::ProcessorImpl::FromStringLarge", "url": "https://issues.chromium.org/issues/427600180", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript, Blink>JavaScript>Runtime", "reporter": "vs...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2025-06-25T14:41:08+00:00", "year": 2025, "attachment_count": 0, "local_path": "issues/427600180", "has_markdown": true }, { "id": "427367145", "title": "Command injection in \"Copy as cURL (cmd)\" due to improper sanitization", "url": "https://issues.chromium.org/issues/427367145", "status": "Accepted", "severity": "S3-Low", "component": "Platform>DevTools>Network", "reporter": "am...@gmail.com", "cve_ids": [], "bounty_amount": 1500.0, "reward_amount_meta": 1500.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2025-06-24T08:46:39+00:00", "year": 2025, "attachment_count": 3, "local_path": "issues/427367145", "has_markdown": true }, { "id": "426480606", "title": "open link in split view view leads to the origin of an external protocol handler prompt obscured (Windows)", "url": "https://issues.chromium.org/issues/426480606", "status": "Accepted", "severity": "S3-Low", "component": "UI>Browser>TopChrome>TabStrip>SplitView", "reporter": "pu...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2025-06-20T17:53:59+00:00", "year": 2025, "attachment_count": 5, "local_path": "issues/426480606", "has_markdown": true }, { "id": "426054987", "title": "use-after-poison in blink::MediaStreamAudioTrack::StopAndNotify(class base::OnceCallback<(void)>)", "url": "https://issues.chromium.org/issues/426054987", "status": "Accepted", "severity": "S3-Low", "component": "Blink>MediaStream", "reporter": "m....@gmail.com", "cve_ids": [], "bounty_amount": 8000.0, "reward_amount_meta": 8000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2025-06-19T13:22:50+00:00", "year": 2025, "attachment_count": 2, "local_path": "issues/426054987", "has_markdown": true }, { "id": "425583995", "title": "Debug check failed: pc_offset() < unresolved_branches_first_limit()", "url": "https://issues.chromium.org/issues/425583995", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript>Compiler>Maglev", "reporter": "fa...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2025-06-17T16:37:00+00:00", "year": 2025, "attachment_count": 1, "local_path": "issues/425583995", "has_markdown": true }, { "id": "425390965", "title": "GPU process crash via WebGPU shader - wild-deref in Mesa try_opt_exclusive_scan_to_inclusive ", "url": "https://issues.chromium.org/issues/425390965", "status": "Assigned", "severity": "S3-Low", "component": "Blink>WebGPU", "reporter": "a7...@gmail.com", "cve_ids": [], "bounty_amount": 10000.0, "reward_amount_meta": 10000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2025-06-16T19:26:26+00:00", "year": 2025, "attachment_count": 3, "local_path": "issues/425390965", "has_markdown": true }, { "id": "425271170", "title": "GPU process crash via WebGPU shader - global-buffer-overflow in Mesa lower_mem_store", "url": "https://issues.chromium.org/issues/425271170", "status": "Assigned", "severity": "S3-Low", "component": "Blink>WebGPU", "reporter": "a7...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2025-06-16T16:59:11+00:00", "year": 2025, "attachment_count": 3, "local_path": "issues/425271170", "has_markdown": true }, { "id": "425121216", "title": "V8 Sandbox Bypass: OOB write in JsonParser due to dangling GC callback", "url": "https://issues.chromium.org/issues/425121216", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript", "reporter": "vs...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2025-06-15T15:50:08+00:00", "year": 2025, "attachment_count": 1, "local_path": "issues/425121216", "has_markdown": true }, { "id": "425122187", "title": "V8 Sandbox Bypass: UB V8HeapExplorer::GetSystemEntryName leads to OOB write", "url": "https://issues.chromium.org/issues/425122187", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript", "reporter": "vs...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2025-06-15T14:04:16+00:00", "year": 2025, "attachment_count": 0, "local_path": "issues/425122187", "has_markdown": true }, { "id": "424995036", "title": "Security: and inside iframe can be drawn outside of iframe", "url": "https://issues.chromium.org/issues/377948403", "status": "Accepted", "severity": "S3-Low", "component": "Internals>Compositing>Scroll", "reporter": "tr...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-11-08T05:51:56+00:00", "year": 2024, "attachment_count": 6, "local_path": "issues/377948403", "has_markdown": true }, { "id": "377803496", "title": "MiraclePtr bypass due to PtrCount overflow", "url": "https://issues.chromium.org/issues/377803496", "status": "Assigned", "severity": "S3-Low", "component": "Unknown", "reporter": "ha...@gmail.com", "cve_ids": [], "bounty_amount": 100115.0, "reward_amount_meta": 100115.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-11-07T14:27:03+00:00", "year": 2024, "attachment_count": 6, "local_path": "issues/377803496", "has_markdown": true }, { "id": "377620832", "title": "Wasm type confusion due to DefaultReferenceValue() JS null for noexn type", "url": "https://issues.chromium.org/issues/377620832", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript>WebAssembly", "reporter": "se...@gmail.com", "cve_ids": [], "bounty_amount": 55000.0, "reward_amount_meta": 55000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-11-06T13:55:41+00:00", "year": 2024, "attachment_count": 2, "local_path": "issues/377620832", "has_markdown": true }, { "id": "377384894", "title": "Debug check failed: kCanBeWeak || (!IsSmi() == HAS_STRONG_HEAP_OBJECT_TAG(ptr_)).", "url": "https://issues.chromium.org/issues/377384894", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript>WebAssembly", "reporter": "jo...@gmail.com", "cve_ids": [], "bounty_amount": 8000.0, "reward_amount_meta": 8000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-11-05T04:56:43+00:00", "year": 2024, "attachment_count": 0, "local_path": "issues/377384894", "has_markdown": true }, { "id": "377321465", "title": "GPU process crash via WebGPU shader - unknown-crash at fs_nir_emit_alu in brw_fs_nir.cpp", "url": "https://issues.chromium.org/issues/377321465", "status": "Accepted", "severity": "S3-Low", "component": "Dawn>Tint", "reporter": "wg...@gmail.com", "cve_ids": [], "bounty_amount": 10000.0, "reward_amount_meta": 10000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-11-04T20:23:52+00:00", "year": 2024, "attachment_count": 1, "local_path": "issues/377321465", "has_markdown": true }, { "id": "377028617", "title": "Debug check failed: Handle v8::internal::Cast(Handle, const v8::SourceLocation &) [To = v8::internal::JSObject, From = v8::internal::Object]. in v8", "url": "https://issues.chromium.org/issues/377028617", "status": "Fixed", "severity": "S3-Low", "component": "Blink>JavaScript, Blink>JavaScript>Runtime", "reporter": "ki...@gmail.com", "cve_ids": [], "bounty_amount": 8000.0, "reward_amount_meta": 8000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-11-03T15:22:32+00:00", "year": 2024, "attachment_count": 2, "local_path": "issues/377028617", "has_markdown": true }, { "id": "377028613", "title": "Drag link 🔗 to Tab leads to the origin of an external protocol handler prompt could have been obscured with spoofing ", "url": "https://issues.chromium.org/issues/377028613", "status": "Accepted", "severity": "S3-Low", "component": "Blink>DataTransfer, UI>Browser>Navigation", "reporter": "pu...@gmail.com", "cve_ids": [], "bounty_amount": 500.0, "reward_amount_meta": 500.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-11-03T10:40:32+00:00", "year": 2024, "attachment_count": 2, "local_path": "issues/377028613", "has_markdown": true }, { "id": "376625003", "title": "Local file access restrictions in chrome.devtools can be bypassed through prototype manipulation.", "url": "https://issues.chromium.org/issues/376625003", "status": "Assigned", "severity": "S3-Low", "component": "Platform>DevTools>Extensions", "reporter": "ba...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-10-31T17:04:51+00:00", "year": 2024, "attachment_count": 4, "local_path": "issues/376625003", "has_markdown": true }, { "id": "376493203", "title": "ProfilePickerHandler UAF via UI", "url": "https://issues.chromium.org/issues/376493203", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>Profiles", "reporter": "no...@ssd-disclosure.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-10-31T09:48:28+00:00", "year": 2024, "attachment_count": 3, "local_path": "issues/376493203", "has_markdown": true }, { "id": "376491759", "title": "Tapjacking on Custom Tabs using animations", "url": "https://issues.chromium.org/issues/376491759", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>Mobile", "reporter": "ph...@gmail.com", "cve_ids": [], "bounty_amount": 10000.0, "reward_amount_meta": 10000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-10-31T09:11:02+00:00", "year": 2024, "attachment_count": 2, "local_path": "issues/376491759", "has_markdown": true }, { "id": "376497151", "title": " Extension popup can render over FEDCM prompts", "url": "https://issues.chromium.org/issues/376497151", "status": "Accepted", "severity": "S3-Low", "component": "Platform>Extensions", "reporter": "sa...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-10-31T02:21:37+00:00", "year": 2024, "attachment_count": 8, "local_path": "issues/376497151", "has_markdown": true }, { "id": "375959770", "title": "Arbitrary WASM type confusion due to module confusion in wasm-to-js tier-up", "url": "https://issues.chromium.org/issues/375959770", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript>API, Blink>JavaScript>Runtime, Blink>JavaScript>WebAssembly", "reporter": "se...@gmail.com", "cve_ids": [ "CVE-2024-10230" ], "bounty_amount": 11000.0, "reward_amount_meta": 11000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-10-28T09:37:53+00:00", "year": 2024, "attachment_count": 0, "local_path": "issues/375959770", "has_markdown": true }, { "id": "375550814", "title": "On Chrome 130.0.6723.73 on Android: there is a way website A can automatically opens chrome://chrome-urls well via Redirect blocked function", "url": "https://issues.chromium.org/issues/375550814", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>Navigation", "reporter": "du...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-10-25T09:48:33+00:00", "year": 2024, "attachment_count": 3, "local_path": "issues/375550814", "has_markdown": true }, { "id": "375317755", "title": "type confusion between ScriptWrappable and EventTarget by StorageManager", "url": "https://issues.chromium.org/issues/375317755", "status": "Assigned", "severity": "Unknown", "component": "Blink>Storage", "reporter": "m....@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-10-24T16:10:12+00:00", "year": 2024, "attachment_count": 2, "local_path": "issues/375317755", "has_markdown": true }, { "id": "375314963", "title": "Debug check failed: kCanBeWeak || (!IsSmi() == HAS_STRONG_HEAP_OBJECT_TAG(ptr_)).", "url": "https://issues.chromium.org/issues/375314963", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript>Compiler>Turbofan, Blink>JavaScript>Runtime", "reporter": "jo...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-10-24T09:39:50+00:00", "year": 2024, "attachment_count": 0, "local_path": "issues/375314963", "has_markdown": true }, { "id": "375123371", "title": "WebGPU: Out-of-bounds GPU buffer access caused by @align", "url": "https://issues.chromium.org/issues/375123371", "status": "Assigned", "severity": "S3-Low", "component": "Blink>WebGPU", "reporter": "ap...@gmail.com", "cve_ids": [], "bounty_amount": 35000.0, "reward_amount_meta": 35000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-10-23T19:07:49+00:00", "year": 2024, "attachment_count": 1, "local_path": "issues/375123371", "has_markdown": true }, { "id": "374811614", "title": "[Chrome VRP - bugSWAT] DCHECK failure in id_ != kInvalidNodeId in maglev-ir.h", "url": "https://issues.chromium.org/issues/374811614", "status": "Assigned", "severity": "S4-Minimal", "component": "Blink>JavaScript>Compiler>Maglev", "reporter": "je...@gmail.com", "cve_ids": [], "bounty_amount": 10000.0, "reward_amount_meta": 10000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-10-22T09:52:47+00:00", "year": 2024, "attachment_count": 1, "local_path": "issues/374811614", "has_markdown": true }, { "id": "374790906", "title": "Wasm type nullability confusion due to non-nullable exnref in catch(_all)_ref", "url": "https://issues.chromium.org/issues/374790906", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript>WebAssembly", "reporter": "se...@gmail.com", "cve_ids": [], "bounty_amount": 55000.0, "reward_amount_meta": 55000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-10-21T20:42:18+00:00", "year": 2024, "attachment_count": 2, "local_path": "issues/374790906", "has_markdown": true }, { "id": "374627491", "title": "DCHECK failure in Handle v8::internal::Cast(Handle, const v8::SourceLocation &) [To = v8", "url": "https://issues.chromium.org/issues/374627491", "status": "Assigned", "severity": "S4-Minimal", "component": "Blink>JavaScript, Blink>JavaScript>Runtime", "reporter": "dd...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-10-21T06:53:48+00:00", "year": 2024, "attachment_count": 1, "local_path": "issues/374627491", "has_markdown": true }, { "id": "374310077", "title": "Incomplete Fix for Issue 361782106", "url": "https://issues.chromium.org/issues/374310077", "status": "Assigned", "severity": "S3-Low", "component": "Blink>WebRTC", "reporter": "em...@gmail.com", "cve_ids": [], "bounty_amount": 11000.0, "reward_amount_meta": 11000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-10-18T21:59:30+00:00", "year": 2024, "attachment_count": 3, "local_path": "issues/374310077", "has_markdown": true }, { "id": "374285495", "title": "Chrome iOS Address Bar Spoof Using 2 RTL (Arabic Characters) Subdomains", "url": "https://issues.chromium.org/issues/374285495", "status": "Accepted", "severity": "S3-Low", "component": "Mobile>iOSWeb>Security", "reporter": "re...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-10-18T19:25:15+00:00", "year": 2024, "attachment_count": 2, "local_path": "issues/374285495", "has_markdown": true }, { "id": "374241707", "title": "Security: [webkit] heap-use-after-free in WebCore::DOMWrapperWorld::~DOMWrapperWorld()+0x25b", "url": "https://issues.chromium.org/issues/374241707", "status": "Assigned", "severity": "S3-Low", "component": "Mobile>iOSWeb", "reporter": "m....@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-10-18T13:26:05+00:00", "year": 2024, "attachment_count": 2, "local_path": "issues/374241707", "has_markdown": true }, { "id": "373794472", "title": "User can still unknowingly allow Permission Prompt Hidden behind PiP during Interaction", "url": "https://issues.chromium.org/issues/373794472", "status": "Accepted", "severity": "S3-Low", "component": "UI>Browser>Permissions", "reporter": "fa...@gmail.com", "cve_ids": [], "bounty_amount": 500.0, "reward_amount_meta": 500.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-10-16T14:30:26+00:00", "year": 2024, "attachment_count": 4, "local_path": "issues/373794472", "has_markdown": true }, { "id": "373746918", "title": "Android fullscreen notification is not shown when Chrome is in split-screen", "url": "https://issues.chromium.org/issues/373746918", "status": "Accepted", "severity": "S3-Low", "component": "Blink>Fullscreen", "reporter": "fa...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-10-16T13:24:27+00:00", "year": 2024, "attachment_count": 2, "local_path": "issues/373746918", "has_markdown": true }, { "id": "373703277", "title": "DCHECK failure in Handle v8::internal::Cast(Handle, const v8::SourceLocation &) [To = v8", "url": "https://issues.chromium.org/issues/373703277", "status": "Assigned", "severity": "S4-Minimal", "component": "Blink>JavaScript>Runtime, Blink>JavaScript>WebAssembly", "reporter": "se...@gmail.com", "cve_ids": [], "bounty_amount": 55000.0, "reward_amount_meta": 55000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-10-16T08:43:56+00:00", "year": 2024, "attachment_count": 4, "local_path": "issues/373703277", "has_markdown": true }, { "id": "373263969", "title": "Chrome Extension Isolation bypass via Link headers", "url": "https://issues.chromium.org/issues/373263969", "status": "Assigned", "severity": "S4-Minimal", "component": "Platform>Extensions", "reporter": "se...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-10-14T13:33:56+00:00", "year": 2024, "attachment_count": 2, "local_path": "issues/373263969", "has_markdown": true }, { "id": "372269618", "title": "Type confusion due to DefaultReferenceValue() `undefined` default value for kNoExtern", "url": "https://issues.chromium.org/issues/372269618", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript>WebAssembly", "reporter": "se...@gmail.com", "cve_ids": [], "bounty_amount": 55000.0, "reward_amount_meta": 55000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-10-09T08:50:31+00:00", "year": 2024, "attachment_count": 8, "local_path": "issues/372269618", "has_markdown": true }, { "id": "371565065", "title": "Arbitrary WASM type confusion due to module confusion in wasm-to-js tier-up", "url": "https://issues.chromium.org/issues/371565065", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript>API, Blink>JavaScript>Runtime, Blink>JavaScript>WebAssembly", "reporter": "se...@gmail.com", "cve_ids": [], "bounty_amount": 11000.0, "reward_amount_meta": 11000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-10-05T05:53:26+00:00", "year": 2024, "attachment_count": 2, "local_path": "issues/371565065", "has_markdown": true }, { "id": "371247955", "title": "GPU process crash via WebGPU shader - UAF in ProcessValue at DxilValueCache.cpp:555", "url": "https://issues.chromium.org/issues/371247955", "status": "Assigned", "severity": "S3-Low", "component": "Blink>WebGPU, Dawn>Tint, Internals>GPU>Dawn, Internals>GPU>Tint", "reporter": "wg...@gmail.com", "cve_ids": [], "bounty_amount": 10000.0, "reward_amount_meta": 10000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-10-04T08:56:52+00:00", "year": 2024, "attachment_count": 1, "local_path": "issues/371247955", "has_markdown": true }, { "id": "371247941", "title": "Bypass of https://issues.chromium.org/issues/333708039", "url": "https://issues.chromium.org/issues/371247941", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Geometry", "reporter": "sa...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-10-03T21:19:14+00:00", "year": 2024, "attachment_count": 7, "local_path": "issues/371247941", "has_markdown": true }, { "id": "371011220", "title": "Chrome Extension context isolation bypass.", "url": "https://issues.chromium.org/issues/371011220", "status": "Assigned", "severity": "S3-Low", "component": "Platform>Extensions", "reporter": "se...@gmail.com", "cve_ids": [], "bounty_amount": 10000.0, "reward_amount_meta": 10000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-10-02T19:32:32+00:00", "year": 2024, "attachment_count": 9, "local_path": "issues/371011220", "has_markdown": true }, { "id": "370856871", "title": "Compromised renderer can control your mouse and escape sbx", "url": "https://issues.chromium.org/issues/370856871", "status": "Assigned", "severity": "S3-Low", "component": "Internals>Views", "reporter": "ha...@gmail.com", "cve_ids": [], "bounty_amount": 50000.0, "reward_amount_meta": 50000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-10-02T16:35:03+00:00", "year": 2024, "attachment_count": 15, "local_path": "issues/370856871", "has_markdown": true }, { "id": "370425451", "title": "UAF in gl::ErrorSet::handleError(ANGLE for Metal)", "url": "https://issues.chromium.org/issues/370425451", "status": "Assigned", "severity": "S3-Low", "component": "Internals>GPU>ANGLE", "reporter": "em...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-09-30T14:40:45+00:00", "year": 2024, "attachment_count": 2, "local_path": "issues/370425451", "has_markdown": true }, { "id": "370217726", "title": "UAF in SupervisedUserGoogleAuthNavigationThrottle::WillStartOrRedirectRequest", "url": "https://issues.chromium.org/issues/370217726", "status": "Assigned", "severity": "S3-Low", "component": "FamilyExperiences>Browser", "reporter": "jt...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-09-29T08:50:38+00:00", "year": 2024, "attachment_count": 4, "local_path": "issues/370217726", "has_markdown": true }, { "id": "370133761", "title": "UAF in EnclaveWebSocketClient::OnConnectionEstablished", "url": "https://issues.chromium.org/issues/370133761", "status": "Assigned", "severity": "S3-Low", "component": "Blink>WebAuthentication", "reporter": "jt...@gmail.com", "cve_ids": [], "bounty_amount": 6000.0, "reward_amount_meta": 6000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-09-29T05:09:11+00:00", "year": 2024, "attachment_count": 2, "local_path": "issues/370133761", "has_markdown": true }, { "id": "370069678", "title": "Heap-use-after-free in · content::CacheStorageScheduler::CompleteOperationAndRunNext", "url": "https://issues.chromium.org/issues/370069678", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Storage>CacheStorage", "reporter": "m....@gmail.com", "cve_ids": [], "bounty_amount": 6000.0, "reward_amount_meta": 6000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-09-28T10:34:44+00:00", "year": 2024, "attachment_count": 10, "local_path": "issues/370069678", "has_markdown": true }, { "id": "368628042", "title": "FencedFrame allows loading local file directories in http(s?) context", "url": "https://issues.chromium.org/issues/368628042", "status": "Assigned", "severity": "S3-Low", "component": "Blink>FencedFrames", "reporter": "so...@proton.me", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-09-21T13:56:56+00:00", "year": 2024, "attachment_count": 3, "local_path": "issues/368628042", "has_markdown": true }, { "id": "368672129", "title": "heap-use-after-free in blink::InspectorPageAgent::EvaluateScriptOnNewDocument", "url": "https://issues.chromium.org/issues/368672129", "status": "Assigned", "severity": "S3-Low", "component": "Platform>DevTools", "reporter": "as...@gmail.com", "cve_ids": [], "bounty_amount": 4000.0, "reward_amount_meta": 4000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-09-21T12:44:40+00:00", "year": 2024, "attachment_count": 3, "local_path": "issues/368672129", "has_markdown": true }, { "id": "368241697", "title": "Type confusion due to improper WASM module size check in `AsyncStreamingDecoder`", "url": "https://issues.chromium.org/issues/368241697", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript>WebAssembly", "reporter": "se...@gmail.com", "cve_ids": [], "bounty_amount": 55000.0, "reward_amount_meta": 55000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-09-20T06:09:23+00:00", "year": 2024, "attachment_count": 4, "local_path": "issues/368241697", "has_markdown": true }, { "id": "368208152", "title": "Out-of-bounds write in ipcz while deserializing message", "url": "https://issues.chromium.org/issues/368208152", "status": "Assigned", "severity": "S3-Low", "component": "Internals>Mojo>Core", "reporter": "bl...@gmail.com", "cve_ids": [], "bounty_amount": 35000.0, "reward_amount_meta": 35000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-09-19T15:15:56+00:00", "year": 2024, "attachment_count": 2, "local_path": "issues/368208152", "has_markdown": true }, { "id": "368222741", "title": "heap-use-after-free cc\\tiles\\gpu_image_decode_cache.cc:2469 in cc::GpuImageDecodeCache::DecodeImageIfNecessary", "url": "https://issues.chromium.org/issues/368222741", "status": "Assigned", "severity": "S3-Low", "component": "Internals>Compositing", "reporter": "m....@gmail.com", "cve_ids": [], "bounty_amount": 4000.0, "reward_amount_meta": 4000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-09-19T10:35:58+00:00", "year": 2024, "attachment_count": 4, "local_path": "issues/368222741", "has_markdown": true }, { "id": "367764861", "title": "Security DCHECK failed at string_view.h: length <= impl.length() - offset", "url": "https://issues.chromium.org/issues/367764861", "status": "Assigned", "severity": "S4-Minimal", "component": "Blink>Layout>Ruby", "reporter": "ta...@gmail.com", "cve_ids": [], "bounty_amount": 10000.0, "reward_amount_meta": 10000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-09-18T08:13:14+00:00", "year": 2024, "attachment_count": 2, "local_path": "issues/367764861", "has_markdown": true }, { "id": "367771116", "title": "Extension popup can render over downloaded file prompts", "url": "https://issues.chromium.org/issues/367771116", "status": "Accepted", "severity": "S3-Low", "component": "Platform>Extensions", "reporter": "sa...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-09-18T07:40:09+00:00", "year": 2024, "attachment_count": 11, "local_path": "issues/367771116", "has_markdown": true }, { "id": "367818758", "title": "invariant of cve-2024-7550", "url": "https://issues.chromium.org/issues/367818758", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript>Compiler, Blink>JavaScript>WebAssembly", "reporter": "in...@starlabs.sg", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-09-18T03:18:51+00:00", "year": 2024, "attachment_count": 1, "local_path": "issues/367818758", "has_markdown": true }, { "id": "367755363", "title": "UAF in AIContextBoundObjectSet::GetFromContext", "url": "https://issues.chromium.org/issues/367755363", "status": "Assigned", "severity": "S3-Low", "component": "Blink>AI", "reporter": "vu...@darknavy.com", "cve_ids": [], "bounty_amount": 36000.0, "reward_amount_meta": 36000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-09-18T01:54:34+00:00", "year": 2024, "attachment_count": 8, "local_path": "issues/367755363", "has_markdown": true }, { "id": "367475557", "title": "race condition on pip window lead to spoof address bar", "url": "https://issues.chromium.org/issues/367475557", "status": "Accepted", "severity": "S3-Low", "component": "Blink>Media>PictureInPicture", "reporter": "sa...@gmail.com", "cve_ids": [], "bounty_amount": 500.0, "reward_amount_meta": 500.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-09-17T13:58:11+00:00", "year": 2024, "attachment_count": 4, "local_path": "issues/367475557", "has_markdown": true }, { "id": "367401496", "title": "Unable to Uninstall PWA Due to Excessive Emoji in App Name Blocking UI", "url": "https://issues.chromium.org/issues/367401496", "status": "Assigned", "severity": "Unknown", "component": "UI>Browser>WebAppInstalls>Desktop", "reporter": "al...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-09-17T06:09:43+00:00", "year": 2024, "attachment_count": 6, "local_path": "issues/367401496", "has_markdown": true }, { "id": "366783804", "title": "Crash in blink::V8Initializer::ExceptionPropagationCallback", "url": "https://issues.chromium.org/issues/366783804", "status": "Assigned", "severity": "S4-Minimal", "component": "Blink>Bindings, Blink>JavaScript>Runtime", "reporter": "m....@gmail.com", "cve_ids": [], "bounty_amount": 9000.0, "reward_amount_meta": 9000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-09-15T16:58:57+00:00", "year": 2024, "attachment_count": 0, "local_path": "issues/366783804", "has_markdown": true }, { "id": "366375482", "title": "Able to bypass URLBlocklist policy via custom_background_image", "url": "https://issues.chromium.org/issues/366375482", "status": "Assigned", "severity": "S3-Low", "component": "Enterprise, UI>Browser>New Tab Page (use subcomponent)>Desktop", "reporter": "cp...@gmail.com", "cve_ids": [], "bounty_amount": 500.0, "reward_amount_meta": 500.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-09-13T16:36:22+00:00", "year": 2024, "attachment_count": 0, "local_path": "issues/366375482", "has_markdown": true }, { "id": "366381662", "title": "Maglev's incorrect object tracking may lead to RCE vulnerability", "url": "https://issues.chromium.org/issues/366381662", "status": "Assigned", "severity": "S4-Minimal", "component": "Blink>JavaScript, Blink>JavaScript>Compiler>Maglev", "reporter": "hu...@gmail.com", "cve_ids": [], "bounty_amount": 10000.0, "reward_amount_meta": 10000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-09-13T14:22:17+00:00", "year": 2024, "attachment_count": 0, "local_path": "issues/366381662", "has_markdown": true }, { "id": "366056651", "title": "Unintended File Upload via `webkitdirectory` triggered by Keyboard interactions on macOS Chrome", "url": "https://issues.chromium.org/issues/366056651", "status": "Accepted", "severity": "S3-Low", "component": "Blink>Forms>File>Directory", "reporter": "fa...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-09-12T11:04:35+00:00", "year": 2024, "attachment_count": 5, "local_path": "issues/366056651", "has_markdown": true }, { "id": "365884464", "title": "out of bound write in skia DrawAtlasOpImpl::DrawAtlasOpImpl", "url": "https://issues.chromium.org/issues/365884464", "status": "Assigned", "severity": "S3-Low", "component": "Internals>Skia", "reporter": "wx...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-09-11T14:43:46+00:00", "year": 2024, "attachment_count": 1, "local_path": "issues/365884464", "has_markdown": true }, { "id": "365802567", "title": "WASM type confusion due to imported tag signature subtyping", "url": "https://issues.chromium.org/issues/365802567", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript>WebAssembly", "reporter": "se...@gmail.com", "cve_ids": [], "bounty_amount": 55000.0, "reward_amount_meta": 55000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-09-10T23:48:08+00:00", "year": 2024, "attachment_count": 2, "local_path": "issues/365802567", "has_markdown": true }, { "id": "365802556", "title": "Security: Potential Use-After-Free in GetAttrSubstitutionValue\n", "url": "https://issues.chromium.org/issues/365802556", "status": "Accepted", "severity": "S3-Low", "component": "Blink>CSS", "reporter": "kd...@gmail.com", "cve_ids": [], "bounty_amount": 11000.0, "reward_amount_meta": 11000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-09-10T18:45:23+00:00", "year": 2024, "attachment_count": 5, "local_path": "issues/365802556", "has_markdown": true }, { "id": "365516486", "title": "UaF in LensOverlayBlurLayerDelegate::FetchBackgroundImage", "url": "https://issues.chromium.org/issues/365516486", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser", "reporter": "ch...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-09-09T16:15:00+00:00", "year": 2024, "attachment_count": 2, "local_path": "issues/365516486", "has_markdown": true }, { "id": "365376497", "title": "JSPI stack switching breaks lazy deoptimization guarantees, leading to type confusion", "url": "https://issues.chromium.org/issues/365376497", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript>WebAssembly", "reporter": "ma...@popax21.dev", "cve_ids": [], "bounty_amount": 55000.0, "reward_amount_meta": 55000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-09-08T19:57:12+00:00", "year": 2024, "attachment_count": 5, "local_path": "issues/365376497", "has_markdown": true }, { "id": "365254285", "title": "GPU process crash via WebGPU shader - UAF in ScalarizePreciseVectorAlloca at DxilConditionalMem2Reg.cpp:275", "url": "https://issues.chromium.org/issues/365254285", "status": "Assigned", "severity": "S3-Low", "component": "Dawn>Tint", "reporter": "a7...@gmail.com", "cve_ids": [], "bounty_amount": 10000.0, "reward_amount_meta": 10000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-09-08T14:24:13+00:00", "year": 2024, "attachment_count": 3, "local_path": "issues/365254285", "has_markdown": true }, { "id": "365089001", "title": "Select Option can be opened on top of Popups with Different Origins and can be used to Spoof important Security Prompts", "url": "https://issues.chromium.org/issues/365089001", "status": "Accepted", "severity": "S3-Low", "component": "Blink>Forms>Select", "reporter": "fa...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-09-06T19:23:43+00:00", "year": 2024, "attachment_count": 9, "local_path": "issues/365089001", "has_markdown": true }, { "id": "364773822", "title": "Non-error pages can reuse the error page policy container", "url": "https://issues.chromium.org/issues/364773822", "status": "Accepted", "severity": "S3-Low", "component": "Blink>SecurityFeature>PolicyContainer, UI>Browser>Navigation", "reporter": "ha...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-09-05T07:15:26+00:00", "year": 2024, "attachment_count": 1, "local_path": "issues/364773822", "has_markdown": true }, { "id": "364508693", "title": "User can unknowingly Permission Prompt Hidden behind PiP during Interaction", "url": "https://issues.chromium.org/issues/364508693", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>Permissions, UI>Browser>Permissions>Prompts", "reporter": "fa...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-09-04T18:08:19+00:00", "year": 2024, "attachment_count": 3, "local_path": "issues/364508693", "has_markdown": true }, { "id": "364508691", "title": "Security: `Android` Top-level redirect from cross-origin iframe by setting `Content-Security-Policy: sandbox allow-top-navigation` Bypass of Issue 1251790", "url": "https://issues.chromium.org/issues/364508691", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>PopupBlocker", "reporter": "el...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-09-04T17:21:08+00:00", "year": 2024, "attachment_count": 4, "local_path": "issues/364508691", "has_markdown": true }, { "id": "364119468", "title": "Clickjacking on permission prompt using PIP", "url": "https://issues.chromium.org/issues/364119468", "status": "Accepted", "severity": "S3-Low", "component": "Blink>Media>PictureInPicture, UI>Browser>Permissions, UI>Browser>Permissions>Prompts", "reporter": "sa...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-09-03T10:51:51+00:00", "year": 2024, "attachment_count": 8, "local_path": "issues/364119468", "has_markdown": true }, { "id": "363930141", "title": "User can unknowingly Execute External File Hidden behind PiP during Interaction", "url": "https://issues.chromium.org/issues/363930141", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Media>PictureInPicture", "reporter": "fa...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-09-02T10:14:17+00:00", "year": 2024, "attachment_count": 3, "local_path": "issues/363930141", "has_markdown": true }, { "id": "363538434", "title": "DCHECK on V8 Parser while parsing Class Static Functions", "url": "https://issues.chromium.org/issues/363538434", "status": "Assigned", "severity": "S4-Minimal", "component": "Blink>JavaScript>Parser", "reporter": "ta...@gmail.com", "cve_ids": [], "bounty_amount": 8000.0, "reward_amount_meta": 8000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-09-01T16:07:19+00:00", "year": 2024, "attachment_count": 2, "local_path": "issues/363538434", "has_markdown": true }, { "id": "363640098", "title": "Security: Download notification can hide 'Press Esc to exit fullscreen and see download' warning", "url": "https://issues.chromium.org/issues/363640098", "status": "Accepted", "severity": "S3-Low", "component": "UI>Browser>Bubbles>Download", "reporter": "al...@gmail.com", "cve_ids": [], "bounty_amount": 500.0, "reward_amount_meta": 500.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-09-01T10:39:50+00:00", "year": 2024, "attachment_count": 4, "local_path": "issues/363640098", "has_markdown": true }, { "id": "362780326", "title": "WebAssembly OOB memory access due to cached memory index confusion", "url": "https://issues.chromium.org/issues/362780326", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript>WebAssembly", "reporter": "se...@gmail.com", "cve_ids": [], "bounty_amount": 20000.0, "reward_amount_meta": 20000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-08-29T02:39:37+00:00", "year": 2024, "attachment_count": 3, "local_path": "issues/362780326", "has_markdown": true }, { "id": "362658609", "title": "security: heap-use-after-free on TouchToFillPaymentMethodControllerBridge_jni.h:31:108", "url": "https://issues.chromium.org/issues/362658609", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>Autofill, UI>Browser>Autofill>Payments", "reporter": "li...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-08-28T14:09:57+00:00", "year": 2024, "attachment_count": 8, "local_path": "issues/362658609", "has_markdown": true }, { "id": "362539773", "title": "Debug check failed: HasWasmExportedFunctionData(). in v8", "url": "https://issues.chromium.org/issues/362539773", "status": "Assigned", "severity": "S4-Minimal", "component": "Blink>JavaScript>Runtime, Blink>JavaScript>WebAssembly", "reporter": "ki...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-08-28T02:13:18+00:00", "year": 2024, "attachment_count": 1, "local_path": "issues/362539773", "has_markdown": true }, { "id": "361862752", "title": "V8 Sandbox Bypass: compiled JS-to-WASM wrappers don't guard against `trusted_function_data` overwrites", "url": "https://issues.chromium.org/issues/361862752", "status": "Fixed", "severity": "S4-Minimal", "component": "Blink>JavaScript>WebAssembly", "reporter": "ma...@popax21.dev", "cve_ids": [ "CVE-2024-12053" ], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-08-25T01:37:56+00:00", "year": 2024, "attachment_count": 2, "local_path": "issues/361862752", "has_markdown": true }, { "id": "361782106", "title": "use-after-poison in mojo::SimpleWatcher::OnHandleReady", "url": "https://issues.chromium.org/issues/361782106", "status": "Assigned", "severity": "S3-Low", "component": "Blink>WebRTC", "reporter": "em...@gmail.com", "cve_ids": [], "bounty_amount": 8000.0, "reward_amount_meta": 8000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-08-24T07:05:55+00:00", "year": 2024, "attachment_count": 2, "local_path": "issues/361782106", "has_markdown": true }, { "id": "361784548", "title": "heap-use-after-free on media_router::MediaRouterDialogControllerAndroid::CancelPresentationRequest", "url": "https://issues.chromium.org/issues/361784548", "status": "Assigned", "severity": "S4-Minimal", "component": "Blink>PresentationAPI", "reporter": "li...@gmail.com", "cve_ids": [], "bounty_amount": 11000.0, "reward_amount_meta": 11000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-08-23T19:56:19+00:00", "year": 2024, "attachment_count": 8, "local_path": "issues/361784548", "has_markdown": true }, { "id": "361711121", "title": " Extension popup can render over Request Payment prompts", "url": "https://issues.chromium.org/issues/361711121", "status": "Accepted", "severity": "S3-Low", "component": "Platform>Extensions", "reporter": "sa...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-08-23T17:58:07+00:00", "year": 2024, "attachment_count": 3, "local_path": "issues/361711121", "has_markdown": true }, { "id": "361611809", "title": "[Security] Tapjacking on payment request dialog using window alert", "url": "https://issues.chromium.org/issues/361611809", "status": "Accepted", "severity": "S3-Low", "component": "Blink>Payments", "reporter": "sa...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-08-23T09:23:59+00:00", "year": 2024, "attachment_count": 6, "local_path": "issues/361611809", "has_markdown": true }, { "id": "361461526", "title": "Integer overflow in Skia GrMeshDrawOp::PatternHelper::init leads to OOB write", "url": "https://issues.chromium.org/issues/361461526", "status": "Assigned", "severity": "S3-Low", "component": "Internals>Skia", "reporter": "hy...@gmail.com", "cve_ids": [], "bounty_amount": 15000.0, "reward_amount_meta": 15000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-08-22T14:10:21+00:00", "year": 2024, "attachment_count": 3, "local_path": "issues/361461526", "has_markdown": true }, { "id": "361369296", "title": "OOB in JSC::StackVisitor::readFrame in webkit/chrome ios", "url": "https://issues.chromium.org/issues/361369296", "status": "Accepted", "severity": "S3-Low", "component": "Mobile>iOSWeb", "reporter": "je...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-08-22T02:51:34+00:00", "year": 2024, "attachment_count": 3, "local_path": "issues/361369296", "has_markdown": true }, { "id": "361116749", "title": "CSP doesn't block sourceMappingURL", "url": "https://issues.chromium.org/issues/361116749", "status": "Accepted", "severity": "S3-Low", "component": "Platform>DevTools>Sources", "reporter": "no...@applitools.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-08-20T19:06:16+00:00", "year": 2024, "attachment_count": 0, "local_path": "issues/361116749", "has_markdown": true }, { "id": "361027508", "title": "GPU process crash via WebGPU shader - UAF in mesa gcm_schedule_early_instr at src/compiler/nir/nir_opt_gcm.c:477", "url": "https://issues.chromium.org/issues/361027508", "status": "Accepted", "severity": "S3-Low", "component": "Internals>GPU", "reporter": "a7...@gmail.com", "cve_ids": [], "bounty_amount": 10000.0, "reward_amount_meta": 10000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-08-20T17:02:15+00:00", "year": 2024, "attachment_count": 1, "local_path": "issues/361027508", "has_markdown": true }, { "id": "360758697", "title": "Integer overflow in Skia RegionOpImpl::onPrepareDraws leads to OOB write", "url": "https://issues.chromium.org/issues/360758697", "status": "Assigned", "severity": "S3-Low", "component": "Internals>Skia", "reporter": "hy...@gmail.com", "cve_ids": [], "bounty_amount": 15000.0, "reward_amount_meta": 15000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-08-19T14:02:30+00:00", "year": 2024, "attachment_count": 5, "local_path": "issues/360758697", "has_markdown": true }, { "id": "360533914", "title": "Arbitrary WASM type confusion due to incomplete fix of CVE-2024-6100", "url": "https://issues.chromium.org/issues/360533914", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript>WebAssembly", "reporter": "se...@gmail.com", "cve_ids": [ "CVE-2024-6100" ], "bounty_amount": 55000.0, "reward_amount_meta": 55000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-08-18T22:31:02+00:00", "year": 2024, "attachment_count": 2, "local_path": "issues/360533914", "has_markdown": true }, { "id": "360520332", "title": "Google Chrome on iOS sad tabs with the following testcase.", "url": "https://issues.chromium.org/issues/360520332", "status": "Accepted", "severity": "S3-Low", "component": "Mobile>iOSWeb>Security", "reporter": "nt...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-08-18T20:05:43+00:00", "year": 2024, "attachment_count": 1, "local_path": "issues/360520332", "has_markdown": true }, { "id": "360520331", "title": "Clickjacking Exploit Leading to Unintentional Credit Card Submission in Chrome iOS", "url": "https://issues.chromium.org/issues/360520331", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>Autofill>Payments", "reporter": "ia...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-08-18T18:14:12+00:00", "year": 2024, "attachment_count": 3, "local_path": "issues/360520331", "has_markdown": true }, { "id": "360642942", "title": "Multiple Vulnerability Address Bar Spoofing to XSS via Recent Search", "url": "https://issues.chromium.org/issues/360642942", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>Omnibox", "reporter": "gh...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-08-18T16:57:54+00:00", "year": 2024, "attachment_count": 22, "local_path": "issues/360642942", "has_markdown": true }, { "id": "360265320", "title": "[Skia] Integer overflow in MeshOp::onCombineIfPossible", "url": "https://issues.chromium.org/issues/360265320", "status": "Assigned", "severity": "S3-Low", "component": "Internals>Skia", "reporter": "hy...@gmail.com", "cve_ids": [ "CVE-2023-6345" ], "bounty_amount": 15000.0, "reward_amount_meta": 15000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-08-16T17:32:56+00:00", "year": 2024, "attachment_count": 4, "local_path": "issues/360265320", "has_markdown": true }, { "id": "360274917", "title": "Security: Heap-use-after-free in the ReadAnythingAppController::Install", "url": "https://issues.chromium.org/issues/360274917", "status": "Assigned", "severity": "S3-Low", "component": "UI>Accessibility, UI>Accessibility>ReadingMode", "reporter": "me...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-08-16T09:44:18+00:00", "year": 2024, "attachment_count": 0, "local_path": "issues/360274917", "has_markdown": true }, { "id": "360044696", "title": "Fatal error in ../../src/compiler/turboshaft/assembler.h, line 1028", "url": "https://issues.chromium.org/issues/360044696", "status": "Assigned", "severity": "S4-Minimal", "component": "Blink>JavaScript>Compiler", "reporter": "sw...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-08-15T14:45:24+00:00", "year": 2024, "attachment_count": 2, "local_path": "issues/360044696", "has_markdown": true }, { "id": "360052650", "title": "Fatal error in ../../src/compiler/turboshaft/graph.h, line 613", "url": "https://issues.chromium.org/issues/360052650", "status": "Assigned", "severity": "S4-Minimal", "component": "Blink>JavaScript, Blink>JavaScript>Compiler", "reporter": "sw...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-08-15T10:31:26+00:00", "year": 2024, "attachment_count": 1, "local_path": "issues/360052650", "has_markdown": true }, { "id": "359909532", "title": "GPU process crash via WebGPU shader (Linux): OOB in mark_src_live mesa/src/compiler/nir/nir_opt_dce.c:39:9", "url": "https://issues.chromium.org/issues/359909532", "status": "Verified", "severity": "S3-Low", "component": "Blink>WebGPU", "reporter": "wg...@gmail.com", "cve_ids": [], "bounty_amount": 10000.0, "reward_amount_meta": 10000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-08-15T08:45:37+00:00", "year": 2024, "attachment_count": 3, "local_path": "issues/359909532", "has_markdown": true }, { "id": "359949844", "title": " Extension popup can render over PWA prompts ", "url": "https://issues.chromium.org/issues/359949844", "status": "Accepted", "severity": "S3-Low", "component": "Platform>Extensions", "reporter": "sa...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-08-15T06:52:01+00:00", "year": 2024, "attachment_count": 4, "local_path": "issues/359949844", "has_markdown": true }, { "id": "359949835", "title": "Unexpected instance type encountered", "url": "https://issues.chromium.org/issues/359949835", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript>Runtime, Blink>JavaScript>WebAssembly", "reporter": "wh...@gmail.com", "cve_ids": [], "bounty_amount": 8000.0, "reward_amount_meta": 8000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-08-15T01:35:23+00:00", "year": 2024, "attachment_count": 2, "local_path": "issues/359949835", "has_markdown": true }, { "id": "359729268", "title": "Signal SIGSEGV in v", "url": "https://issues.chromium.org/issues/359729268", "status": "Assigned", "severity": "S4-Minimal", "component": "Blink>JavaScript>API, Blink>JavaScript>Runtime", "reporter": "ki...@gmail.com", "cve_ids": [], "bounty_amount": 8000.0, "reward_amount_meta": 8000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-08-14T15:14:25+00:00", "year": 2024, "attachment_count": 1, "local_path": "issues/359729268", "has_markdown": true }, { "id": "358485426", "title": "SEGV in v8::internal::Scavenger::Process", "url": "https://issues.chromium.org/issues/358485426", "status": "Assigned", "severity": "S4-Minimal", "component": "Blink>JavaScript>GarbageCollection", "reporter": "em...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-08-09T12:50:14+00:00", "year": 2024, "attachment_count": 2, "local_path": "issues/358485426", "has_markdown": true }, { "id": "358296941", "title": "UAF in NoPasskeysBottomSheetBridge::OnDismissed", "url": "https://issues.chromium.org/issues/358296941", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>Passwords", "reporter": "jt...@gmail.com", "cve_ids": [], "bounty_amount": 36000.0, "reward_amount_meta": 36000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-08-08T13:18:24+00:00", "year": 2024, "attachment_count": 4, "local_path": "issues/358296941", "has_markdown": true }, { "id": "358151317", "title": "heap-use-after-free on [PriceNotificationsPriceTrackingMediator navigateToWebpageForURL]", "url": "https://issues.chromium.org/issues/358151317", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>Mobile", "reporter": "li...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-08-08T05:39:38+00:00", "year": 2024, "attachment_count": 5, "local_path": "issues/358151317", "has_markdown": true }, { "id": "357776197", "title": "heap-use-after-free on [ParcelTrackingOptInMediator didTapAlwaysTrack]", "url": "https://issues.chromium.org/issues/357776197", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>ParcelTracking", "reporter": "li...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-08-06T09:57:53+00:00", "year": 2024, "attachment_count": 4, "local_path": "issues/357776197", "has_markdown": true }, { "id": "357484640", "title": " GPU process crash via WebGL2 shader - dynamic-stack-buffer-overflow in hash_phi", "url": "https://issues.chromium.org/issues/357484640", "status": "Assigned", "severity": "S3-Low", "component": "Blink>WebGL, Blink>WebGPU", "reporter": "wg...@gmail.com", "cve_ids": [], "bounty_amount": 10000.0, "reward_amount_meta": 10000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-08-05T11:36:07+00:00", "year": 2024, "attachment_count": 2, "local_path": "issues/357484640", "has_markdown": true }, { "id": "357391257", "title": "memory corruption in blink::Delay::ProcessARateScalar", "url": "https://issues.chromium.org/issues/357391257", "status": "Assigned", "severity": "S3-Low", "component": "Blink>WebAudio", "reporter": "em...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-08-05T07:13:58+00:00", "year": 2024, "attachment_count": 3, "local_path": "issues/357391257", "has_markdown": true }, { "id": "356658477", "title": "Android Chrome External Navigation Bubble Tapjacking", "url": "https://issues.chromium.org/issues/356658477", "status": "Assigned", "severity": "S3-Low", "component": "Mobile>Intents", "reporter": "sh...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-07-31T19:04:14+00:00", "year": 2024, "attachment_count": 2, "local_path": "issues/356658477", "has_markdown": true }, { "id": "356423094", "title": "Security: heap-use-after-free in webrtc::VSyncEncodeAdapterMode::EncodeAllEnqueuedFrames", "url": "https://issues.chromium.org/issues/356423094", "status": "Assigned", "severity": "S4-Minimal", "component": "Blink>WebRTC", "reporter": "zh...@gmail.com", "cve_ids": [], "bounty_amount": 8000.0, "reward_amount_meta": 8000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-07-31T08:47:55+00:00", "year": 2024, "attachment_count": 14, "local_path": "issues/356423094", "has_markdown": true }, { "id": "356423093", "title": "Security: segment fault in dawn DXC", "url": "https://issues.chromium.org/issues/356423093", "status": "Assigned", "severity": "S3-Low", "component": "Blink>WebGL", "reporter": "de...@gmail.com", "cve_ids": [], "bounty_amount": 10000.0, "reward_amount_meta": 10000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-07-31T08:38:41+00:00", "year": 2024, "attachment_count": 2, "local_path": "issues/356423093", "has_markdown": true }, { "id": "356328460", "title": "\nChromium arbitrary file create/write and execute vulnerability", "url": "https://issues.chromium.org/issues/356328460", "status": "Assigned", "severity": "S3-Low", "component": "Internals>Installer", "reporter": "in...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-07-30T13:49:25+00:00", "year": 2024, "attachment_count": 2, "local_path": "issues/356328460", "has_markdown": true }, { "id": "356196918", "title": "Improper optimization of ZeroExtendsWord32ToWord64() leads to Memory Corruption", "url": "https://issues.chromium.org/issues/356196918", "status": "Assigned", "severity": "S4-Minimal", "component": "Blink>JavaScript, Blink>JavaScript>API, Blink>JavaScript>Compiler>Turbofan, Blink>JavaScript>Runtime", "reporter": "ch...@gmail.com", "cve_ids": [], "bounty_amount": 11000.0, "reward_amount_meta": 11000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-07-30T10:02:17+00:00", "year": 2024, "attachment_count": 0, "local_path": "issues/356196918", "has_markdown": true }, { "id": "356064205", "title": "Chromium arbitrary file create/write vulnerability", "url": "https://issues.chromium.org/issues/356064205", "status": "Assigned", "severity": "S3-Low", "component": "Internals>Installer", "reporter": "in...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-07-29T14:28:23+00:00", "year": 2024, "attachment_count": 1, "local_path": "issues/356064205", "has_markdown": true }, { "id": "355870166", "title": "Signal SIGSEGV in v8", "url": "https://issues.chromium.org/issues/355870166", "status": "Assigned", "severity": "S4-Minimal", "component": "Blink>JavaScript>Regexp", "reporter": "ki...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-07-28T16:14:22+00:00", "year": 2024, "attachment_count": 1, "local_path": "issues/355870166", "has_markdown": true }, { "id": "355731798", "title": "Heap-Buffer-Overflow on Blink Renderer leads to Segmentation Fault", "url": "https://issues.chromium.org/issues/355731798", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Fonts", "reporter": "ta...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-07-27T11:50:53+00:00", "year": 2024, "attachment_count": 2, "local_path": "issues/355731798", "has_markdown": true }, { "id": "355465305", "title": "OOB write in SkSLRasterPipelineBuilder", "url": "https://issues.chromium.org/issues/355465305", "status": "Assigned", "severity": "S3-Low", "component": "Internals>Skia", "reporter": "hy...@gmail.com", "cve_ids": [], "bounty_amount": 10000.0, "reward_amount_meta": 10000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-07-25T18:54:53+00:00", "year": 2024, "attachment_count": 5, "local_path": "issues/355465305", "has_markdown": true }, { "id": "355256380", "title": "Type Confusion between WasmObject and JSObject in V8 MaglevGraphBuilder::TryBuildFastOrdinaryHasInstance", "url": "https://issues.chromium.org/issues/355256380", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript>WebAssembly", "reporter": "ki...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-07-25T02:50:06+00:00", "year": 2024, "attachment_count": 1, "local_path": "issues/355256380", "has_markdown": true }, { "id": "355139788", "title": "UAF in FacilitatedPaymentsPaymentMethodsControllerBridge", "url": "https://issues.chromium.org/issues/355139788", "status": "Verified", "severity": "S3-Low", "component": "UI>Browser>Autofill>Payments", "reporter": "jt...@gmail.com", "cve_ids": [], "bounty_amount": 36000.0, "reward_amount_meta": 36000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-07-24T13:27:12+00:00", "year": 2024, "attachment_count": 4, "local_path": "issues/355139788", "has_markdown": true }, { "id": "354847246", "title": "UAF in blink::AudioBus::Zero()", "url": "https://issues.chromium.org/issues/354847246", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Media>Audio, Blink>WebAudio", "reporter": "em...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-07-23T17:11:20+00:00", "year": 2024, "attachment_count": 5, "local_path": "issues/354847246", "has_markdown": true }, { "id": "354882231", "title": "site information change url to about:blank#https://google.com", "url": "https://issues.chromium.org/issues/354882231", "status": "Accepted", "severity": "S3-Low", "component": "UI>Browser>Mobile>CustomTabs", "reporter": "bh...@gmail.com", "cve_ids": [], "bounty_amount": 500.0, "reward_amount_meta": 500.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-07-23T12:39:18+00:00", "year": 2024, "attachment_count": 8, "local_path": "issues/354882231", "has_markdown": true }, { "id": "354824998", "title": "heap-use-after-free on content::OverlayStateObserverImpl::Create", "url": "https://issues.chromium.org/issues/354824998", "status": "Fixed", "severity": "S3-Low", "component": "Internals>Media", "reporter": "ki...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-07-23T10:25:40+00:00", "year": 2024, "attachment_count": 4, "local_path": "issues/354824998", "has_markdown": true }, { "id": "354748063", "title": "heap-use-after-free dawn\\src\\dawn\\native\\Device.cpp:285 in dawn::native::DeviceBase::DeviceLostEvent::Complete", "url": "https://issues.chromium.org/issues/354748063", "status": "Assigned", "severity": "S3-Low", "component": "Dawn>Native", "reporter": "m....@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-07-23T03:39:01+00:00", "year": 2024, "attachment_count": 1, "local_path": "issues/354748063", "has_markdown": true }, { "id": "354748060", "title": "Security: Internal Compiler Error(OpTypeFunction may not take more than 255 arguments. OpTypeFunction '267[%267]' has 256 arguments) in tint::spirv::writer::IRFuzzer", "url": "https://issues.chromium.org/issues/354748060", "status": "Assigned", "severity": "S3-Low", "component": "Dawn>Tint", "reporter": "de...@gmail.com", "cve_ids": [], "bounty_amount": 10000.0, "reward_amount_meta": 10000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-07-23T02:43:34+00:00", "year": 2024, "attachment_count": 2, "local_path": "issues/354748060", "has_markdown": true }, { "id": "354627692", "title": "Security: Internal Compiler Error(The continue construct with the continue target '16[%16]' is not structurally post dominated by the back-edge block '38[%38]') in tint::spirv::writer::IRFuzzer", "url": "https://issues.chromium.org/issues/354627692", "status": "Assigned", "severity": "S3-Low", "component": "Dawn>Tint", "reporter": "de...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-07-22T10:34:04+00:00", "year": 2024, "attachment_count": 2, "local_path": "issues/354627692", "has_markdown": true }, { "id": "354408144", "title": "V8 Sandbox Bypass: AAR/W via WASM signature confusion in Wasm-to-JS wrapper through PodArrayOfWasmValueType overwrite", "url": "https://issues.chromium.org/issues/354408144", "status": "Verified", "severity": "S4-Minimal", "component": "Blink>JavaScript>WebAssembly", "reporter": "se...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-07-21T06:24:37+00:00", "year": 2024, "attachment_count": 2, "local_path": "issues/354408144", "has_markdown": true }, { "id": "353628445", "title": "Security: SEGV_ACCERR in V8", "url": "https://issues.chromium.org/issues/353628445", "status": "Assigned", "severity": "S4-Minimal", "component": "Blink>JavaScript>API, Blink>JavaScript>Compiler>Turbofan, Blink>JavaScript>Runtime", "reporter": "ki...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-07-17T08:57:57+00:00", "year": 2024, "attachment_count": 0, "local_path": "issues/353628445", "has_markdown": true }, { "id": "353552540", "title": "AddressSanitizer: heap-use-after-free on [SharingCoordinator start]", "url": "https://issues.chromium.org/issues/353552540", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>Sharing", "reporter": "li...@gmail.com", "cve_ids": [], "bounty_amount": 11000.0, "reward_amount_meta": 11000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-07-17T02:20:33+00:00", "year": 2024, "attachment_count": 6, "local_path": "issues/353552540", "has_markdown": true }, { "id": "353244363", "title": "File Might Be Harmful Warning Missing for HTTP-Only Sites on Android", "url": "https://issues.chromium.org/issues/353244363", "status": "Accepted", "severity": "S3-Low", "component": "Services (Use Subcomponents)>Safebrowsing, UI>Browser>Downloads", "reporter": "fa...@gmail.com", "cve_ids": [], "bounty_amount": 500.0, "reward_amount_meta": 500.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-07-15T17:02:22+00:00", "year": 2024, "attachment_count": 4, "local_path": "issues/353244363", "has_markdown": true }, { "id": "353034820", "title": "TINT_ASSERT(to != nullptr) in src/tint/lang/wgsl/resolver/uniformity.cc:157", "url": "https://issues.chromium.org/issues/353034820", "status": "Assigned", "severity": "S3-Low", "component": "Dawn, Dawn>Tint", "reporter": "de...@gmail.com", "cve_ids": [], "bounty_amount": 10000.0, "reward_amount_meta": 10000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-07-15T00:59:53+00:00", "year": 2024, "attachment_count": 1, "local_path": "issues/353034820", "has_markdown": true }, { "id": "352872238", "title": "Webtransport session close crashes browser tab", "url": "https://issues.chromium.org/issues/352872238", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Network>WebTransport", "reporter": "ma...@googlemail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-07-13T15:55:35+00:00", "year": 2024, "attachment_count": 0, "local_path": "issues/352872238", "has_markdown": true }, { "id": "352689356", "title": "V8 Sandbox Bypass: AAR/W via WASM function signature confusion in TurboFan call_ref", "url": "https://issues.chromium.org/issues/352689356", "status": "Fixed", "severity": "S3-Low", "component": "Blink>JavaScript>Sandbox, Blink>JavaScript>WebAssembly", "reporter": "se...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-07-13T02:55:15+00:00", "year": 2024, "attachment_count": 1, "local_path": "issues/352689356", "has_markdown": true }, { "id": "352720899", "title": "Security: Debug check failed: !type.is_uninhabited()", "url": "https://issues.chromium.org/issues/352720899", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript>Compiler, Blink>JavaScript>WebAssembly", "reporter": "rh...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-07-12T17:57:09+00:00", "year": 2024, "attachment_count": 1, "local_path": "issues/352720899", "has_markdown": true }, { "id": "352690885", "title": "Fatal error in Bytecode mismatch at offset 8 in interpreter.cc", "url": "https://issues.chromium.org/issues/352690885", "status": "Assigned", "severity": "S4-Minimal", "component": "Blink>JavaScript, Blink>JavaScript>GarbageCollection, Blink>JavaScript>Parser, Blink>JavaScript>Runtime", "reporter": "ta...@gmail.com", "cve_ids": [], "bounty_amount": 8000.0, "reward_amount_meta": 8000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-07-12T13:40:18+00:00", "year": 2024, "attachment_count": 6, "local_path": "issues/352690885", "has_markdown": true }, { "id": "352651673", "title": "Chrome devTools \"Copy as cURL (cmd)\" Allows Arbitrary Code Execution in CMD", "url": "https://issues.chromium.org/issues/352651673", "status": "Accepted", "severity": "S3-Low", "component": "Platform>DevTools>Network", "reporter": "fa...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-07-12T10:08:32+00:00", "year": 2024, "attachment_count": 2, "local_path": "issues/352651673", "has_markdown": true }, { "id": "352681108", "title": "Incorrect security UI of files' download source at chrome://downloads", "url": "https://issues.chromium.org/issues/352681108", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>Downloads", "reporter": "zy...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-07-12T08:23:29+00:00", "year": 2024, "attachment_count": 6, "local_path": "issues/352681108", "has_markdown": true }, { "id": "352610611", "title": "UAF in dawn::wire::client::Device::HandleError", "url": "https://issues.chromium.org/issues/352610611", "status": "Assigned", "severity": "S3-Low", "component": "Dawn, Dawn>Wire", "reporter": "em...@gmail.com", "cve_ids": [], "bounty_amount": 8000.0, "reward_amount_meta": 8000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-07-12T05:54:56+00:00", "year": 2024, "attachment_count": 3, "local_path": "issues/352610611", "has_markdown": true }, { "id": "352516283", "title": "Android Chrome Incognito Mode Leaving Alert Dialog Box Origin Confusion", "url": "https://issues.chromium.org/issues/352516283", "status": "Accepted", "severity": "S3-Low", "component": "Mobile>Intents, UI>Browser>Navigation", "reporter": "sh...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-07-11T19:16:17+00:00", "year": 2024, "attachment_count": 3, "local_path": "issues/352516283", "has_markdown": true }, { "id": "352446085", "title": "V8 Sandbox Bypass: AAR/W via WASM import race condition leading to broken runtime bounds check with memory64", "url": "https://issues.chromium.org/issues/352446085", "status": "Verified", "severity": "S3-Low", "component": "Blink>JavaScript>WebAssembly", "reporter": "se...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-07-11T15:27:24+00:00", "year": 2024, "attachment_count": 1, "local_path": "issues/352446085", "has_markdown": true }, { "id": "352467338", "title": "AddressSanitizer: heap-buffer-overflow", "url": "https://issues.chromium.org/issues/352467338", "status": "Assigned", "severity": "S4-Minimal", "component": "Blink>Layout", "reporter": "ta...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-07-11T12:12:55+00:00", "year": 2024, "attachment_count": 3, "local_path": "issues/352467338", "has_markdown": true }, { "id": "351843813", "title": "Security: Potential Use-After-Free in CallbackLayerAnimationObserver::OnDetachedFromSequence", "url": "https://issues.chromium.org/issues/351843813", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Compositing", "reporter": "kd...@gmail.com", "cve_ids": [], "bounty_amount": 500.0, "reward_amount_meta": 500.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-07-09T08:36:57+00:00", "year": 2024, "attachment_count": 0, "local_path": "issues/351843813", "has_markdown": true }, { "id": "351865302", "title": "Fatal error in ../../src/compiler/simplified-lowering.cc, line 568", "url": "https://issues.chromium.org/issues/351865302", "status": "Assigned", "severity": "S4-Minimal", "component": "Blink>JavaScript>Compiler, Blink>JavaScript>Compiler>Maglev, Blink>JavaScript>Compiler>Turbofan", "reporter": "be...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-07-09T05:11:06+00:00", "year": 2024, "attachment_count": 1, "local_path": "issues/351865302", "has_markdown": true }, { "id": "351564774", "title": "The PWA's installation dialog isn't being dismissed after redirects, which allows an attacker to sho", "url": "https://issues.chromium.org/issues/351564774", "status": "Accepted", "severity": "S3-Low", "component": "UI>Browser>Mobile>Messages, UI>Browser>WebAppInstalls>Android", "reporter": "bh...@gmail.com", "cve_ids": [], "bounty_amount": 500.0, "reward_amount_meta": 500.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-07-07T19:54:12+00:00", "year": 2024, "attachment_count": 7, "local_path": "issues/351564774", "has_markdown": true }, { "id": "351327767", "title": "WebAssembly OOB memory access due to cached memory index confusion", "url": "https://issues.chromium.org/issues/351327767", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript>WebAssembly", "reporter": "se...@gmail.com", "cve_ids": [], "bounty_amount": 20000.0, "reward_amount_meta": 20000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-07-06T09:13:19+00:00", "year": 2024, "attachment_count": 4, "local_path": "issues/351327767", "has_markdown": true }, { "id": "350869463", "title": "heap-buffer-overflow in apps::AppShimManager::OnShimLaunchRequested", "url": "https://issues.chromium.org/issues/350869463", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>WebAppInstalls", "reporter": "ha...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-07-03T13:23:23+00:00", "year": 2024, "attachment_count": 0, "local_path": "issues/350869463", "has_markdown": true }, { "id": "350628675", "title": "V8 Sandbox Bypass: AAR/W via WASM dispatch table index OOB from `WasmTableObject.uses`", "url": "https://issues.chromium.org/issues/350628675", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript>Sandbox, Blink>JavaScript>WebAssembly", "reporter": "se...@gmail.com", "cve_ids": [], "bounty_amount": 20000.0, "reward_amount_meta": 20000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-07-02T16:14:52+00:00", "year": 2024, "attachment_count": 3, "local_path": "issues/350628675", "has_markdown": true }, { "id": "350407902", "title": "UAF in content::EmbeddedWorkerInstance::ReleaseProcess(Browser Process)", "url": "https://issues.chromium.org/issues/350407902", "status": "New", "severity": "S3-Low", "component": "Blink>ServiceWorker", "reporter": "em...@gmail.com", "cve_ids": [], "bounty_amount": 21000.0, "reward_amount_meta": 21000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-07-01T20:33:29+00:00", "year": 2024, "attachment_count": 5, "local_path": "issues/350407902", "has_markdown": true }, { "id": "350292240", "title": "V8 Sandbox Bypass: AAR/W via generic function table `call_indirect` rtt check bypass", "url": "https://issues.chromium.org/issues/350292240", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript>Sandbox, Blink>JavaScript>WebAssembly", "reporter": "se...@gmail.com", "cve_ids": [], "bounty_amount": 20000.0, "reward_amount_meta": 20000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-07-01T06:50:34+00:00", "year": 2024, "attachment_count": 3, "local_path": "issues/350292240", "has_markdown": true }, { "id": "350256147", "title": "Fatal error in ../../src/heap/mark-compact.cc, line 3665", "url": "https://issues.chromium.org/issues/350256147", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript, Blink>JavaScript>GarbageCollection", "reporter": "da...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-07-01T03:02:42+00:00", "year": 2024, "attachment_count": 3, "local_path": "issues/350256147", "has_markdown": true }, { "id": "350256139", "title": "Pip window can cover PWA Install Dialogue", "url": "https://issues.chromium.org/issues/350256139", "status": "Accepted", "severity": "S3-Low", "component": "UI>Browser>WebAppInstalls", "reporter": "li...@gmail.com", "cve_ids": [], "bounty_amount": 500.0, "reward_amount_meta": 500.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-06-30T18:13:57+00:00", "year": 2024, "attachment_count": 5, "local_path": "issues/350256139", "has_markdown": true }, { "id": "349788229", "title": "Fatal error in ../../src/heap/mark-compact.cc, line 3665", "url": "https://issues.chromium.org/issues/349788229", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript, Blink>JavaScript>GarbageCollection", "reporter": "da...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-06-27T18:32:37+00:00", "year": 2024, "attachment_count": 2, "local_path": "issues/349788229", "has_markdown": true }, { "id": "349728837", "title": "UAF in URLDownloader::DeleteCompletionHandler", "url": "https://issues.chromium.org/issues/349728837", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>Downloads", "reporter": "ha...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-06-27T14:48:22+00:00", "year": 2024, "attachment_count": 0, "local_path": "issues/349728837", "has_markdown": true }, { "id": "349653218", "title": "AddressSanitizer: heap-use-after-free on NetExportMessageHandler::SendEmail", "url": "https://issues.chromium.org/issues/349653218", "status": "Assigned", "severity": "S4-Minimal", "component": "Internals>Network>Logging", "reporter": "li...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-06-27T04:42:51+00:00", "year": 2024, "attachment_count": 2, "local_path": "issues/349653218", "has_markdown": true }, { "id": "349502157", "title": "V8 Sandbox Bypass: AAR/W via table set OOB SBXCHECK_LT() bypass", "url": "https://issues.chromium.org/issues/349502157", "status": "Accepted", "severity": "S3-Low", "component": "Blink>JavaScript>Sandbox", "reporter": "se...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-06-26T11:56:35+00:00", "year": 2024, "attachment_count": 1, "local_path": "issues/349502157", "has_markdown": true }, { "id": "349529650", "title": "V8 Sandbox Bypass: AAR/W via function import signature check race", "url": "https://issues.chromium.org/issues/349529650", "status": "Accepted", "severity": "S3-Low", "component": "Blink>JavaScript>Sandbox", "reporter": "se...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-06-26T10:32:13+00:00", "year": 2024, "attachment_count": 1, "local_path": "issues/349529650", "has_markdown": true }, { "id": "349251460", "title": "use-after-free on ReadingListDownloadService::DownloadUnprocessedEntries", "url": "https://issues.chromium.org/issues/349251460", "status": "Accepted", "severity": "S3-Low", "component": "UI>Browser>Mobile>ReadingList", "reporter": "li...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-06-25T16:39:15+00:00", "year": 2024, "attachment_count": 1, "local_path": "issues/349251460", "has_markdown": true }, { "id": "349342289", "title": "Security: possible heap UaF in ThrottlingURLLoader+HttpsUpgradesInterceptor+MaybeCreateLoaderForResponse", "url": "https://issues.chromium.org/issues/349342289", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Loader>WebPackaging, Internals>Network>SSL>HttpsUpgrades, UI>Browser>Navigation", "reporter": "ha...@gmail.com", "cve_ids": [], "bounty_amount": 8000.0, "reward_amount_meta": 8000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-06-25T15:12:53+00:00", "year": 2024, "attachment_count": 1, "local_path": "issues/349342289", "has_markdown": true }, { "id": "349253666", "title": "Security: Potential Use-After-Free in PasswordGenerationPopupControllerImpl::EditPasswordClicked\n", "url": "https://issues.chromium.org/issues/349253666", "status": "Accepted", "severity": "S3-Low", "component": "UI>Browser>Autofill", "reporter": "kd...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-06-25T13:14:40+00:00", "year": 2024, "attachment_count": 0, "local_path": "issues/349253666", "has_markdown": true }, { "id": "349198731", "title": "heap-use-after-free on DownloadManagerTabHelper::DidCreateDownload", "url": "https://issues.chromium.org/issues/349198731", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>Downloads", "reporter": "li...@gmail.com", "cve_ids": [], "bounty_amount": 11000.0, "reward_amount_meta": 11000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-06-25T07:18:43+00:00", "year": 2024, "attachment_count": 5, "local_path": "issues/349198731", "has_markdown": true }, { "id": "349062458", "title": "Picture Capture Camera Prompt On Different Origin - Chrome iOS.", "url": "https://issues.chromium.org/issues/349062458", "status": "Accepted", "severity": "S3-Low", "component": "Mobile>iOSWeb", "reporter": "ia...@gmail.com", "cve_ids": [], "bounty_amount": 500.0, "reward_amount_meta": 500.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-06-24T18:56:48+00:00", "year": 2024, "attachment_count": 2, "local_path": "issues/349062458", "has_markdown": true }, { "id": "348793147", "title": "V8 Sandbox Bypass: AAR/W via table import signature check bypass", "url": "https://issues.chromium.org/issues/348793147", "status": "Accepted", "severity": "S3-Low", "component": "Blink>JavaScript>Sandbox", "reporter": "se...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-06-23T09:41:44+00:00", "year": 2024, "attachment_count": 2, "local_path": "issues/348793147", "has_markdown": true }, { "id": "348793144", "title": "Abrt in Builtins_CEntry_Return1_ArgvOnStack_NoBuiltinExit", "url": "https://issues.chromium.org/issues/348793144", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript>Runtime, Blink>JavaScript>WebAssembly", "reporter": "je...@gmail.com", "cve_ids": [], "bounty_amount": 8000.0, "reward_amount_meta": 8000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-06-23T03:07:05+00:00", "year": 2024, "attachment_count": 1, "local_path": "issues/348793144", "has_markdown": true }, { "id": "348793134", "title": "use-after-poison in apps::AppShimManager::OnShimProcessConnectedForRegisterOnly", "url": "https://issues.chromium.org/issues/348793134", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>WebAppInstalls", "reporter": "ha...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-06-22T15:39:10+00:00", "year": 2024, "attachment_count": 3, "local_path": "issues/348793134", "has_markdown": true }, { "id": "348598133", "title": "DCHECK failure in size() > index in small-vector.h", "url": "https://issues.chromium.org/issues/348598133", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript>Compiler, Blink>JavaScript>WebAssembly", "reporter": "ki...@gmail.com", "cve_ids": [], "bounty_amount": 11000.0, "reward_amount_meta": 11000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-06-22T00:07:16+00:00", "year": 2024, "attachment_count": 2, "local_path": "issues/348598133", "has_markdown": true }, { "id": "348129258", "title": "Pdfium Heap-buffer-overflow in in opj_t1_decode_cblk", "url": "https://issues.chromium.org/issues/348129258", "status": "Assigned", "severity": "S3-Low", "component": "PDFium", "reporter": "ke...@gmail.com", "cve_ids": [], "bounty_amount": 11000.0, "reward_amount_meta": 11000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-06-19T14:50:06+00:00", "year": 2024, "attachment_count": 4, "local_path": "issues/348129258", "has_markdown": true }, { "id": "348084786", "title": "V8 Sandbox Bypass: with Shared Function Info", "url": "https://issues.chromium.org/issues/348084786", "status": "Accepted", "severity": "S4-Minimal", "component": "Blink>JavaScript>API, Blink>JavaScript>Runtime, Blink>JavaScript>Sandbox", "reporter": "d8...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-06-19T10:03:48+00:00", "year": 2024, "attachment_count": 2, "local_path": "issues/348084786", "has_markdown": true }, { "id": "347724915", "title": "Segfault in v8 in Builtins_JSConstructStubGeneric", "url": "https://issues.chromium.org/issues/347724915", "status": "Assigned", "severity": "S4-Minimal", "component": "Blink>JavaScript>Compiler>Turbofan, Blink>JavaScript>Runtime", "reporter": "s0...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-06-17T21:58:55+00:00", "year": 2024, "attachment_count": 2, "local_path": "issues/347724915", "has_markdown": true }, { "id": "347664964", "title": "Security: heap-use-after-free in GetModalDialogBounds", "url": "https://issues.chromium.org/issues/347664964", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser", "reporter": "st...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-06-17T11:26:42+00:00", "year": 2024, "attachment_count": 1, "local_path": "issues/347664964", "has_markdown": true }, { "id": "347509736", "title": "Clickjack element", "url": "https://issues.chromium.org/issues/347509736", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Geometry", "reporter": "ja...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-06-17T09:32:49+00:00", "year": 2024, "attachment_count": 1, "local_path": "issues/347509736", "has_markdown": true }, { "id": "347588491", "title": "Permission Element overlay and tapjacking", "url": "https://issues.chromium.org/issues/347588491", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Geometry, Blink>PermissionsAPI, Internals>Permissions>PermissionElement, UI>Browser>Permissions, UI>Browser>Permissions>Prompts", "reporter": "st...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-06-16T22:27:13+00:00", "year": 2024, "attachment_count": 2, "local_path": "issues/347588491", "has_markdown": true }, { "id": "347373236", "title": "heap-use-after-free in MediaStreamManager::GetRawDeviceIdsOpenedForFrame", "url": "https://issues.chromium.org/issues/347373236", "status": "Assigned", "severity": "S3-Low", "component": "Blink>GetUserMedia", "reporter": "ha...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-06-15T07:59:56+00:00", "year": 2024, "attachment_count": 2, "local_path": "issues/347373236", "has_markdown": true }, { "id": "346898524", "title": "AddressSanitizer: heap-use-after-free on ScreenCaptureKitDeviceMac::ResetStreamTo", "url": "https://issues.chromium.org/issues/346898524", "status": "Assigned", "severity": "S3-Low", "component": "Internals>Media>ScreenCapture", "reporter": "li...@gmail.com", "cve_ids": [], "bounty_amount": 6000.0, "reward_amount_meta": 6000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-06-13T17:07:25+00:00", "year": 2024, "attachment_count": 4, "local_path": "issues/346898524", "has_markdown": true }, { "id": "346835902", "title": "Debug check failed: Object::FitsRepresentation(*object, representation). in v8", "url": "https://issues.chromium.org/issues/346835902", "status": "Assigned", "severity": "S4-Minimal", "component": "Blink>JavaScript, Blink>JavaScript>Runtime", "reporter": "ki...@gmail.com", "cve_ids": [], "bounty_amount": 8000.0, "reward_amount_meta": 8000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-06-13T03:36:40+00:00", "year": 2024, "attachment_count": 2, "local_path": "issues/346835902", "has_markdown": true }, { "id": "346618785", "title": "GPU process crash via WebGPU shader - Stack use-after-return at HLMatrixLowerPass.cpp:63", "url": "https://issues.chromium.org/issues/346618785", "status": "Assigned", "severity": "S3-Low", "component": "Dawn>Tint", "reporter": "wg...@gmail.com", "cve_ids": [], "bounty_amount": 10000.0, "reward_amount_meta": 10000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-06-12T11:10:17+00:00", "year": 2024, "attachment_count": 5, "local_path": "issues/346618785", "has_markdown": true }, { "id": "346692546", "title": "AddressSanitizer: heap-use-after-free on media::SCKAudioInputStream::Start", "url": "https://issues.chromium.org/issues/346692546", "status": "Assigned", "severity": "S3-Low", "component": "Internals>Media>Audio", "reporter": "li...@gmail.com", "cve_ids": [], "bounty_amount": 4000.0, "reward_amount_meta": 4000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-06-12T10:03:20+00:00", "year": 2024, "attachment_count": 7, "local_path": "issues/346692546", "has_markdown": true }, { "id": "346597059", "title": "A security issue related to jspi stack switching", "url": "https://issues.chromium.org/issues/346597059", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript>WebAssembly", "reporter": "jo...@gmail.com", "cve_ids": [], "bounty_amount": 10000.0, "reward_amount_meta": 10000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-06-12T03:51:02+00:00", "year": 2024, "attachment_count": 0, "local_path": "issues/346597059", "has_markdown": true }, { "id": "346086168", "title": "Turbofan incorrectly optimizes 64 bit bigint shifts.", "url": "https://issues.chromium.org/issues/346086168", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript>Compiler>Turbofan", "reporter": "in...@gmail.com", "cve_ids": [], "bounty_amount": 11000.0, "reward_amount_meta": 11000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-06-10T01:20:44+00:00", "year": 2024, "attachment_count": 1, "local_path": "issues/346086168", "has_markdown": true }, { "id": "345960102", "title": "Turbofan incorrectly optimizes 64 bit bigint shifts.", "url": "https://issues.chromium.org/issues/345960102", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript>Compiler>Turbofan", "reporter": "in...@gmail.com", "cve_ids": [], "bounty_amount": 11000.0, "reward_amount_meta": 11000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-06-10T01:18:57+00:00", "year": 2024, "attachment_count": 1, "local_path": "issues/345960102", "has_markdown": true }, { "id": "345993680", "title": "GPU process crash via WebGPU shader - UAF in RecursivelyDeleteTriviallyDeadInstructions at Transforms\\Utils\\Local.cpp:368", "url": "https://issues.chromium.org/issues/345993680", "status": "Assigned", "severity": "S3-Low", "component": "Dawn>Tint, Internals>GPU>Dawn", "reporter": "wg...@gmail.com", "cve_ids": [], "bounty_amount": 10000.0, "reward_amount_meta": 10000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-06-09T08:35:07+00:00", "year": 2024, "attachment_count": 4, "local_path": "issues/345993680", "has_markdown": true }, { "id": "346044228", "title": "UAF in media::VideoCaptureDeviceFactoryLinux::OnGetDevicesInfo", "url": "https://issues.chromium.org/issues/346044228", "status": "Assigned", "severity": "S3-Low", "component": "Internals>Core, Internals>Media>CameraCapture", "reporter": "m....@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-06-09T08:11:48+00:00", "year": 2024, "attachment_count": 0, "local_path": "issues/346044228", "has_markdown": true }, { "id": "345822331", "title": " AddressSanitizer: heap-use-after-free on Dawn", "url": "https://issues.chromium.org/issues/345822331", "status": "Assigned", "severity": "S3-Low", "component": "Dawn>Tint", "reporter": "de...@gmail.com", "cve_ids": [], "bounty_amount": 10000.0, "reward_amount_meta": 10000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-06-08T05:45:41+00:00", "year": 2024, "attachment_count": 3, "local_path": "issues/345822331", "has_markdown": true }, { "id": "345640549", "title": "heap-use-after-free in in content::RemoveWebUIManagedInterfaces", "url": "https://issues.chromium.org/issues/345640549", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>Navigation, UI>Browser>WebUI", "reporter": "xp...@gmail.com", "cve_ids": [], "bounty_amount": 2500.0, "reward_amount_meta": 2500.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-06-07T08:02:16+00:00", "year": 2024, "attachment_count": 3, "local_path": "issues/345640549", "has_markdown": true }, { "id": "345518608", "title": "Pdfium Out-Of-Bounds Read in CPDF_DIB::LoadJpxBitmap", "url": "https://issues.chromium.org/issues/345518608", "status": "Assigned", "severity": "S3-Low", "component": "PDFium", "reporter": "ke...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-06-06T22:49:01+00:00", "year": 2024, "attachment_count": 1, "local_path": "issues/345518608", "has_markdown": true }, { "id": "345352978", "title": "libicu multiple vulnerabilities in lastate chromium", "url": "https://issues.chromium.org/issues/345352978", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript>Internationalization", "reporter": "pw...@gmail.com", "cve_ids": [], "bounty_amount": 500.0, "reward_amount_meta": 500.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-06-06T09:26:30+00:00", "year": 2024, "attachment_count": 0, "local_path": "issues/345352978", "has_markdown": true }, { "id": "344963941", "title": "V8 Sandbox Bypass: Irregexp engine bytecode modification leads to arbitrary read/write outside the sandbox", "url": "https://issues.chromium.org/issues/344963941", "status": "Accepted", "severity": "S4-Minimal", "component": "Blink>JavaScript>Sandbox", "reporter": "as...@gmail.com", "cve_ids": [], "bounty_amount": 5250.0, "reward_amount_meta": 5250.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-06-05T00:07:16+00:00", "year": 2024, "attachment_count": 2, "local_path": "issues/344963941", "has_markdown": true }, { "id": "344639860", "title": "GPU process crash via WebGPU shader - UAF in SimplifyCFG at SimplifyCFG.cpp:4743", "url": "https://issues.chromium.org/issues/344639860", "status": "Assigned", "severity": "S3-Low", "component": "Dawn>Tint, Internals>GPU>Dawn", "reporter": "wg...@gmail.com", "cve_ids": [], "bounty_amount": 10000.0, "reward_amount_meta": 10000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-06-04T14:47:44+00:00", "year": 2024, "attachment_count": 4, "local_path": "issues/344639860", "has_markdown": true }, { "id": "344608204", "title": "Google Chrome RCE (no sandbox)", "url": "https://issues.chromium.org/issues/344608204", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript>WebAssembly", "reporter": "no...@ssd-disclosure.com", "cve_ids": [ "CVE-2024-2887" ], "bounty_amount": 20000.0, "reward_amount_meta": 0.0, "public_issue": true, "inclusion_reason": "award_text", "award_text_found": true, "created_date": "2024-06-04T09:57:35+00:00", "year": 2024, "attachment_count": 5, "local_path": "issues/344608204", "has_markdown": true }, { "id": "344343031", "title": "V8 Sandbox Bypass: Code Pointer Table Index Confusion leading to Stack Corruption", "url": "https://issues.chromium.org/issues/344343031", "status": "Verified", "severity": "S3-Low", "component": "Blink>JavaScript>Sandbox", "reporter": "ki...@sec.in.tum.de", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-06-02T14:24:19+00:00", "year": 2024, "attachment_count": 4, "local_path": "issues/344343031", "has_markdown": true }, { "id": "344081614", "title": "LUCI Auth service \"auth-trusted-services\" group bypass", "url": "https://issues.chromium.org/issues/344081614", "status": "Accepted", "severity": "S4-Minimal", "component": "Infra>LUCI", "reporter": "nd...@protonmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-06-02T02:53:46+00:00", "year": 2024, "attachment_count": 0, "local_path": "issues/344081614", "has_markdown": true }, { "id": "343938078", "title": "Security: Android address bar URL spoof if page is scrolling and tab is switched", "url": "https://issues.chromium.org/issues/343938078", "status": "Assigned", "severity": "S3-Low", "component": "Unknown", "reporter": "al...@alesandroortiz.com", "cve_ids": [], "bounty_amount": 6000.0, "reward_amount_meta": 6000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-06-01T03:56:23+00:00", "year": 2024, "attachment_count": 5, "local_path": "issues/343938078", "has_markdown": true }, { "id": "343754425", "title": "memory corruption in perfetto", "url": "https://issues.chromium.org/issues/343754425", "status": "Accepted", "severity": "S3-Low", "component": "Speed>Tracing", "reporter": "em...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-05-31T15:32:54+00:00", "year": 2024, "attachment_count": 1, "local_path": "issues/343754425", "has_markdown": true }, { "id": "343801366", "title": "V8 Sandbox Bypass: Incomplete hardening of the experimental regex engine", "url": "https://issues.chromium.org/issues/343801366", "status": "Verified", "severity": "S4-Minimal", "component": "Unknown", "reporter": "as...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-05-31T10:20:28+00:00", "year": 2024, "attachment_count": 1, "local_path": "issues/343801366", "has_markdown": true }, { "id": "343748812", "title": "Security: Debug check failed: offset == var.offset() (128 vs. 112).", "url": "https://issues.chromium.org/issues/343748812", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript>WebAssembly", "reporter": "rh...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-05-31T01:47:28+00:00", "year": 2024, "attachment_count": 2, "local_path": "issues/343748812", "has_markdown": true }, { "id": "343633071", "title": "Security: Debug check failed: !type.is_uninhabited()", "url": "https://issues.chromium.org/issues/343633071", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript>Compiler, Blink>JavaScript>WebAssembly", "reporter": "rh...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-05-30T14:45:48+00:00", "year": 2024, "attachment_count": 3, "local_path": "issues/343633071", "has_markdown": true }, { "id": "343352552", "title": "WebGL Fullscreen Security UI Bypass", "url": "https://issues.chromium.org/issues/343352552", "status": "Accepted", "severity": "S3-Low", "component": "Blink>Fullscreen", "reporter": "a....@certitude.consulting", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-05-29T16:10:54+00:00", "year": 2024, "attachment_count": 2, "local_path": "issues/343352552", "has_markdown": true }, { "id": "343302586", "title": "Security: heap-use-after-free in MacNotificationServiceUN::CloseNotificationsForProfile", "url": "https://issues.chromium.org/issues/343302586", "status": "Fixed", "severity": "S3-Low", "component": "UI>Notifications", "reporter": "zh...@gmail.com", "cve_ids": [], "bounty_amount": 4000.0, "reward_amount_meta": 4000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-05-29T06:29:33+00:00", "year": 2024, "attachment_count": 7, "local_path": "issues/343302586", "has_markdown": true }, { "id": "343093440", "title": "UAF in ScheduleCpuFrequencyTask", "url": "https://issues.chromium.org/issues/343093440", "status": "Accepted", "severity": "S3-Low", "component": "Internals>PerformanceManager", "reporter": "ha...@gmail.com", "cve_ids": [], "bounty_amount": 500.0, "reward_amount_meta": 500.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-05-28T14:49:12+00:00", "year": 2024, "attachment_count": 0, "local_path": "issues/343093440", "has_markdown": true }, { "id": "343035068", "title": "Security: Segv in Builtins_JSToWasmWrapperAsm", "url": "https://issues.chromium.org/issues/343035068", "status": "Assigned", "severity": "S4-Minimal", "component": "Blink>JavaScript>WebAssembly", "reporter": "je...@gmail.com", "cve_ids": [], "bounty_amount": 11000.0, "reward_amount_meta": 11000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-05-28T03:16:21+00:00", "year": 2024, "attachment_count": 1, "local_path": "issues/343035068", "has_markdown": true }, { "id": "343014709", "title": "Segv on unknown address in media::`anonymous namespace'::ConvertVideoFrameToRGBPixelsTask", "url": "https://issues.chromium.org/issues/343014709", "status": "Assigned", "severity": "S4-Minimal", "component": "Blink>GetUserMedia, Internals>Media>CameraCapture", "reporter": "ch...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-05-28T01:32:25+00:00", "year": 2024, "attachment_count": 4, "local_path": "issues/343014709", "has_markdown": true }, { "id": "342866373", "title": "V8 Sandbox Bypass: JSToWasmWrapperAsm accessible and allows type confusion", "url": "https://issues.chromium.org/issues/342866373", "status": "Fixed", "severity": "S4-Minimal", "component": "Blink>JavaScript>Sandbox", "reporter": "cl...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-05-27T12:14:12+00:00", "year": 2024, "attachment_count": 1, "local_path": "issues/342866373", "has_markdown": true }, { "id": "342840932", "title": "Security: Internal Compiler Error(Duplicate non-aggregate type declarations are not allowed) in tint::spirv::writer::IRFuzzer", "url": "https://issues.chromium.org/issues/342840932", "status": "Assigned", "severity": "S3-Low", "component": "Dawn>Tint", "reporter": "de...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-05-26T15:17:16+00:00", "year": 2024, "attachment_count": 2, "local_path": "issues/342840932", "has_markdown": true }, { "id": "342545100", "title": " GPU process crash via WebGPU shader - UAF in combineInstructionsOverFunction at InstructionCombining.cpp:3008", "url": "https://issues.chromium.org/issues/342545100", "status": "Assigned", "severity": "S3-Low", "component": "Dawn>Tint", "reporter": "wg...@gmail.com", "cve_ids": [], "bounty_amount": 10000.0, "reward_amount_meta": 10000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-05-24T21:19:40+00:00", "year": 2024, "attachment_count": 4, "local_path": "issues/342545100", "has_markdown": true }, { "id": "342602616", "title": "Security: Debug check failed: !type.is_uninhabited()", "url": "https://issues.chromium.org/issues/342602616", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript>Compiler, Blink>JavaScript>WebAssembly", "reporter": "rh...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-05-24T17:59:24+00:00", "year": 2024, "attachment_count": 6, "local_path": "issues/342602616", "has_markdown": true }, { "id": "342579972", "title": "Drag and Drop Can Navigate to File and Chrome URIs Without Restriction", "url": "https://issues.chromium.org/issues/342579972", "status": "Accepted", "severity": "S4-Minimal", "component": "Blink>DataTransfer, UI>Browser>Navigation, UI>Browser>TopChrome>TabStrip", "reporter": "fa...@gmail.com", "cve_ids": [], "bounty_amount": 500.0, "reward_amount_meta": 500.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-05-24T17:44:58+00:00", "year": 2024, "attachment_count": 2, "local_path": "issues/342579972", "has_markdown": true }, { "id": "342456991", "title": "Type confusion in TryFastAddDataProperty", "url": "https://issues.chromium.org/issues/342456991", "status": "Assigned", "severity": "S4-Minimal", "component": "Blink>JavaScript", "reporter": "m-...@github.com", "cve_ids": [], "bounty_amount": 25000.0, "reward_amount_meta": 25000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-05-24T12:40:05+00:00", "year": 2024, "attachment_count": 3, "local_path": "issues/342456991", "has_markdown": true }, { "id": "342456975", "title": " URL spoof in Omnibox", "url": "https://issues.chromium.org/issues/342456975", "status": "Assigned", "severity": "S3-Low", "component": "UI>Accessibility>ReadingMode, UI>Browser>Omnibox", "reporter": "ch...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-05-24T01:43:40+00:00", "year": 2024, "attachment_count": 2, "local_path": "issues/342456975", "has_markdown": true }, { "id": "342419061", "title": "UaF in LensOverlayController::~LensOverlayController", "url": "https://issues.chromium.org/issues/342419061", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser", "reporter": "ch...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-05-24T01:00:21+00:00", "year": 2024, "attachment_count": 2, "local_path": "issues/342419061", "has_markdown": true }, { "id": "342428008", "title": " GPU process crash via WebGPU shader - UAF in GlobalIsNeeded at GlobalDCE.cpp:244", "url": "https://issues.chromium.org/issues/342428008", "status": "Assigned", "severity": "S3-Low", "component": "Blink>WebGPU, Dawn>Tint", "reporter": "wg...@gmail.com", "cve_ids": [], "bounty_amount": 10000.0, "reward_amount_meta": 10000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-05-23T18:15:24+00:00", "year": 2024, "attachment_count": 4, "local_path": "issues/342428008", "has_markdown": true }, { "id": "342415789", "title": "A security issue when using the JSPI feature.", "url": "https://issues.chromium.org/issues/342415789", "status": "Assigned", "severity": "S4-Minimal", "component": "Blink>JavaScript>WebAssembly", "reporter": "jo...@gmail.com", "cve_ids": [], "bounty_amount": 11000.0, "reward_amount_meta": 11000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-05-23T17:49:56+00:00", "year": 2024, "attachment_count": 0, "local_path": "issues/342415789", "has_markdown": true }, { "id": "342197919", "title": "Security: SEGV in v8_wasm_compile_fuzzer ", "url": "https://issues.chromium.org/issues/342197919", "status": "Accepted", "severity": "S3-Low", "component": "Blink>JavaScript", "reporter": "al...@goodmanemail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-05-23T13:33:09+00:00", "year": 2024, "attachment_count": 1, "local_path": "issues/342197919", "has_markdown": true }, { "id": "342194497", "title": "Security: PEPC prompt can be obscured by Video/Document PiP window", "url": "https://issues.chromium.org/issues/342194497", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>Permissions>Prompts", "reporter": "al...@alesandroortiz.com", "cve_ids": [], "bounty_amount": 4000.0, "reward_amount_meta": 4000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-05-23T04:09:11+00:00", "year": 2024, "attachment_count": 4, "local_path": "issues/342194497", "has_markdown": true }, { "id": "341991535", "title": "Security: Container-overflow in STGEverythingMenu::ExecuteCommand", "url": "https://issues.chromium.org/issues/341991535", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>TopChrome>TabStrip>TabGroups", "reporter": "me...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-05-22T03:34:43+00:00", "year": 2024, "attachment_count": 2, "local_path": "issues/341991535", "has_markdown": true }, { "id": "341947676", "title": "Security: PEPC element max-(width|height) restrictions can be bypassed with larger min-(width|height) value", "url": "https://issues.chromium.org/issues/341947676", "status": "Assigned", "severity": "S4-Minimal", "component": "UI>Browser>Permissions>Prompts", "reporter": "al...@alesandroortiz.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-05-22T01:14:51+00:00", "year": 2024, "attachment_count": 5, "local_path": "issues/341947676", "has_markdown": true }, { "id": "341803763", "title": "Google Update on Windows: COM Session Moniker EoP", "url": "https://issues.chromium.org/issues/341803763", "status": "Assigned", "severity": "S3-Low", "component": "Internals>Updater", "reporter": "sy...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-05-21T14:42:55+00:00", "year": 2024, "attachment_count": 1, "local_path": "issues/341803763", "has_markdown": true }, { "id": "341875171", "title": "Extensions can run JS on any privileged origin by using a race condition with chrome.devtools.inspectedWindow.reload ", "url": "https://issues.chromium.org/issues/341875171", "status": "Assigned", "severity": "S3-Low", "component": "Platform>DevTools", "reporter": "ad...@gmail.com", "cve_ids": [], "bounty_amount": 20000.0, "reward_amount_meta": 0.0, "public_issue": true, "inclusion_reason": "award_text", "award_text_found": true, "created_date": "2024-05-21T12:06:54+00:00", "year": 2024, "attachment_count": 6, "local_path": "issues/341875171", "has_markdown": true }, { "id": "341663594", "title": "Security: PEPC prompt renders outside initiator window in small windows", "url": "https://issues.chromium.org/issues/341663594", "status": "Accepted", "severity": "S3-Low", "component": "UI>Browser>Permissions>Prompts", "reporter": "al...@alesandroortiz.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-05-21T04:42:01+00:00", "year": 2024, "attachment_count": 7, "local_path": "issues/341663594", "has_markdown": true }, { "id": "341432425", "title": "Security: Keyboard/Pointer Lock permission prompt does not elide origins correctly, allows origin spoof", "url": "https://issues.chromium.org/issues/341432425", "status": "Verified", "severity": "Unknown", "component": "UI>Browser>Permissions>Prompts", "reporter": "al...@alesandroortiz.com", "cve_ids": [], "bounty_amount": 500.0, "reward_amount_meta": 500.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-05-18T23:04:46+00:00", "year": 2024, "attachment_count": 2, "local_path": "issues/341432425", "has_markdown": true }, { "id": "341353783", "title": "Chrome iOS is Vulnerable to Permission Tapjacking", "url": "https://issues.chromium.org/issues/341353783", "status": "Accepted", "severity": "S3-Low", "component": "Mobile>iOSWeb>Security", "reporter": "fa...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-05-18T18:18:46+00:00", "year": 2024, "attachment_count": 5, "local_path": "issues/341353783", "has_markdown": true }, { "id": "341313077", "title": "Potential PDFium Use-After-Free in CPDFSDK_FormFillEnvironment::OnFormat", "url": "https://issues.chromium.org/issues/341313077", "status": "Assigned", "severity": "S3-Low", "component": "Internals>Plugins>PDF", "reporter": "kd...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-05-18T17:13:53+00:00", "year": 2024, "attachment_count": 0, "local_path": "issues/341313077", "has_markdown": true }, { "id": "341181414", "title": "Container-overflow in blink::QualifiedName::ToString", "url": "https://issues.chromium.org/issues/341181414", "status": "Assigned", "severity": "S4-Minimal", "component": "Blink>DOM, Blink>SecurityFeature>SanitizerAPI", "reporter": "m....@gmail.com", "cve_ids": [], "bounty_amount": 9000.0, "reward_amount_meta": 9000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-05-18T05:59:36+00:00", "year": 2024, "attachment_count": 0, "local_path": "issues/341181414", "has_markdown": true }, { "id": "341208341", "title": "UAF in OnTaskFinished", "url": "https://issues.chromium.org/issues/341208341", "status": "Fixed", "severity": "S3-Low", "component": "Mobile>WebAPKs", "reporter": "ha...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-05-17T15:31:23+00:00", "year": 2024, "attachment_count": 0, "local_path": "issues/341208341", "has_markdown": true }, { "id": "341136300", "title": "Extensions can run JS on any priveledged origin by using chrome.devtools.inspectedWindow.reload and crashing the page", "url": "https://issues.chromium.org/issues/341136300", "status": "Assigned", "severity": "S3-Low", "component": "Platform>Extensions", "reporter": "ad...@gmail.com", "cve_ids": [], "bounty_amount": 20000.0, "reward_amount_meta": 0.0, "public_issue": true, "inclusion_reason": "award_text", "award_text_found": true, "created_date": "2024-05-16T20:39:13+00:00", "year": 2024, "attachment_count": 9, "local_path": "issues/341136300", "has_markdown": true }, { "id": "341095523", "title": "Security: Use-After-Free in CFFL_ComboBox::SaveData", "url": "https://issues.chromium.org/issues/341095523", "status": "Accepted", "severity": "S3-Low", "component": "Internals>Plugins>PDF", "reporter": "kd...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-05-16T18:02:59+00:00", "year": 2024, "attachment_count": 0, "local_path": "issues/341095523", "has_markdown": true }, { "id": "340893685", "title": "Security: FedCM prompts do not show origin if initiator origin is opaque", "url": "https://issues.chromium.org/issues/340893685", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Identity>FedCM", "reporter": "al...@alesandroortiz.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-05-15T23:07:46+00:00", "year": 2024, "attachment_count": 6, "local_path": "issues/340893685", "has_markdown": true }, { "id": "340196361", "title": "GPU process crash via WebGPU shader - UAF in GetIfCondition at BasicBlockUtils.cpp:810", "url": "https://issues.chromium.org/issues/340196361", "status": "Assigned", "severity": "S3-Low", "component": "Dawn>Tint", "reporter": "wg...@gmail.com", "cve_ids": [], "bounty_amount": 10000.0, "reward_amount_meta": 10000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-05-13T18:51:24+00:00", "year": 2024, "attachment_count": 4, "local_path": "issues/340196361", "has_markdown": true }, { "id": "340178596", "title": "heap-use-after-free on AudioManagerMac", "url": "https://issues.chromium.org/issues/340178596", "status": "Assigned", "severity": "S3-Low", "component": "Unknown", "reporter": "ha...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-05-13T15:44:18+00:00", "year": 2024, "attachment_count": 0, "local_path": "issues/340178596", "has_markdown": true }, { "id": "340221135", "title": "RCE in V8 maglev", "url": "https://issues.chromium.org/issues/340221135", "status": "New", "severity": "S3-Low", "component": "Blink>JavaScript>Compiler>Maglev", "reporter": "oc...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-05-13T15:08:08+00:00", "year": 2024, "attachment_count": 6, "local_path": "issues/340221135", "has_markdown": true }, { "id": "340098902", "title": "use-after-free at browser_user_education_service.cc:120", "url": "https://issues.chromium.org/issues/340098902", "status": "Assigned", "severity": "S3-Low", "component": "Unknown", "reporter": "xp...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-05-13T06:19:32+00:00", "year": 2024, "attachment_count": 2, "local_path": "issues/340098902", "has_markdown": true }, { "id": "340122160", "title": "MiraclePtr bypass due to PtrCount overflow", "url": "https://issues.chromium.org/issues/340122160", "status": "Assigned", "severity": "S3-Low", "component": "Unknown", "reporter": "ha...@gmail.com", "cve_ids": [], "bounty_amount": 100115.0, "reward_amount_meta": 100115.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-05-13T04:16:20+00:00", "year": 2024, "attachment_count": 0, "local_path": "issues/340122160", "has_markdown": true }, { "id": "339877167", "title": "Memory corruption in ReadableByteStreamController::FillPullIntoDescriptorFromQueue", "url": "https://issues.chromium.org/issues/339877167", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Network>StreamsAPI", "reporter": "jt...@gmail.com", "cve_ids": [], "bounty_amount": 11000.0, "reward_amount_meta": 11000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-05-11T10:20:38+00:00", "year": 2024, "attachment_count": 2, "local_path": "issues/339877167", "has_markdown": true }, { "id": "339877165", "title": "heap-buffer-overflow write in libaom", "url": "https://issues.chromium.org/issues/339877165", "status": "Assigned", "severity": "S3-Low", "component": "Blink>WebRTC", "reporter": "em...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-05-11T07:58:54+00:00", "year": 2024, "attachment_count": 2, "local_path": "issues/339877165", "has_markdown": true }, { "id": "339877158", "title": "UAF in SetPreludeText", "url": "https://issues.chromium.org/issues/339877158", "status": "Assigned", "severity": "S3-Low", "component": "Blink>CSS", "reporter": "ha...@gmail.com", "cve_ids": [], "bounty_amount": 500.0, "reward_amount_meta": 500.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-05-11T03:54:33+00:00", "year": 2024, "attachment_count": 0, "local_path": "issues/339877158", "has_markdown": true }, { "id": "339788215", "title": "UAF in ParseDarkColorOverride", "url": "https://issues.chromium.org/issues/339788215", "status": "Assigned", "severity": "S3-Low", "component": "Blink>AppManifest", "reporter": "ha...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-05-10T18:50:32+00:00", "year": 2024, "attachment_count": 0, "local_path": "issues/339788215", "has_markdown": true }, { "id": "339753685", "title": "Type Confusion between WasmObject and JSObject in Array Concat", "url": "https://issues.chromium.org/issues/339753685", "status": "Assigned", "severity": "S4-Minimal", "component": "Blink>JavaScript>Runtime, Blink>JavaScript>WebAssembly", "reporter": "ki...@gmail.com", "cve_ids": [], "bounty_amount": 10000.0, "reward_amount_meta": 10000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-05-10T10:57:04+00:00", "year": 2024, "attachment_count": 0, "local_path": "issues/339753685", "has_markdown": true }, { "id": "339654392", "title": "Security: FedCM prompt bubble can be obscured by Video/Document PiP window, allow for hidden login", "url": "https://issues.chromium.org/issues/339654392", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Identity>FedCM", "reporter": "al...@alesandroortiz.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-05-10T03:57:55+00:00", "year": 2024, "attachment_count": 11, "local_path": "issues/339654392", "has_markdown": true }, { "id": "339686368", "title": "HeapBufferOverflow in GridNode::ConstructGridItems", "url": "https://issues.chromium.org/issues/339686368", "status": "Accepted", "severity": "S4-Minimal", "component": "Blink>Layout>Grid", "reporter": "su...@gmail.com", "cve_ids": [], "bounty_amount": 8000.0, "reward_amount_meta": 8000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-05-10T03:10:45+00:00", "year": 2024, "attachment_count": 0, "local_path": "issues/339686368", "has_markdown": true }, { "id": "339588211", "title": " Use After Free in PresentationConnectionCallbacks::OnSuccess", "url": "https://issues.chromium.org/issues/339588211", "status": "Assigned", "severity": "S3-Low", "component": "Blink>PresentationAPI", "reporter": "ha...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-05-09T10:51:13+00:00", "year": 2024, "attachment_count": 0, "local_path": "issues/339588211", "has_markdown": true }, { "id": "339481295", "title": "Security: Autofill prompt can be obscured by FedCM bubble dialog", "url": "https://issues.chromium.org/issues/339481295", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Identity>FedCM", "reporter": "al...@alesandroortiz.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-05-09T03:56:35+00:00", "year": 2024, "attachment_count": 6, "local_path": "issues/339481295", "has_markdown": true }, { "id": "339287000", "title": "Security: heap-use-after-free in blink::internal::IdleRequestCallbackWrapper::TimeoutFired", "url": "https://issues.chromium.org/issues/339287000", "status": "Assigned", "severity": "S3-Low", "component": "Blink>DOM", "reporter": "zh...@gmail.com", "cve_ids": [], "bounty_amount": 8000.0, "reward_amount_meta": 8000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-05-08T03:42:11+00:00", "year": 2024, "attachment_count": 6, "local_path": "issues/339287000", "has_markdown": true }, { "id": "339169163", "title": "GPU process crash via WebGPU shader - OOB in ComputeExitLimit at", "url": "https://issues.chromium.org/issues/339169163", "status": "Assigned", "severity": "S3-Low", "component": "Dawn>Tint", "reporter": "wg...@gmail.com", "cve_ids": [], "bounty_amount": 10000.0, "reward_amount_meta": 10000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-05-07T14:54:28+00:00", "year": 2024, "attachment_count": 9, "local_path": "issues/339169163", "has_markdown": true }, { "id": "339141099", "title": "v8::Value string with unmatched UTF8 surrogate pair causes crash when converted to base::Value", "url": "https://issues.chromium.org/issues/339141099", "status": "Assigned", "severity": "S3-Low", "component": "Platform>Extensions", "reporter": "go...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-05-07T14:53:37+00:00", "year": 2024, "attachment_count": 3, "local_path": "issues/339141099", "has_markdown": true }, { "id": "339171223", "title": "GPU process crash via WebGPU shader - UAF in ConstantFoldTerminator at Transforms\\Utils\\Local.cpp:93", "url": "https://issues.chromium.org/issues/339171223", "status": "Assigned", "severity": "S3-Low", "component": "Dawn>Tint", "reporter": "wg...@gmail.com", "cve_ids": [], "bounty_amount": 10000.0, "reward_amount_meta": 10000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-05-07T14:30:15+00:00", "year": 2024, "attachment_count": 8, "local_path": "issues/339171223", "has_markdown": true }, { "id": "339061099", "title": "Security: container-overflow in chrome::ReloadInternal", "url": "https://issues.chromium.org/issues/339061099", "status": "Assigned", "severity": "S3-Low", "component": "UI>Input>KeyboardShortcuts", "reporter": "zh...@gmail.com", "cve_ids": [ "CVE-2024-5497" ], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-05-07T04:30:23+00:00", "year": 2024, "attachment_count": 3, "local_path": "issues/339061099", "has_markdown": true }, { "id": "338929744", "title": "UAF in content::MediaSessionImpl::BuildMetadata", "url": "https://issues.chromium.org/issues/338929744", "status": "Assigned", "severity": "S3-Low", "component": "Internals>Media>Session", "reporter": "em...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-05-06T16:08:58+00:00", "year": 2024, "attachment_count": 3, "local_path": "issues/338929744", "has_markdown": true }, { "id": "338908243", "title": "Type Confusion between WasmObject and JSObject in Array Concat", "url": "https://issues.chromium.org/issues/338908243", "status": "Assigned", "severity": "S4-Minimal", "component": "Blink>JavaScript>Runtime, Blink>JavaScript>WebAssembly", "reporter": "ki...@gmail.com", "cve_ids": [], "bounty_amount": 10000.0, "reward_amount_meta": 10000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-05-06T13:12:31+00:00", "year": 2024, "attachment_count": 2, "local_path": "issues/338908243", "has_markdown": true }, { "id": "338248595", "title": "Sandbox escape from extensions due to insufficent checks in chrome.devtools.inspectedWindow.reload and chrome://policy", "url": "https://issues.chromium.org/issues/338248595", "status": "Assigned", "severity": "S3-Low", "component": "Platform>DevTools", "reporter": "ad...@gmail.com", "cve_ids": [], "bounty_amount": 20000.0, "reward_amount_meta": 20000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-05-01T22:57:43+00:00", "year": 2024, "attachment_count": 10, "local_path": "issues/338248595", "has_markdown": true }, { "id": "338233148", "title": "Security: FedCM prompt bubble renders outside of opening window, causing various issues", "url": "https://issues.chromium.org/issues/338233148", "status": "Accepted", "severity": "S3-Low", "component": "Blink>Identity>FedCM", "reporter": "al...@alesandroortiz.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-05-01T21:16:29+00:00", "year": 2024, "attachment_count": 19, "local_path": "issues/338233148", "has_markdown": true }, { "id": "338254612", "title": "Security UI Spoofing on Android Chrome Due to Picture in Picture PIP Fullscreen ", "url": "https://issues.chromium.org/issues/338254612", "status": "Accepted", "severity": "S3-Low", "component": "Internals>Media>UI, UI>Browser>FullScreen", "reporter": "pu...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-05-01T20:50:04+00:00", "year": 2024, "attachment_count": 22, "local_path": "issues/338254612", "has_markdown": true }, { "id": "338103465", "title": "GPU process crash via WebGPU shader - UAF in SimplifyTerminatorOnSelect at SimplifyCFG.cpp:2637", "url": "https://issues.chromium.org/issues/338103465", "status": "Assigned", "severity": "S3-Low", "component": "Blink>WebGPU, Dawn>Tint, Internals>GPU>Dawn, Internals>GPU>Tint", "reporter": "wg...@gmail.com", "cve_ids": [], "bounty_amount": 10000.0, "reward_amount_meta": 10000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-05-01T12:16:43+00:00", "year": 2024, "attachment_count": 4, "local_path": "issues/338103465", "has_markdown": true }, { "id": "338162110", "title": "UAF in remote_cocoa::RenderWidgetHostNSViewBridge::DisplayPopupMenu", "url": "https://issues.chromium.org/issues/338162110", "status": "Assigned", "severity": "S3-Low", "component": "UI>Accessibility>Compatibility", "reporter": "ha...@gmail.com", "cve_ids": [], "bounty_amount": 10000.0, "reward_amount_meta": 10000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-05-01T11:21:53+00:00", "year": 2024, "attachment_count": 1, "local_path": "issues/338162110", "has_markdown": true }, { "id": "338161969", "title": " GPU process crash via WebGPU shader - OOB in WriteInstruction at BitcodeWriter.cpp:1720", "url": "https://issues.chromium.org/issues/338161969", "status": "Assigned", "severity": "S3-Low", "component": "Blink>WebGPU, Dawn>Tint, Internals>GPU>Dawn, Internals>GPU>Tint", "reporter": "wg...@gmail.com", "cve_ids": [], "bounty_amount": 10000.0, "reward_amount_meta": 10000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-05-01T09:50:53+00:00", "year": 2024, "attachment_count": 6, "local_path": "issues/338161969", "has_markdown": true }, { "id": "338071106", "title": "GPU process crash via WebGPU shader - UAF in ProcessValue at DxilValueCache.cpp:555", "url": "https://issues.chromium.org/issues/338071106", "status": "Assigned", "severity": "S3-Low", "component": "Blink>WebGPU, Dawn>Tint, Internals>GPU>Dawn, Internals>GPU>Tint", "reporter": "wg...@gmail.com", "cve_ids": [], "bounty_amount": 10000.0, "reward_amount_meta": 10000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-05-01T08:09:53+00:00", "year": 2024, "attachment_count": 4, "local_path": "issues/338071106", "has_markdown": true }, { "id": "337998760", "title": "UAF in BackgroundProcessor::OnDataPipeReadable", "url": "https://issues.chromium.org/issues/337998760", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Bindings", "reporter": "em...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-04-30T14:20:42+00:00", "year": 2024, "attachment_count": 6, "local_path": "issues/337998760", "has_markdown": true }, { "id": "337766133", "title": "Heap-Buffer-Overflow in glgCopyRowsWithMemCopy", "url": "https://issues.chromium.org/issues/337766133", "status": "Assigned", "severity": "S3-Low", "component": "Internals>GPU>ANGLE", "reporter": "de...@gmail.com", "cve_ids": [ "CVE-2021-4058" ], "bounty_amount": 11000.0, "reward_amount_meta": 11000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-04-29T17:11:45+00:00", "year": 2024, "attachment_count": 4, "local_path": "issues/337766133", "has_markdown": true }, { "id": "337356054", "title": "Cross origin dialog spoof", "url": "https://issues.chromium.org/issues/337356054", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Storage>FileAPI, Blink>Storage>FileSystem", "reporter": "li...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-04-27T07:08:08+00:00", "year": 2024, "attachment_count": 2, "local_path": "issues/337356054", "has_markdown": true }, { "id": "337222641", "title": "Autofill Drop Down List Scroll Swaps Datalist Leading To Clickjacking", "url": "https://issues.chromium.org/issues/337222641", "status": "Accepted", "severity": "S2-Medium", "component": "UI>Browser>Autofill", "reporter": "le...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-04-26T19:16:08+00:00", "year": 2024, "attachment_count": 9, "local_path": "issues/337222641", "has_markdown": true }, { "id": "336449367", "title": "UAF in ModelManagerImpl::CanCreateGenericSession", "url": "https://issues.chromium.org/issues/336449367", "status": "Accepted", "severity": "S4-Minimal", "component": "Unknown", "reporter": "zh...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-04-23T12:51:28+00:00", "year": 2024, "attachment_count": 4, "local_path": "issues/336449367", "has_markdown": true }, { "id": "336399251", "title": "Check failed: !v8::internal::v8_flags.enable_slow_asserts.value() || (IsWasmExportedFunction(*this))", "url": "https://issues.chromium.org/issues/336399251", "status": "Accepted", "severity": "S4-Minimal", "component": "Blink>JavaScript>WebAssembly", "reporter": "ki...@gmail.com", "cve_ids": [], "bounty_amount": 8000.0, "reward_amount_meta": 8000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-04-23T03:43:57+00:00", "year": 2024, "attachment_count": 1, "local_path": "issues/336399251", "has_markdown": true }, { "id": "336007400", "title": "v8_wasm_fuzzer Debug check failed: begin.valid() in v8/src/compiler/turboshaft/graph.h, line 946", "url": "https://issues.chromium.org/issues/336007400", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript>Compiler, Blink>JavaScript>WebAssembly", "reporter": "al...@goodmanemail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-04-21T10:54:21+00:00", "year": 2024, "attachment_count": 1, "local_path": "issues/336007400", "has_markdown": true }, { "id": "336012573", "title": "Use After Free in BackForwardCacheDisablingFeatureTracker::ReportFeaturesToDelegate()", "url": "https://issues.chromium.org/issues/336012573", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Scheduling", "reporter": "lo...@gmail.com", "cve_ids": [], "bounty_amount": 11000.0, "reward_amount_meta": 11000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-04-21T04:02:28+00:00", "year": 2024, "attachment_count": 1, "local_path": "issues/336012573", "has_markdown": true }, { "id": "335613092", "title": "heap-buffer-overflow in SpirvTransformerBase::copyInstruction", "url": "https://issues.chromium.org/issues/335613092", "status": "Assigned", "severity": "S3-Low", "component": "Internals>GPU>ANGLE, Internals>GPU>SwiftShader", "reporter": "da...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-04-18T17:30:49+00:00", "year": 2024, "attachment_count": 8, "local_path": "issues/335613092", "has_markdown": true }, { "id": "335611025", "title": "Chrome on IOS ignores Content-Type header (and nosniff) when rendering XHTML content", "url": "https://issues.chromium.org/issues/335611025", "status": "Accepted", "severity": "S3-Low", "component": "Mobile>iOSWeb", "reporter": "jo...@gmail.com", "cve_ids": [ "CVE-2023-32445", "CVE-2024-40785" ], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-04-18T12:30:02+00:00", "year": 2024, "attachment_count": 1, "local_path": "issues/335611025", "has_markdown": true }, { "id": "335222589", "title": "Test Security ITW", "url": "https://issues.chromium.org/issues/335222589", "status": "Accepted", "severity": "S3-Low", "component": "Unknown", "reporter": "ph...@google.com", "cve_ids": [], "bounty_amount": 1.0, "reward_amount_meta": 1.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-04-16T16:34:59+00:00", "year": 2024, "attachment_count": 0, "local_path": "issues/335222589", "has_markdown": true }, { "id": "335003891", "title": "Use-after-poison in blink::LocalDOMWindow::Trace", "url": "https://issues.chromium.org/issues/335003891", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Media>PictureInPicture", "reporter": "ki...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-04-16T07:16:29+00:00", "year": 2024, "attachment_count": 8, "local_path": "issues/335003891", "has_markdown": true }, { "id": "334120897", "title": "V8 Sandbox Bypass: wasm function signature confusion leading to out of sandbox arbitrary read/write", "url": "https://issues.chromium.org/issues/334120897", "status": "Accepted", "severity": "S3-Low", "component": "Unknown", "reporter": "ze...@gmail.com", "cve_ids": [], "bounty_amount": 6000.0, "reward_amount_meta": 6000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-04-14T23:01:05+00:00", "year": 2024, "attachment_count": 6, "local_path": "issues/334120897", "has_markdown": true }, { "id": "334110479", "title": "Security: SidePanelContentSwappingContainer Heap-Use-After-Free Vulnerability", "url": "https://issues.chromium.org/issues/334110479", "status": "Verified", "severity": "S3-Low", "component": "UI>Browser>TopChrome>SidePanel", "reporter": "pw...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-04-13T15:01:02+00:00", "year": 2024, "attachment_count": 0, "local_path": "issues/334110479", "has_markdown": true }, { "id": "333940412", "title": "pyz and pyzw file not in block list", "url": "https://issues.chromium.org/issues/333940412", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>Downloads", "reporter": "ho...@gmail.com", "cve_ids": [], "bounty_amount": 500.0, "reward_amount_meta": 500.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-04-12T15:20:39+00:00", "year": 2024, "attachment_count": 3, "local_path": "issues/333940412", "has_markdown": true }, { "id": "333708039", "title": "Intersection Observer v2 API fails to reliably determine target's visibility, which enables clickjacking against Google One Tap", "url": "https://issues.chromium.org/issues/333708039", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Geometry", "reporter": "lo...@icloud.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-04-10T15:21:37+00:00", "year": 2024, "attachment_count": 4, "local_path": "issues/333708039", "has_markdown": true }, { "id": "333414305", "title": "Security: heap-buffer-overflow while opening pdf and search box", "url": "https://issues.chromium.org/issues/333414305", "status": "Assigned", "severity": "S3-Low", "component": "Internals>Plugins>PDF", "reporter": "kd...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-04-09T19:32:08+00:00", "year": 2024, "attachment_count": 5, "local_path": "issues/333414305", "has_markdown": true }, { "id": "333508731", "title": "GPU process crash via WebGPU shader - placeSplitBlockCarefully in LoopSimplify.cpp", "url": "https://issues.chromium.org/issues/333508731", "status": "Assigned", "severity": "S3-Low", "component": "Blink>WebGPU, Dawn>Tint, Internals>GPU>Dawn, Internals>GPU>Tint", "reporter": "wg...@gmail.com", "cve_ids": [], "bounty_amount": 10000.0, "reward_amount_meta": 10000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-04-09T17:07:07+00:00", "year": 2024, "attachment_count": 2, "local_path": "issues/333508731", "has_markdown": true }, { "id": "333420620", "title": "GPU process crash via WebGPU shader - dynamic_cast exception in DXC", "url": "https://issues.chromium.org/issues/333420620", "status": "Assigned", "severity": "S3-Low", "component": "Blink>WebGPU, Internals>GPU>Dawn, Internals>GPU>Tint", "reporter": "wg...@gmail.com", "cve_ids": [], "bounty_amount": 10000.0, "reward_amount_meta": 10000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-04-09T14:24:36+00:00", "year": 2024, "attachment_count": 4, "local_path": "issues/333420620", "has_markdown": true }, { "id": "333414294", "title": "GPU process crash via WebGPU shader - SimplifyInstruction in InstructionSimplify.cpp", "url": "https://issues.chromium.org/issues/333414294", "status": "Assigned", "severity": "S3-Low", "component": "Blink>WebGPU, Internals>GPU>Dawn, Internals>GPU>Tint", "reporter": "wg...@gmail.com", "cve_ids": [], "bounty_amount": 10000.0, "reward_amount_meta": 10000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-04-09T12:10:31+00:00", "year": 2024, "attachment_count": 3, "local_path": "issues/333414294", "has_markdown": true }, { "id": "333182464", "title": "WebGLContext.getContextAttributes() triggers resource leak on page reload", "url": "https://issues.chromium.org/issues/333182464", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript>API", "reporter": "ei...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-04-08T10:33:10+00:00", "year": 2024, "attachment_count": 2, "local_path": "issues/333182464", "has_markdown": true }, { "id": "333313912", "title": "WebAuthn Attestation dialog can hide the full-screen notification.", "url": "https://issues.chromium.org/issues/333313912", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>FullScreen", "reporter": "ch...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-04-08T06:54:59+00:00", "year": 2024, "attachment_count": 2, "local_path": "issues/333313912", "has_markdown": true }, { "id": "332939155", "title": "SEGV_ACCERR / seccomp-bpf gpu::gles2::cmds::FramebufferPixelLocalClearValuefvANGLEImmediate::Init", "url": "https://issues.chromium.org/issues/332939155", "status": "Accepted", "severity": "S3-Low", "component": "Blink>WebGL", "reporter": "wx...@gmail.com", "cve_ids": [], "bounty_amount": 8000.0, "reward_amount_meta": 8000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-04-05T04:57:13+00:00", "year": 2024, "attachment_count": 3, "local_path": "issues/332939155", "has_markdown": true }, { "id": "332592716", "title": "heap-use-after-free on ModelExecutionManager::ExecuteModel", "url": "https://issues.chromium.org/issues/332592716", "status": "Verified", "severity": "S3-Low", "component": "Internals>OptimizationGuide", "reporter": "li...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-04-03T18:51:30+00:00", "year": 2024, "attachment_count": 4, "local_path": "issues/332592716", "has_markdown": true }, { "id": "332546345", "title": "ANGLE compiler ArrayLength transformation type confution lead to Stack Overflow", "url": "https://issues.chromium.org/issues/332546345", "status": "New", "severity": "S4-Minimal", "component": "Internals>GPU>ANGLE, Internals>GPU>SwiftShader", "reporter": "d8...@gmail.com", "cve_ids": [], "bounty_amount": 16000.0, "reward_amount_meta": 16000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-04-02T17:11:56+00:00", "year": 2024, "attachment_count": 1, "local_path": "issues/332546345", "has_markdown": true }, { "id": "332410234", "title": "Security: Private Network Access (PNA) Bypass Allows Access to localhost on macOS & Linux using 0.0.0.0", "url": "https://issues.chromium.org/issues/332410234", "status": "Accepted", "severity": "S3-Low", "component": "Blink>SecurityFeature>CORS>PrivateNetworkAccess", "reporter": "sa...@gmail.com", "cve_ids": [ "CVE-2023-48022" ], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-04-02T14:35:52+00:00", "year": 2024, "attachment_count": 3, "local_path": "issues/332410234", "has_markdown": true }, { "id": "332081797", "title": "Type confusion in v8 wasm", "url": "https://issues.chromium.org/issues/332081797", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript>Runtime", "reporter": "je...@gmail.com", "cve_ids": [], "bounty_amount": 11500.0, "reward_amount_meta": 11500.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-03-31T17:23:55+00:00", "year": 2024, "attachment_count": 4, "local_path": "issues/332081797", "has_markdown": true }, { "id": "331837300", "title": "Crash in v8::internal::Heap::InYoungGeneration", "url": "https://issues.chromium.org/issues/331837300", "status": "Assigned", "severity": "S4-Minimal", "component": "Blink>JavaScript, Blink>JavaScript>GarbageCollection", "reporter": "de...@googlemail.com", "cve_ids": [], "bounty_amount": 9000.0, "reward_amount_meta": 9000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-03-28T20:58:40+00:00", "year": 2024, "attachment_count": 0, "local_path": "issues/331837300", "has_markdown": true }, { "id": "331358160", "title": "Insufficient fix for CVE-2021-30561", "url": "https://issues.chromium.org/issues/331358160", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript>API, Blink>JavaScript>WebAssembly", "reporter": "m-...@github.com", "cve_ids": [ "CVE-2021-30561" ], "bounty_amount": 20000.0, "reward_amount_meta": 20000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-03-27T13:23:05+00:00", "year": 2024, "attachment_count": 2, "local_path": "issues/331358160", "has_markdown": true }, { "id": "331383939", "title": "JS object corruption in WasmJs::InstallTypeReflection", "url": "https://issues.chromium.org/issues/331383939", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript>API, Blink>JavaScript>WebAssembly", "reporter": "m-...@github.com", "cve_ids": [], "bounty_amount": 10000.0, "reward_amount_meta": 10000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-03-27T13:13:53+00:00", "year": 2024, "attachment_count": 3, "local_path": "issues/331383939", "has_markdown": true }, { "id": "331369797", "title": "use-after-poison in blink::AudioContext::OnRenderError", "url": "https://issues.chromium.org/issues/331369797", "status": "Assigned", "severity": "S4-Minimal", "component": "Blink>WebAudio", "reporter": "em...@gmail.com", "cve_ids": [], "bounty_amount": 8000.0, "reward_amount_meta": 8000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-03-26T15:47:31+00:00", "year": 2024, "attachment_count": 6, "local_path": "issues/331369797", "has_markdown": true }, { "id": "331237485", "title": "OOB Access in mojo SkBitmap StructTraits", "url": "https://issues.chromium.org/issues/331237485", "status": "Assigned", "severity": "S3-Low", "component": "Internals>Services>Viz", "reporter": "vu...@darknavy.com", "cve_ids": [], "bounty_amount": 21000.0, "reward_amount_meta": 21000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-03-26T02:58:45+00:00", "year": 2024, "attachment_count": 1, "local_path": "issues/331237485", "has_markdown": true }, { "id": "331123811", "title": "GPU process crash via WebGPU shader - DeleteMemcpy in ScalarReplAggregatesHLSL.cpp", "url": "https://issues.chromium.org/issues/331123811", "status": "Assigned", "severity": "S3-Low", "component": "Blink>WebGPU, Internals>GPU>Dawn", "reporter": "wg...@gmail.com", "cve_ids": [], "bounty_amount": 10000.0, "reward_amount_meta": 10000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-03-25T09:27:53+00:00", "year": 2024, "attachment_count": 1, "local_path": "issues/331123811", "has_markdown": true }, { "id": "330376742", "title": "Security: HTML injection in chrome://browser-switch/", "url": "https://issues.chromium.org/issues/330376742", "status": "Assigned", "severity": "S3-Low", "component": "Enterprise>BrowserSwitcher", "reporter": "ol...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-03-19T21:41:03+00:00", "year": 2024, "attachment_count": 3, "local_path": "issues/330376742", "has_markdown": true }, { "id": "329965696", "title": "heap-use-after-free in PriceTrackingEmailDialogCoordinator::Show", "url": "https://issues.chromium.org/issues/329965696", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>Shopping>PriceTracking", "reporter": "un...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-03-17T09:32:16+00:00", "year": 2024, "attachment_count": 4, "local_path": "issues/329965696", "has_markdown": true }, { "id": "329781390", "title": "security: Type confusion lead to use-after-poison in AuthenticationCredentialsContainer::store", "url": "https://issues.chromium.org/issues/329781390", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Identity>DigitalCredentials", "reporter": "li...@gmail.com", "cve_ids": [], "bounty_amount": 11000.0, "reward_amount_meta": 11000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-03-15T10:30:20+00:00", "year": 2024, "attachment_count": 5, "local_path": "issues/329781390", "has_markdown": true }, { "id": "329476341", "title": "Text Selection menu able to overlap URL bar ", "url": "https://issues.chromium.org/issues/329476341", "status": "Assigned", "severity": "S1-High", "component": "UI>Browser, UI>Browser>Mobile>ContextMenu, UI>Browser>Selection", "reporter": "ch...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-03-14T08:23:08+00:00", "year": 2024, "attachment_count": 5, "local_path": "issues/329476341", "has_markdown": true }, { "id": "329271490", "title": "Stack buffer overflow in angle shader translation", "url": "https://issues.chromium.org/issues/329271490", "status": "Assigned", "severity": "S4-Minimal", "component": "Blink>WebGL, Internals>GPU, Internals>GPU>ANGLE", "reporter": "wg...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-03-13T10:36:06+00:00", "year": 2024, "attachment_count": 2, "local_path": "issues/329271490", "has_markdown": true }, { "id": "329130361", "title": "use-after-poison on blink::MIDIDispatcher::SessionStarted", "url": "https://issues.chromium.org/issues/329130361", "status": "Assigned", "severity": "S3-Low", "component": "Blink>WebMIDI", "reporter": "ki...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-03-12T02:50:39+00:00", "year": 2024, "attachment_count": 2, "local_path": "issues/329130361", "has_markdown": true }, { "id": "329130358", "title": "Security: Signal SIGSEGV in v8", "url": "https://issues.chromium.org/issues/329130358", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript>API, Blink>JavaScript>Runtime, Infra>Client>V8", "reporter": "ki...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-03-12T01:17:18+00:00", "year": 2024, "attachment_count": 1, "local_path": "issues/329130358", "has_markdown": true }, { "id": "328958020", "title": "GPU process crash via WebGPU shader", "url": "https://issues.chromium.org/issues/328958020", "status": "Assigned", "severity": "S3-Low", "component": "Dawn, Internals>GPU>Dawn", "reporter": "wg...@gmail.com", "cve_ids": [], "bounty_amount": 10000.0, "reward_amount_meta": 10000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-03-11T09:14:12+00:00", "year": 2024, "attachment_count": 1, "local_path": "issues/328958020", "has_markdown": true }, { "id": "328918906", "title": "heap-use-after-free heap-use-after-free media\\audio\\audio_renderer_mixer_manager.cc:228 in blink::AudioRendererMixerManager::ReturnMixer", "url": "https://issues.chromium.org/issues/328918906", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Media>Audio, Blink>WebAudio", "reporter": "m....@gmail.com", "cve_ids": [], "bounty_amount": 8000.0, "reward_amount_meta": 8000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-03-11T03:46:02+00:00", "year": 2024, "attachment_count": 7, "local_path": "issues/328918906", "has_markdown": true }, { "id": "328859176", "title": "Incomplete fix for CVE-2024-0223", "url": "https://issues.chromium.org/issues/328859176", "status": "Assigned", "severity": "S3-Low", "component": "Internals>GPU>ANGLE, Internals>GPU>SwiftShader", "reporter": "d8...@gmail.com", "cve_ids": [ "CVE-2024-0223" ], "bounty_amount": 10000.0, "reward_amount_meta": 10000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-03-09T16:35:14+00:00", "year": 2024, "attachment_count": 1, "local_path": "issues/328859176", "has_markdown": true }, { "id": "328690293", "title": "chrome://whats-new/ CSP allows loading any HTTPS page", "url": "https://issues.chromium.org/issues/328690293", "status": "Accepted", "severity": "S3-Low", "component": "UI>Browser>UserEducation", "reporter": "je...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-03-08T17:32:15+00:00", "year": 2024, "attachment_count": 1, "local_path": "issues/328690293", "has_markdown": true }, { "id": "328483401", "title": "Crash in gpu::gles2::GLES2Implementation::BufferDataHelper", "url": "https://issues.chromium.org/issues/328483401", "status": "Assigned", "severity": "S4-Minimal", "component": "Blink>WebGL", "reporter": "ne...@nesk.kr", "cve_ids": [], "bounty_amount": 9000.0, "reward_amount_meta": 9000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-03-07T11:32:44+00:00", "year": 2024, "attachment_count": 0, "local_path": "issues/328483401", "has_markdown": true }, { "id": "328278718", "title": "Fake Downloads and Deceptive Notifications through Browsing History Manipulation.", "url": "https://issues.chromium.org/issues/328278718", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>Downloads, UI>Browser>Navigation", "reporter": "st...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-03-06T15:51:33+00:00", "year": 2024, "attachment_count": 2, "local_path": "issues/328278718", "has_markdown": true }, { "id": "328109821", "title": "heap-buffer-overflow in vk::Image::copy", "url": "https://issues.chromium.org/issues/328109821", "status": "Accepted", "severity": "S3-Low", "component": "Internals>GPU>SwiftShader", "reporter": "em...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-03-05T10:00:49+00:00", "year": 2024, "attachment_count": 3, "local_path": "issues/328109821", "has_markdown": true }, { "id": "327807820", "title": "UAF in vk::Buffer::getOffsetPointer", "url": "https://issues.chromium.org/issues/327807820", "status": "New", "severity": "S4-Minimal", "component": "Internals>GPU>ANGLE, Internals>GPU>SwiftShader", "reporter": "em...@gmail.com", "cve_ids": [], "bounty_amount": 10000.0, "reward_amount_meta": 10000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-03-03T04:46:45+00:00", "year": 2024, "attachment_count": 5, "local_path": "issues/327807820", "has_markdown": true }, { "id": "327740539", "title": "Check failed: !v8::internal::v8_flags.enable_slow_asserts.value() || (IsDereferenceAllowed()).", "url": "https://issues.chromium.org/issues/327740539", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript", "reporter": "wh...@gmail.com", "cve_ids": [], "bounty_amount": 15000.0, "reward_amount_meta": 15000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-03-01T18:43:44+00:00", "year": 2024, "attachment_count": 1, "local_path": "issues/327740539", "has_markdown": true }, { "id": "327687950", "title": "UAF in net::QuicChromiumClientSession::StreamRequest", "url": "https://issues.chromium.org/issues/327687950", "status": "Assigned", "severity": "S3-Low", "component": "Internals>Network>QUIC", "reporter": "em...@gmail.com", "cve_ids": [], "bounty_amount": 10000.0, "reward_amount_meta": 10000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-03-01T09:54:56+00:00", "year": 2024, "attachment_count": 5, "local_path": "issues/327687950", "has_markdown": true }, { "id": "327696052", "title": "Security: heap-use-after-free in ScopedResourceUsageQuery::NotifyObservers", "url": "https://issues.chromium.org/issues/327696052", "status": "Assigned", "severity": "S3-Low", "component": "Internals>PerformanceManager", "reporter": "zh...@gmail.com", "cve_ids": [], "bounty_amount": 4000.0, "reward_amount_meta": 4000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-03-01T08:36:05+00:00", "year": 2024, "attachment_count": 5, "local_path": "issues/327696052", "has_markdown": true }, { "id": "326765855", "title": "UAF in v8_inspector::V8DebuggerAgentImpl::setBlackboxPatterns", "url": "https://issues.chromium.org/issues/326765855", "status": "Assigned", "severity": "S3-Low", "component": "Platform>DevTools", "reporter": "em...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-02-26T07:21:20+00:00", "year": 2024, "attachment_count": 3, "local_path": "issues/326765855", "has_markdown": true }, { "id": "326607008", "title": "UAF in chrome://download-internals on iOS", "url": "https://issues.chromium.org/issues/326607008", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>Downloads", "reporter": "zh...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-02-24T08:26:23+00:00", "year": 2024, "attachment_count": 1, "local_path": "issues/326607008", "has_markdown": true }, { "id": "326607001", "title": "malloc_consolidate(): unaligned fastbin chunk detected in v8", "url": "https://issues.chromium.org/issues/326607001", "status": "Fixed", "severity": "S3-Low", "component": "Blink>JavaScript, Infra>Client>V8", "reporter": "wh...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-02-24T03:34:27+00:00", "year": 2024, "attachment_count": 3, "local_path": "issues/326607001", "has_markdown": true }, { "id": "326277812", "title": "UAF in ActiveDevicesMediaCoordinator::GotDeviceIdsOpenedForWebContents", "url": "https://issues.chromium.org/issues/326277812", "status": "Verified", "severity": "S3-Low", "component": "Internals>Media>UI", "reporter": "jt...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-02-22T09:36:14+00:00", "year": 2024, "attachment_count": 5, "local_path": "issues/326277812", "has_markdown": true }, { "id": "325936438", "title": "UAF in FedCmAccountSelectionView::Show", "url": "https://issues.chromium.org/issues/325936438", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Identity>FedCM", "reporter": "jt...@gmail.com", "cve_ids": [], "bounty_amount": 6000.0, "reward_amount_meta": 6000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-02-20T09:58:42+00:00", "year": 2024, "attachment_count": 6, "local_path": "issues/325936438", "has_markdown": true }, { "id": "325893559", "title": "Debug check failed: index < length() (2 vs. 1)", "url": "https://issues.chromium.org/issues/325893559", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript>WebAssembly", "reporter": "jo...@gmail.com", "cve_ids": [], "bounty_amount": 12000.0, "reward_amount_meta": 12000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-02-19T17:10:37+00:00", "year": 2024, "attachment_count": 2, "local_path": "issues/325893559", "has_markdown": true }, { "id": "325878101", "title": "Debug check failed: IsWasmDispatchTable(table)", "url": "https://issues.chromium.org/issues/325878101", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript>Runtime, Blink>JavaScript>WebAssembly", "reporter": "jo...@gmail.com", "cve_ids": [], "bounty_amount": 12000.0, "reward_amount_meta": 12000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-02-19T15:56:38+00:00", "year": 2024, "attachment_count": 3, "local_path": "issues/325878101", "has_markdown": true }, { "id": "325866363", "title": "Security: Signal SIGSEGV in v8", "url": "https://issues.chromium.org/issues/325866363", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript>WebAssembly", "reporter": "je...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-02-19T15:36:03+00:00", "year": 2024, "attachment_count": 1, "local_path": "issues/325866363", "has_markdown": true }, { "id": "325697537", "title": "UAF in BrowserView", "url": "https://issues.chromium.org/issues/325697537", "status": "Assigned", "severity": "S3-Low", "component": "UI>Accessibility", "reporter": "he...@gmail.com", "cve_ids": [], "bounty_amount": 4000.0, "reward_amount_meta": 4000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-02-17T15:50:00+00:00", "year": 2024, "attachment_count": 10, "local_path": "issues/325697537", "has_markdown": true }, { "id": "325678240", "title": "Security: Debug check failed: is_loadable(). in v8", "url": "https://issues.chromium.org/issues/325678240", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript, Blink>JavaScript>Compiler>Maglev", "reporter": "ki...@gmail.com", "cve_ids": [], "bounty_amount": 8000.0, "reward_amount_meta": 8000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-02-17T14:36:01+00:00", "year": 2024, "attachment_count": 1, "local_path": "issues/325678240", "has_markdown": true }, { "id": "325293263", "title": "Chrome crashes when dragging tab out during initiation of \"Organize Tabs\" function", "url": "https://issues.chromium.org/issues/325293263", "status": "Assigned", "severity": "S3-Low", "component": "Internals>CrashReporting, UI>Browser>TopChrome", "reporter": "xp...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-02-15T01:17:36+00:00", "year": 2024, "attachment_count": 7, "local_path": "issues/325293263", "has_markdown": true }, { "id": "324930013", "title": "monorail: issue chart page leaks unredacted emails", "url": "https://issues.chromium.org/issues/324930013", "status": "Assigned", "severity": "S3-Low", "component": "Issue Tracker, Platform>DevTools", "reporter": "ha...@gmail.com", "cve_ids": [], "bounty_amount": 500.0, "reward_amount_meta": 500.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-02-13T04:02:41+00:00", "year": 2024, "attachment_count": 3, "local_path": "issues/324930013", "has_markdown": true }, { "id": "324864439", "title": "OOB in WebRTC-MultiplexCodec", "url": "https://issues.chromium.org/issues/324864439", "status": "Verified", "severity": "S3-Low", "component": "Blink>WebRTC", "reporter": "em...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-02-12T20:02:59+00:00", "year": 2024, "attachment_count": 2, "local_path": "issues/324864439", "has_markdown": true }, { "id": "324747822", "title": "Debug check failed: !type.is_uninhabited(). in v8", "url": "https://issues.chromium.org/issues/324747822", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript, Blink>JavaScript>Compiler>Turbofan, Blink>JavaScript>WebAssembly", "reporter": "je...@gmail.com", "cve_ids": [], "bounty_amount": 8000.0, "reward_amount_meta": 8000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-02-12T10:55:21+00:00", "year": 2024, "attachment_count": 3, "local_path": "issues/324747822", "has_markdown": true }, { "id": "324770940", "title": "Chrome Update Elevation of Privilege", "url": "https://issues.chromium.org/issues/324770940", "status": "Assigned", "severity": "S3-Low", "component": "Internals>Installer", "reporter": "do...@pksecurity.io", "cve_ids": [ "CVE-2020-1170" ], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-02-11T15:34:10+00:00", "year": 2024, "attachment_count": 0, "local_path": "issues/324770940", "has_markdown": true }, { "id": "324596281", "title": "Debug check failed: !type.has_index(). in v8", "url": "https://issues.chromium.org/issues/324596281", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript, Blink>JavaScript>WebAssembly", "reporter": "je...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-02-11T01:31:14+00:00", "year": 2024, "attachment_count": 2, "local_path": "issues/324596281", "has_markdown": true }, { "id": "324690505", "title": "Debug check failed: i.valid(). in v8", "url": "https://issues.chromium.org/issues/324690505", "status": "Assigned", "severity": "S4-Minimal", "component": "Blink>JavaScript, Blink>JavaScript>WebAssembly", "reporter": "je...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-02-11T01:28:18+00:00", "year": 2024, "attachment_count": 2, "local_path": "issues/324690505", "has_markdown": true }, { "id": "324342761", "title": "Debug check failed: mutable_double_address_ == reinterpret_cast
(raw_bytes_->end()) (23179938834648 vs. 23179938834660)", "url": "https://issues.chromium.org/issues/324342761", "status": "Assigned", "severity": "S4-Minimal", "component": "Blink>JavaScript", "reporter": "wh...@gmail.com", "cve_ids": [], "bounty_amount": 8000.0, "reward_amount_meta": 8000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-02-08T11:23:43+00:00", "year": 2024, "attachment_count": 0, "local_path": "issues/324342761", "has_markdown": true }, { "id": "323813642", "title": "UAF in v8_inspector", "url": "https://issues.chromium.org/issues/323813642", "status": "Assigned", "severity": "S3-Low", "component": "Platform>DevTools>Sources", "reporter": "em...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-02-05T16:39:05+00:00", "year": 2024, "attachment_count": 3, "local_path": "issues/323813642", "has_markdown": true }, { "id": "323583084", "title": "Security: Application can actively circumvent Mixed Content policy in PNA origin trial", "url": "https://issues.chromium.org/issues/323583084", "status": "Assigned", "severity": "S3-Low", "component": "Blink>SecurityFeature>CORS>PrivateNetworkAccess", "reporter": "me...@danielbaulig.de", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-02-03T19:17:17+00:00", "year": 2024, "attachment_count": 0, "local_path": "issues/323583084", "has_markdown": true }, { "id": "41497180", "title": "UAF in webrtc::BitrateAllocator::OnNetworkEstimateChanged", "url": "https://issues.chromium.org/issues/41497180", "status": "Assigned", "severity": "S3-Low", "component": "Blink>WebRTC", "reporter": "em...@gmail.com", "cve_ids": [], "bounty_amount": 11000.0, "reward_amount_meta": 11000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-02-02T06:25:08+00:00", "year": 2024, "attachment_count": 4, "local_path": "issues/41497180", "has_markdown": true }, { "id": "41496366", "title": "Security: Debug check failed: op.input_count >= 2 in v8", "url": "https://issues.chromium.org/issues/41496366", "status": "Fixed", "severity": "S3-Low", "component": "Blink>JavaScript>Compiler>Turbofan", "reporter": "je...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-01-31T00:58:44+00:00", "year": 2024, "attachment_count": 2, "local_path": "issues/41496366", "has_markdown": true }, { "id": "41496084", "title": "Security: Download & Execute File Silently Without Knowing User in Chrome", "url": "https://issues.chromium.org/issues/41496084", "status": "Assigned", "severity": "S3-Low", "component": "Blink>DataTransfer, Blink>Fullscreen, UI>Browser>Downloads, UI>Browser>FullScreen", "reporter": "pu...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-01-30T06:57:41+00:00", "year": 2024, "attachment_count": 5, "local_path": "issues/41496084", "has_markdown": true }, { "id": "41495878", "title": "iOS Chrome External protocol confirmation dialog may overlap with other origins", "url": "https://issues.chromium.org/issues/41495878", "status": "Accepted", "severity": "S3-Low", "component": "Mobile>iOSWeb>Security", "reporter": "ra...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-01-29T17:53:10+00:00", "year": 2024, "attachment_count": 2, "local_path": "issues/41495878", "has_markdown": true }, { "id": "41495060", "title": "Memory corruption in blink::StyleColor", "url": "https://issues.chromium.org/issues/41495060", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Color", "reporter": "he...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-01-26T11:37:47+00:00", "year": 2024, "attachment_count": 4, "local_path": "issues/41495060", "has_markdown": true }, { "id": "41494860", "title": "Security: heap-buffer-overflow in Blink", "url": "https://issues.chromium.org/issues/41494860", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Image, Internals>Skia", "reporter": "jo...@ret2.one", "cve_ids": [], "bounty_amount": 15000.0, "reward_amount_meta": 15000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-01-25T21:21:30+00:00", "year": 2024, "attachment_count": 6, "local_path": "issues/41494860", "has_markdown": true }, { "id": "41494611", "title": "Security: Debug check failed: is_loadable(). in v8", "url": "https://issues.chromium.org/issues/41494611", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript, Blink>JavaScript>Compiler>Maglev", "reporter": "ki...@gmail.com", "cve_ids": [], "bounty_amount": 8000.0, "reward_amount_meta": 8000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-01-25T06:38:08+00:00", "year": 2024, "attachment_count": 1, "local_path": "issues/41494611", "has_markdown": true }, { "id": "41494539", "title": "Undefined behavior in ipcz::DriverMemory::Clone()", "url": "https://issues.chromium.org/issues/41494539", "status": "Assigned", "severity": "S3-Low", "component": "Internals>Core", "reporter": "he...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-01-25T02:25:05+00:00", "year": 2024, "attachment_count": 8, "local_path": "issues/41494539", "has_markdown": true }, { "id": "41494315", "title": "Security: Select Options Can Escape Across Tabs", "url": "https://issues.chromium.org/issues/41494315", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Forms>Select, Blink>HTML, Internals>Sandbox>SiteIsolation", "reporter": "fa...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-01-24T15:30:32+00:00", "year": 2024, "attachment_count": 2, "local_path": "issues/41494315", "has_markdown": true }, { "id": "41493771", "title": "Security: Capture Autofill Data using showPicker Spoofing", "url": "https://issues.chromium.org/issues/41493771", "status": "Accepted", "severity": "S3-Low", "component": "Privacy, UI>Browser>Autofill", "reporter": "fa...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-01-23T10:26:10+00:00", "year": 2024, "attachment_count": 8, "local_path": "issues/41493771", "has_markdown": true }, { "id": "41493674", "title": "Security: Debug check failed: start_instr <= end_instr . in v8", "url": "https://issues.chromium.org/issues/41493674", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript>Compiler>Turbofan", "reporter": "ki...@gmail.com", "cve_ids": [], "bounty_amount": 8000.0, "reward_amount_meta": 8000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-01-23T02:23:40+00:00", "year": 2024, "attachment_count": 2, "local_path": "issues/41493674", "has_markdown": true }, { "id": "41493458", "title": "Security: `Android` Top-level redirect from cross-origin iframe by setting `Content-Security-Policy: sandbox allow-top-navigation` Bypass of Issue 1251790", "url": "https://issues.chromium.org/issues/41493458", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>PopupBlocker", "reporter": "el...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-01-22T13:57:12+00:00", "year": 2024, "attachment_count": 2, "local_path": "issues/41493458", "has_markdown": true }, { "id": "41493290", "title": "Security: UAF IN BaseRenderingContext2D::ResetInternal", "url": "https://issues.chromium.org/issues/41493290", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Canvas", "reporter": "m....@gmail.com", "cve_ids": [], "bounty_amount": 4000.0, "reward_amount_meta": 4000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-01-21T04:22:35+00:00", "year": 2024, "attachment_count": 3, "local_path": "issues/41493290", "has_markdown": true }, { "id": "41493286", "title": "Security: Debug check failed: displacement == 0 in V8.", "url": "https://issues.chromium.org/issues/41493286", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript>Compiler>Turbofan", "reporter": "je...@gmail.com", "cve_ids": [], "bounty_amount": 8000.0, "reward_amount_meta": 8000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-01-21T03:18:10+00:00", "year": 2024, "attachment_count": 10, "local_path": "issues/41493286", "has_markdown": true }, { "id": "41493285", "title": "Security: Debug check failed: element_size_log2 == 0 (\\x2 vs. 0). in v8", "url": "https://issues.chromium.org/issues/41493285", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript, Blink>JavaScript>Compiler>Turbofan", "reporter": "je...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-01-21T02:51:52+00:00", "year": 2024, "attachment_count": 4, "local_path": "issues/41493285", "has_markdown": true }, { "id": "41493175", "title": "Security: Signal SIGSEGV in v8", "url": "https://issues.chromium.org/issues/41493175", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript>Runtime", "reporter": "ki...@gmail.com", "cve_ids": [], "bounty_amount": 8000.0, "reward_amount_meta": 8000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-01-20T08:21:54+00:00", "year": 2024, "attachment_count": 2, "local_path": "issues/41493175", "has_markdown": true }, { "id": "41492634", "title": "UAF in gpu::GpuChannelHost", "url": "https://issues.chromium.org/issues/41492634", "status": "Fixed", "severity": "S3-Low", "component": "Internals>GPU", "reporter": "em...@gmail.com", "cve_ids": [], "bounty_amount": 10000.0, "reward_amount_meta": 10000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-01-18T21:14:00+00:00", "year": 2024, "attachment_count": 6, "local_path": "issues/41492634", "has_markdown": true }, { "id": "41492103", "title": "Security: Directory listing no-cors issue", "url": "https://issues.chromium.org/issues/41492103", "status": "Assigned", "severity": "S3-Low", "component": "Blink>SecurityFeature>CORS", "reporter": "ma...@shell.fishing", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-01-17T12:31:17+00:00", "year": 2024, "attachment_count": 9, "local_path": "issues/41492103", "has_markdown": true }, { "id": "41492087", "title": "In Chrome for Android, attackers can display a tel bubble on the Main Page and hijack the domain shown in the Main Page's Address Bar.", "url": "https://issues.chromium.org/issues/41492087", "status": "Fixed", "severity": "S3-Low", "component": "Mobile>Intents, UI>Browser>Navigation", "reporter": "lu...@gmail.com", "cve_ids": [], "bounty_amount": 500.0, "reward_amount_meta": 500.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-01-17T11:14:00+00:00", "year": 2024, "attachment_count": 11, "local_path": "issues/41492087", "has_markdown": true }, { "id": "41491428", "title": "Security: ui::AXPlatformNodeWin Use-After-Free issue", "url": "https://issues.chromium.org/issues/41491428", "status": "Assigned", "severity": "S4-Minimal", "component": "UI>Accessibility, UI>Browser>Panels", "reporter": "sw...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-01-15T10:51:58+00:00", "year": 2024, "attachment_count": 2, "local_path": "issues/41491428", "has_markdown": true }, { "id": "41491379", "title": "Security: [Network Process] 8-byte use-after-free in `net::QuicChromiumClientSession`", "url": "https://issues.chromium.org/issues/41491379", "status": "Assigned", "severity": "S3-Low", "component": "Internals>Network>QUIC", "reporter": "op...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-01-15T05:48:42+00:00", "year": 2024, "attachment_count": 4, "local_path": "issues/41491379", "has_markdown": true }, { "id": "41491373", "title": "Security: SEGV in turboshaft-loop-peeling", "url": "https://issues.chromium.org/issues/41491373", "status": "Assigned", "severity": "S4-Minimal", "component": "Blink>JavaScript, Blink>JavaScript>Compiler", "reporter": "ki...@gmail.com", "cve_ids": [ "CVE-2016-9651", "CVE-2017-5053" ], "bounty_amount": 8000.0, "reward_amount_meta": 8000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-01-15T03:57:39+00:00", "year": 2024, "attachment_count": 3, "local_path": "issues/41491373", "has_markdown": true }, { "id": "41490491", "title": "Security: Heap-use-after-free in AXTreeDistiller::ScreenAIServiceReady", "url": "https://issues.chromium.org/issues/41490491", "status": "Assigned", "severity": "S4-Minimal", "component": "UI>Accessibility", "reporter": "me...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-01-11T08:28:55+00:00", "year": 2024, "attachment_count": 2, "local_path": "issues/41490491", "has_markdown": true }, { "id": "41489926", "title": "Security: use-after-poison in blink::MLGraphXnnpack::ComputeAsyncImpl", "url": "https://issues.chromium.org/issues/41489926", "status": "Assigned", "severity": "S4-Minimal", "component": "Blink>WebML", "reporter": "zh...@gmail.com", "cve_ids": [], "bounty_amount": 11000.0, "reward_amount_meta": 11000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-01-09T17:37:53+00:00", "year": 2024, "attachment_count": 5, "local_path": "issues/41489926", "has_markdown": true }, { "id": "41488920", "title": "Crash in v8::internal::SemiSpaceNewSpace::VerifyObjects", "url": "https://issues.chromium.org/issues/41488920", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript, Blink>JavaScript>Compiler>Maglev", "reporter": "d8...@gmail.com", "cve_ids": [], "bounty_amount": 16000.0, "reward_amount_meta": 16000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-01-05T17:41:38+00:00", "year": 2024, "attachment_count": 2, "local_path": "issues/41488920", "has_markdown": true }, { "id": "41488824", "title": "Heap-use-after-free in webrtc::JsepTransportController::ValidateAndMaybeUpdateBundleGroups", "url": "https://issues.chromium.org/issues/41488824", "status": "Assigned", "severity": "S4-Minimal", "component": "Blink>WebRTC", "reporter": "m....@gmail.com", "cve_ids": [], "bounty_amount": 9000.0, "reward_amount_meta": 9000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-01-05T10:28:31+00:00", "year": 2024, "attachment_count": 0, "local_path": "issues/41488824", "has_markdown": true }, { "id": "41487933", "title": "Security: about:srcdoc session history entries leak document state cross-origin", "url": "https://issues.chromium.org/issues/41487933", "status": "Assigned", "severity": "S3-Low", "component": "Blink>History, Internals>Sandbox>SiteIsolation, UI>Browser>Navigation", "reporter": "ha...@gmail.com", "cve_ids": [], "bounty_amount": 8000.0, "reward_amount_meta": 8000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-01-03T20:49:14+00:00", "year": 2024, "attachment_count": 9, "local_path": "issues/41487933", "has_markdown": true }, { "id": "41487774", "title": "File Download Origin Spoof Using Long Subdomain", "url": "https://issues.chromium.org/issues/41487774", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>Downloads", "reporter": "lu...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-01-03T08:27:20+00:00", "year": 2024, "attachment_count": 2, "local_path": "issues/41487774", "has_markdown": true }, { "id": "41487721", "title": "Security: Spoofing request source of Apple mobile configuration profile downloads by UI impersonation", "url": "https://issues.chromium.org/issues/41487721", "status": "Assigned", "severity": "S3-Low", "component": "Mobile>iOSWeb>Security", "reporter": "ni...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-01-02T23:16:24+00:00", "year": 2024, "attachment_count": 4, "local_path": "issues/41487721", "has_markdown": true }, { "id": "41487478", "title": "Security: Spoofing Download URL wiith Long Domain", "url": "https://issues.chromium.org/issues/41487478", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>Downloads", "reporter": "fe...@gmail.com", "cve_ids": [], "bounty_amount": 500.0, "reward_amount_meta": 500.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2024-01-01T10:19:18+00:00", "year": 2024, "attachment_count": 2, "local_path": "issues/41487478", "has_markdown": true }, { "id": "41487330", "title": "[webrtc]UAF in RTCPeerConnectionHandler::OnIceCandidate", "url": "https://issues.chromium.org/issues/41487330", "status": "Assigned", "severity": "S3-Low", "component": "Blink>WebRTC, Blink>WebRTC>PeerConnection", "reporter": "em...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-12-29T13:34:17+00:00", "year": 2023, "attachment_count": 3, "local_path": "issues/41487330", "has_markdown": true }, { "id": "41486862", "title": "Security: Memory Corrupt in V8 Webassembly", "url": "https://issues.chromium.org/issues/41486862", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript>Compiler>Turbofan, Blink>JavaScript>WebAssembly", "reporter": "je...@gmail.com", "cve_ids": [], "bounty_amount": 8000.0, "reward_amount_meta": 8000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-12-26T04:14:16+00:00", "year": 2023, "attachment_count": 3, "local_path": "issues/41486862", "has_markdown": true }, { "id": "41486859", "title": "Security: container-overflow in FileSystemAccessManagerImpl::DidCleanupAccessHandleCapacityAllocation", "url": "https://issues.chromium.org/issues/41486859", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Storage>FileSystem", "reporter": "vu...@darknavy.com", "cve_ids": [], "bounty_amount": 21000.0, "reward_amount_meta": 21000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-12-26T02:13:22+00:00", "year": 2023, "attachment_count": 2, "local_path": "issues/41486859", "has_markdown": true }, { "id": "41486690", "title": "Extension sanitization bypass - Setting file extension as \"%%\" resorts to the previous text", "url": "https://issues.chromium.org/issues/41486690", "status": "Assigned", "severity": "S4-Minimal", "component": "UI>Browser>Downloads", "reporter": "br...@gmail.com", "cve_ids": [], "bounty_amount": 4000.0, "reward_amount_meta": 4000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-12-24T21:59:41+00:00", "year": 2023, "attachment_count": 5, "local_path": "issues/41486690", "has_markdown": true }, { "id": "41486636", "title": "Security: SEGV in v8_wasm_compile_fuzzer ", "url": "https://issues.chromium.org/issues/41486636", "status": "Accepted", "severity": "S3-Low", "component": "Blink>JavaScript", "reporter": "al...@goodmanemail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-12-24T00:53:52+00:00", "year": 2023, "attachment_count": 2, "local_path": "issues/41486636", "has_markdown": true }, { "id": "41486208", "title": "Security: Downloading .scf files possible with a drag and drop, stealing NTLM hashes", "url": "https://issues.chromium.org/issues/41486208", "status": "Assigned", "severity": "S3-Low", "component": "Blink>DataTransfer", "reporter": "ba...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-12-21T09:59:58+00:00", "year": 2023, "attachment_count": 6, "local_path": "issues/41486208", "has_markdown": true }, { "id": "41486150", "title": "Security: Debug check failed: displacement == 0 . in v8", "url": "https://issues.chromium.org/issues/41486150", "status": "Accepted", "severity": "S3-Low", "component": "Blink>JavaScript>Compiler>Turbofan, Blink>JavaScript>WebAssembly", "reporter": "je...@gmail.com", "cve_ids": [], "bounty_amount": 8000.0, "reward_amount_meta": 8000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-12-21T02:38:29+00:00", "year": 2023, "attachment_count": 2, "local_path": "issues/41486150", "has_markdown": true }, { "id": "41485950", "title": "Security: CRX3 File Signature Verification Bypass via Embedded ZIP64 Payload", "url": "https://issues.chromium.org/issues/41485950", "status": "Assigned", "severity": "S3-Low", "component": "Internals>Cast, Internals>Installer>Components, Internals>Updater, Platform>Extensions", "reporter": "ma...@sodium24.com", "cve_ids": [], "bounty_amount": 6000.0, "reward_amount_meta": 6000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-12-20T10:13:42+00:00", "year": 2023, "attachment_count": 8, "local_path": "issues/41485950", "has_markdown": true }, { "id": "41485789", "title": "Improper handling of duplicate `` and `` tags enables CSP nonce leakage", "url": "https://issues.chromium.org/issues/41485789", "status": "Assigned", "severity": "S3-Low", "component": "Blink>SecurityFeature>ContentSecurityPolicy", "reporter": "fe...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-12-19T18:08:24+00:00", "year": 2023, "attachment_count": 0, "local_path": "issues/41485789", "has_markdown": true }, { "id": "41485769", "title": "Security: Spoof to allow permission", "url": "https://issues.chromium.org/issues/41485769", "status": "Fixed", "severity": "S3-Low", "component": "Internals>Preload", "reporter": "sa...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-12-19T17:05:40+00:00", "year": 2023, "attachment_count": 5, "local_path": "issues/41485769", "has_markdown": true }, { "id": "41485206", "title": "Security: Guess a cross-origin iframe URL by firing multiple navigations", "url": "https://issues.chromium.org/issues/41485206", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>Navigation", "reporter": "re...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-12-18T16:33:22+00:00", "year": 2023, "attachment_count": 2, "local_path": "issues/41485206", "has_markdown": true }, { "id": "41485059", "title": "Security: Debug check failed: var.has_value(). in v8", "url": "https://issues.chromium.org/issues/41485059", "status": "Assigned", "severity": "S4-Minimal", "component": "Blink>JavaScript, Blink>JavaScript>Compiler>Turbofan", "reporter": "je...@gmail.com", "cve_ids": [], "bounty_amount": 8000.0, "reward_amount_meta": 8000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-12-18T02:48:45+00:00", "year": 2023, "attachment_count": 2, "local_path": "issues/41485059", "has_markdown": true }, { "id": "41484965", "title": "Security: Enterprise Policy Bypass Vulnerability Allows Download of Internal/Blocked Files", "url": "https://issues.chromium.org/issues/41484965", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Storage>FileSystem, UI>Browser>Downloads", "reporter": "fa...@gmail.com", "cve_ids": [ "CVE-2023-4904" ], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-12-16T20:51:14+00:00", "year": 2023, "attachment_count": 2, "local_path": "issues/41484965", "has_markdown": true }, { "id": "41484431", "title": "Security: Debug check failed: inlinee.sig->return_count() == sig->return_count() . in v8", "url": "https://issues.chromium.org/issues/41484431", "status": "Assigned", "severity": "S4-Minimal", "component": "Blink>JavaScript>Compiler>Turbofan, Blink>JavaScript>WebAssembly", "reporter": "je...@gmail.com", "cve_ids": [], "bounty_amount": 11000.0, "reward_amount_meta": 11000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-12-15T02:42:54+00:00", "year": 2023, "attachment_count": 7, "local_path": "issues/41484431", "has_markdown": true }, { "id": "41484271", "title": "Security: Use After Free in sqlite", "url": "https://issues.chromium.org/issues/41484271", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Storage>WebSQL, Internals>Storage>SQLite", "reporter": "gc...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-12-14T17:04:35+00:00", "year": 2023, "attachment_count": 4, "local_path": "issues/41484271", "has_markdown": true }, { "id": "41484151", "title": "Security: Heap-use-after-free blink::BaseRenderingContext2D::DrawTextInternal base_rendering_context_2d.cc:2856", "url": "https://issues.chromium.org/issues/41484151", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Canvas", "reporter": "m....@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-12-14T09:30:11+00:00", "year": 2023, "attachment_count": 4, "local_path": "issues/41484151", "has_markdown": true }, { "id": "41483793", "title": "Security: Omnibox Spoofing in MacOS", "url": "https://issues.chromium.org/issues/41483793", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>FullScreen", "reporter": "fa...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-12-13T11:30:29+00:00", "year": 2023, "attachment_count": 4, "local_path": "issues/41483793", "has_markdown": true }, { "id": "41483711", "title": "Security: Title : Debug check failed: Asm().current_block()->IsMerge() && inputs.size() == Asm().current_block()->Predecessors().size(). in v8, leading to SEGV", "url": "https://issues.chromium.org/issues/41483711", "status": "Assigned", "severity": "S4-Minimal", "component": "Blink>JavaScript>Compiler>Turbofan", "reporter": "je...@gmail.com", "cve_ids": [], "bounty_amount": 8000.0, "reward_amount_meta": 8000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-12-13T03:45:13+00:00", "year": 2023, "attachment_count": 2, "local_path": "issues/41483711", "has_markdown": true }, { "id": "41483350", "title": "Security: Heap-use-after-free in Accessibility", "url": "https://issues.chromium.org/issues/41483350", "status": "Assigned", "severity": "S4-Minimal", "component": "Internals>Accessibility", "reporter": "ti...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-12-12T05:52:02+00:00", "year": 2023, "attachment_count": 1, "local_path": "issues/41483350", "has_markdown": true }, { "id": "41483297", "title": "Security: Type confusion in Harmony Set methods (Leads to RCE)", "url": "https://issues.chromium.org/issues/41483297", "status": "Fixed", "severity": "S4-Minimal", "component": "Blink>JavaScript, Blink>JavaScript>Runtime", "reporter": "h0...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-12-12T01:29:07+00:00", "year": 2023, "attachment_count": 4, "local_path": "issues/41483297", "has_markdown": true }, { "id": "41481877", "title": "Running JavaScript on file:// URI allowing to access information and access camera for iOS Chrome ", "url": "https://issues.chromium.org/issues/41481877", "status": "Assigned", "severity": "S3-Low", "component": "Mobile>Fundamentals>Security", "reporter": "pr...@gmail.com", "cve_ids": [ "CVE-2022-4185" ], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-12-07T04:33:43+00:00", "year": 2023, "attachment_count": 15, "local_path": "issues/41481877", "has_markdown": true }, { "id": "41481374", "title": "UAF in mojo::WaitSet::State::Context::OnNotification", "url": "https://issues.chromium.org/issues/41481374", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Storage, Internals>Mojo", "reporter": "em...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-12-06T06:15:17+00:00", "year": 2023, "attachment_count": 7, "local_path": "issues/41481374", "has_markdown": true }, { "id": "40948927", "title": "Security: Debug check failed: idx.offset() / sizeof(OperationStorageSlot) < size(), leading to segment fault.", "url": "https://issues.chromium.org/issues/40948927", "status": "Accepted", "severity": "S4-Minimal", "component": "Blink>JavaScript>WebAssembly", "reporter": "je...@gmail.com", "cve_ids": [], "bounty_amount": 11000.0, "reward_amount_meta": 11000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-12-05T02:35:34+00:00", "year": 2023, "attachment_count": 11, "local_path": "issues/40948927", "has_markdown": true }, { "id": "40948479", "title": "Security: Debug check failed: !can_be_invalid implies result.valid().", "url": "https://issues.chromium.org/issues/40948479", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript>WebAssembly", "reporter": "je...@gmail.com", "cve_ids": [], "bounty_amount": 10000.0, "reward_amount_meta": 10000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-12-04T10:52:08+00:00", "year": 2023, "attachment_count": 8, "local_path": "issues/40948479", "has_markdown": true }, { "id": "40948441", "title": "Security: Debug check failed: use->opcode() == IrOpcode::kLoopExitEffect || use->opcode() == IrOpcode::kLoopExitValue.", "url": "https://issues.chromium.org/issues/40948441", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript>WebAssembly", "reporter": "je...@gmail.com", "cve_ids": [], "bounty_amount": 8000.0, "reward_amount_meta": 8000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-12-04T07:44:08+00:00", "year": 2023, "attachment_count": 6, "local_path": "issues/40948441", "has_markdown": true }, { "id": "40948126", "title": "Security: Extensions are able to inject resources into Chrome URLs.", "url": "https://issues.chromium.org/issues/40948126", "status": "Accepted", "severity": "S3-Low", "component": "Unknown", "reporter": "fa...@gmail.com", "cve_ids": [], "bounty_amount": 500.0, "reward_amount_meta": 500.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-12-02T19:59:41+00:00", "year": 2023, "attachment_count": 5, "local_path": "issues/40948126", "has_markdown": true }, { "id": "40948107", "title": "Security: Debug check failed: HasFeedbackMetadata(kAcquireLoad)", "url": "https://issues.chromium.org/issues/40948107", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript>Compiler>Maglev, Blink>JavaScript>Compiler>Turbofan", "reporter": "wh...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-12-02T16:28:57+00:00", "year": 2023, "attachment_count": 9, "local_path": "issues/40948107", "has_markdown": true }, { "id": "40947602", "title": "Security: Heap-use-after-free WRITE 16 · cppgc::internal::PersistentRegionBase::ClearAllUsedNodes", "url": "https://issues.chromium.org/issues/40947602", "status": "Assigned", "severity": "S3-Low", "component": "Blink>WebGPU", "reporter": "m....@gmail.com", "cve_ids": [], "bounty_amount": 11000.0, "reward_amount_meta": 11000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-12-01T09:21:46+00:00", "year": 2023, "attachment_count": 4, "local_path": "issues/40947602", "has_markdown": true }, { "id": "40946724", "title": "Security: Security UI Spoofing on Chrome for Android due to the tabstrip hiding the fullscreen notification ", "url": "https://issues.chromium.org/issues/40946724", "status": "Accepted", "severity": "S3-Low", "component": "UI>Browser>FullScreen, UI>Browser>Mobile>TabStrip", "reporter": "ch...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-11-29T16:09:33+00:00", "year": 2023, "attachment_count": 5, "local_path": "issues/40946724", "has_markdown": true }, { "id": "40946348", "title": "UAF in blink::RTCEncodedAudioUnderlyingSource::OnFrameFromSource ", "url": "https://issues.chromium.org/issues/40946348", "status": "Assigned", "severity": "S3-Low", "component": "Blink>WebRTC", "reporter": "em...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-11-28T11:14:38+00:00", "year": 2023, "attachment_count": 5, "local_path": "issues/40946348", "has_markdown": true }, { "id": "40946325", "title": "Elevation of Privilege in GoogleUpdate with Windows", "url": "https://issues.chromium.org/issues/40946325", "status": "Assigned", "severity": "S3-Low", "component": "Internals>Updater", "reporter": "do...@pksecurity.io", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-11-28T09:15:28+00:00", "year": 2023, "attachment_count": 2, "local_path": "issues/40946325", "has_markdown": true }, { "id": "40945830", "title": "embed element allows to access camera and Pan-Tilt-Zoom on legitimate webcam site with no ua", "url": "https://issues.chromium.org/issues/40945830", "status": "Assigned", "severity": "S3-Low", "component": "Mobile>iOSWeb>Media", "reporter": "pr...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-11-25T23:21:19+00:00", "year": 2023, "attachment_count": 8, "local_path": "issues/40945830", "has_markdown": true }, { "id": "40945804", "title": "Security: iOS file picker dialog can be shown over a different tab", "url": "https://issues.chromium.org/issues/40945804", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>Navigation", "reporter": "ho...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-11-25T17:13:01+00:00", "year": 2023, "attachment_count": 2, "local_path": "issues/40945804", "has_markdown": true }, { "id": "40945774", "title": "Security: AddressSanitizer: heap-use-after-free on address 0x11f602026080 at pc 0x7ffc02e5a899 bp 0x000bbe7fed80 sp 0x000bbe7fedc8", "url": "https://issues.chromium.org/issues/40945774", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>Passwords", "reporter": "18...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-11-25T08:57:10+00:00", "year": 2023, "attachment_count": 2, "local_path": "issues/40945774", "has_markdown": true }, { "id": "40945677", "title": "Security: use-after-free of AudioArray in blink::DelayHandler::Process", "url": "https://issues.chromium.org/issues/40945677", "status": "Assigned", "severity": "S4-Minimal", "component": "Blink>Media>Audio, Blink>WebAudio", "reporter": "su...@gmail.com", "cve_ids": [], "bounty_amount": 10000.0, "reward_amount_meta": 10000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-11-24T16:27:08+00:00", "year": 2023, "attachment_count": 1, "local_path": "issues/40945677", "has_markdown": true }, { "id": "40945671", "title": "Security: SincResampler buffer UAF", "url": "https://issues.chromium.org/issues/40945671", "status": "Assigned", "severity": "S4-Minimal", "component": "Blink>WebAudio", "reporter": "su...@gmail.com", "cve_ids": [], "bounty_amount": 11000.0, "reward_amount_meta": 11000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-11-24T16:08:30+00:00", "year": 2023, "attachment_count": 2, "local_path": "issues/40945671", "has_markdown": true }, { "id": "40945594", "title": "Security: WebGL Vulkan Spirv bytecode builder length truncate lead to heap overflow", "url": "https://issues.chromium.org/issues/40945594", "status": "Assigned", "severity": "S3-Low", "component": "Internals>GPU>ANGLE, Internals>GPU>SwiftShader", "reporter": "d8...@gmail.com", "cve_ids": [], "bounty_amount": 15000.0, "reward_amount_meta": 15000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-11-24T10:03:37+00:00", "year": 2023, "attachment_count": 1, "local_path": "issues/40945594", "has_markdown": true }, { "id": "40945587", "title": "Security: Heap-use-after-free in WebUIBubbleDialogView::ClearContentsWrapper", "url": "https://issues.chromium.org/issues/40945587", "status": "Accepted", "severity": "S3-Low", "component": "UI>Browser>ContentSuggestions", "reporter": "me...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-11-24T09:12:20+00:00", "year": 2023, "attachment_count": 4, "local_path": "issues/40945587", "has_markdown": true }, { "id": "40945515", "title": "Security: Stack-buffer-underflow in DataPack::GetStringPieceFromOffset when loading a malicious theme", "url": "https://issues.chromium.org/issues/40945515", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>Themes, UI>Browser>WebUI", "reporter": "re...@gmail.com", "cve_ids": [], "bounty_amount": 6000.0, "reward_amount_meta": 6000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-11-24T00:16:12+00:00", "year": 2023, "attachment_count": 5, "local_path": "issues/40945515", "has_markdown": true }, { "id": "40945359", "title": "Security: heap-use-after-free in libavif when decode the crafted avif file.", "url": "https://issues.chromium.org/issues/40945359", "status": "Assigned", "severity": "S4-Minimal", "component": "Internals>Images>Codecs", "reporter": "me...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-11-23T12:41:55+00:00", "year": 2023, "attachment_count": 2, "local_path": "issues/40945359", "has_markdown": true }, { "id": "40945098", "title": "memory corruption in sw::SpirvEmitter::getImageSampler", "url": "https://issues.chromium.org/issues/40945098", "status": "Assigned", "severity": "S3-Low", "component": "Internals>GPU>SwiftShader", "reporter": "em...@gmail.com", "cve_ids": [], "bounty_amount": 10000.0, "reward_amount_meta": 10000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-11-22T15:32:47+00:00", "year": 2023, "attachment_count": 1, "local_path": "issues/40945098", "has_markdown": true }, { "id": "40945077", "title": "Security: Fullscreen Quickly Hide \"Press and hold Esc to exit fullscreen and see download\" Notification", "url": "https://issues.chromium.org/issues/40945077", "status": "Accepted", "severity": "S3-Low", "component": "UI>Browser>FullScreen", "reporter": "pu...@gmail.com", "cve_ids": [], "bounty_amount": 500.0, "reward_amount_meta": 500.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-11-22T14:02:46+00:00", "year": 2023, "attachment_count": 7, "local_path": "issues/40945077", "has_markdown": true }, { "id": "40944847", "title": "Security: File picker dialog can be shown over a different tab", "url": "https://issues.chromium.org/issues/40944847", "status": "Accepted", "severity": "S3-Low", "component": "Blink>Forms>File, UI>Browser>Navigation", "reporter": "ch...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-11-21T22:58:57+00:00", "year": 2023, "attachment_count": 4, "local_path": "issues/40944847", "has_markdown": true }, { "id": "40944020", "title": "Opening the Sidepanel results in plaintext HTTP requests to gstatic URLs", "url": "https://issues.chromium.org/issues/40944020", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>TopChrome>SidePanel", "reporter": "d4...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-11-20T06:55:42+00:00", "year": 2023, "attachment_count": 2, "local_path": "issues/40944020", "has_markdown": true }, { "id": "40943982", "title": "Security: [V8] [turboshaft] Yet another minus zero case missing when typing divisions.", "url": "https://issues.chromium.org/issues/40943982", "status": "Fixed", "severity": "S3-Low", "component": "Blink>JavaScript>Compiler>Turbofan", "reporter": "in...@gmail.com", "cve_ids": [], "bounty_amount": 11000.0, "reward_amount_meta": 11000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-11-19T22:22:23+00:00", "year": 2023, "attachment_count": 4, "local_path": "issues/40943982", "has_markdown": true }, { "id": "40942995", "title": "SwiftShader: UAF in isCubeCompatible ", "url": "https://issues.chromium.org/issues/40942995", "status": "Assigned", "severity": "S3-Low", "component": "Internals>GPU>SwiftShader", "reporter": "em...@gmail.com", "cve_ids": [], "bounty_amount": 4000.0, "reward_amount_meta": 4000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-11-15T19:11:13+00:00", "year": 2023, "attachment_count": 13, "local_path": "issues/40942995", "has_markdown": true }, { "id": "40942837", "title": "UAF in WallpaperSearch", "url": "https://issues.chromium.org/issues/40942837", "status": "Accepted", "severity": "S4-Minimal", "component": "Unknown", "reporter": "he...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-11-15T12:33:39+00:00", "year": 2023, "attachment_count": 3, "local_path": "issues/40942837", "has_markdown": true }, { "id": "40942531", "title": "Security: Origin spoof caused by navigation that doesn't paint any content", "url": "https://issues.chromium.org/issues/40942531", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Paint, UI>Browser>Navigation, UI>Browser>Omnibox", "reporter": "st...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-11-14T17:46:55+00:00", "year": 2023, "attachment_count": 5, "local_path": "issues/40942531", "has_markdown": true }, { "id": "40942439", "title": "use-after-poison in mojo::SimpleWatcher::OnHandleReady - image_bitmap_factories.cc Check failed: script_state->ContextIsValid(). ", "url": "https://issues.chromium.org/issues/40942439", "status": "Assigned", "severity": "S3-Low", "component": "Blink>GarbageCollection, Internals>Mojo", "reporter": "em...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-11-14T11:28:28+00:00", "year": 2023, "attachment_count": 1, "local_path": "issues/40942439", "has_markdown": true }, { "id": "40942152", "title": "Security: Attacker Can Execute Arbitrary JavaScript Code in the Highly Privileged \"devtools://devtools\" Origin", "url": "https://issues.chromium.org/issues/40942152", "status": "Assigned", "severity": "S3-Low", "component": "Platform>DevTools", "reporter": "ad...@gmail.com", "cve_ids": [], "bounty_amount": 6000.0, "reward_amount_meta": 6000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-11-13T15:37:15+00:00", "year": 2023, "attachment_count": 7, "local_path": "issues/40942152", "has_markdown": true }, { "id": "40942112", "title": "Security: WebGL Texture RenderTarget Vulkan backend UAF", "url": "https://issues.chromium.org/issues/40942112", "status": "Assigned", "severity": "S3-Low", "component": "Internals>GPU>ANGLE", "reporter": "d8...@gmail.com", "cve_ids": [], "bounty_amount": 15000.0, "reward_amount_meta": 15000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-11-13T13:24:12+00:00", "year": 2023, "attachment_count": 4, "local_path": "issues/40942112", "has_markdown": true }, { "id": "40942082", "title": "Security: heap-use-after-free in libavif when decode the crafted avif file.", "url": "https://issues.chromium.org/issues/40942082", "status": "Assigned", "severity": "S3-Low", "component": "Internals>Images>Codecs", "reporter": "me...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-11-13T11:12:13+00:00", "year": 2023, "attachment_count": 2, "local_path": "issues/40942082", "has_markdown": true }, { "id": "40942077", "title": "Security: heap-buffer-overflow in libavif when decode the crafted avif file", "url": "https://issues.chromium.org/issues/40942077", "status": "Assigned", "severity": "S3-Low", "component": "Internals>Images>Codecs", "reporter": "me...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-11-13T11:03:10+00:00", "year": 2023, "attachment_count": 2, "local_path": "issues/40942077", "has_markdown": true }, { "id": "40942069", "title": "Security: Content-Type x-mixed-replace can be abused to bypass CSP on iOS", "url": "https://issues.chromium.org/issues/40942069", "status": "Accepted", "severity": "S4-Minimal", "component": "Blink>SecurityFeature", "reporter": "jo...@gmail.com", "cve_ids": [ "CVE-2024-23263" ], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-11-13T10:23:46+00:00", "year": 2023, "attachment_count": 0, "local_path": "issues/40942069", "has_markdown": true }, { "id": "40941600", "title": "Security: V8 Debug check failed: LAST_TYPE >= value", "url": "https://issues.chromium.org/issues/40941600", "status": "Assigned", "severity": "S4-Minimal", "component": "Blink>JavaScript>Runtime", "reporter": "vu...@gmail.com", "cve_ids": [], "bounty_amount": 16000.0, "reward_amount_meta": 16000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-11-10T13:24:28+00:00", "year": 2023, "attachment_count": 1, "local_path": "issues/40941600", "has_markdown": true }, { "id": "40941179", "title": "Security: UAF in FedCmAccountSelectionView::Show", "url": "https://issues.chromium.org/issues/40941179", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Identity>FedCM", "reporter": "jt...@gmail.com", "cve_ids": [], "bounty_amount": 6000.0, "reward_amount_meta": 6000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-11-09T12:23:08+00:00", "year": 2023, "attachment_count": 8, "local_path": "issues/40941179", "has_markdown": true }, { "id": "40941111", "title": "Security: WebAudio UAF caused by setSinkId", "url": "https://issues.chromium.org/issues/40941111", "status": "Assigned", "severity": "S4-Minimal", "component": "Blink>WebAudio", "reporter": "su...@gmail.com", "cve_ids": [], "bounty_amount": 10000.0, "reward_amount_meta": 10000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-11-09T07:38:24+00:00", "year": 2023, "attachment_count": 1, "local_path": "issues/40941111", "has_markdown": true }, { "id": "40940854", "title": "Security: Bypass the Protection of PaymentRequest dialog saved chrome Data, Bypass of Issue 1403539", "url": "https://issues.chromium.org/issues/40940854", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Media>PictureInPicture, Blink>Payments", "reporter": "el...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-11-08T13:48:25+00:00", "year": 2023, "attachment_count": 9, "local_path": "issues/40940854", "has_markdown": true }, { "id": "40940830", "title": "Security: heap-buffer-overflow in gfx::RenderText::TextIndexToDisplayIndex", "url": "https://issues.chromium.org/issues/40940830", "status": "Fixed", "severity": "S4-Minimal", "component": "UI>GFX", "reporter": "ki...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-11-08T11:48:26+00:00", "year": 2023, "attachment_count": 4, "local_path": "issues/40940830", "has_markdown": true }, { "id": "40940815", "title": "Security: UAF in DigitalCredentialProviderAndroid", "url": "https://issues.chromium.org/issues/40940815", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Identity>FedCM", "reporter": "jt...@gmail.com", "cve_ids": [], "bounty_amount": 38000.0, "reward_amount_meta": 38000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-11-08T10:58:05+00:00", "year": 2023, "attachment_count": 3, "local_path": "issues/40940815", "has_markdown": true }, { "id": "40076226", "title": "Security: Heap-use-after-free in ChromeComposeClient::ShowComposeDialog", "url": "https://issues.chromium.org/issues/40076226", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>ContentSuggestions", "reporter": "me...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-11-06T11:45:49+00:00", "year": 2023, "attachment_count": 4, "local_path": "issues/40076226", "has_markdown": true }, { "id": "40076120", "title": "Security: Document Picture-in-Picture API can be used to spoof file reads and writes", "url": "https://issues.chromium.org/issues/40076120", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Media>PictureInPicture", "reporter": "re...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-11-02T18:18:40+00:00", "year": 2023, "attachment_count": 2, "local_path": "issues/40076120", "has_markdown": true }, { "id": "40076065", "title": "Security: Bypass the Protection of input fields cache (Autofill) 1395164", "url": "https://issues.chromium.org/issues/40076065", "status": "Accepted", "severity": "S3-Low", "component": "UI>Browser>Autofill", "reporter": "el...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-11-01T14:18:54+00:00", "year": 2023, "attachment_count": 7, "local_path": "issues/40076065", "has_markdown": true }, { "id": "40075982", "title": "Security: heap-use-after-free in blink::FormData::append form_data.cc:151", "url": "https://issues.chromium.org/issues/40075982", "status": "Assigned", "severity": "S3-Low", "component": "Blink>GarbageCollection, Blink>Network>FetchAPI", "reporter": "m....@gmail.com", "cve_ids": [], "bounty_amount": 10000.0, "reward_amount_meta": 10000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-10-31T15:00:20+00:00", "year": 2023, "attachment_count": 6, "local_path": "issues/40075982", "has_markdown": true }, { "id": "40075980", "title": "Security: Bypass and Semi Regression of Issue 1472404 fix which Bypass the Protection of input fields cache (Autofill) ", "url": "https://issues.chromium.org/issues/40075980", "status": "Accepted", "severity": "S4-Minimal", "component": "UI>Browser>Autofill", "reporter": "el...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-10-31T14:14:47+00:00", "year": 2023, "attachment_count": 10, "local_path": "issues/40075980", "has_markdown": true }, { "id": "40075979", "title": "[module:breakout_box]use-after-poison in blink::FrameQueueUnderlyingSource", "url": "https://issues.chromium.org/issues/40075979", "status": "Assigned", "severity": "S3-Low", "component": "Blink>MediaStream", "reporter": "em...@gmail.com", "cve_ids": [], "bounty_amount": 10000.0, "reward_amount_meta": 10000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-10-31T14:10:19+00:00", "year": 2023, "attachment_count": 4, "local_path": "issues/40075979", "has_markdown": true }, { "id": "40075944", "title": "UAP in permissions::PermissionRequestQueue::Peek", "url": "https://issues.chromium.org/issues/40075944", "status": "New", "severity": "S3-Low", "component": "UI>Browser>Permissions>Prompts", "reporter": "ha...@gmail.com", "cve_ids": [], "bounty_amount": 41000.0, "reward_amount_meta": 41000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-10-31T03:04:35+00:00", "year": 2023, "attachment_count": 3, "local_path": "issues/40075944", "has_markdown": true }, { "id": "40075849", "title": "Security: Elevation of Privilege via Vulnerability in Keystone for macOS", "url": "https://issues.chromium.org/issues/40075849", "status": "Assigned", "severity": "S3-Low", "component": "Internals>Updater", "reporter": "ma...@gmail.com", "cve_ids": [], "bounty_amount": 10000.0, "reward_amount_meta": 10000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-10-29T07:35:39+00:00", "year": 2023, "attachment_count": 17, "local_path": "issues/40075849", "has_markdown": true }, { "id": "40075744", "title": "Security: Check failed: !v8::internal::v8_flags.enable_slow_asserts.value() || (IsSharedFunctionInfo_NonInline(*this)).", "url": "https://issues.chromium.org/issues/40075744", "status": "Assigned", "severity": "S4-Minimal", "component": "Blink>JavaScript>Compiler>Maglev", "reporter": "ki...@gmail.com", "cve_ids": [], "bounty_amount": 8000.0, "reward_amount_meta": 8000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-10-27T02:15:36+00:00", "year": 2023, "attachment_count": 2, "local_path": "issues/40075744", "has_markdown": true }, { "id": "40075672", "title": "Security: chrome.debugger API can capture cookies of host blocked by Enterprise Policy", "url": "https://issues.chromium.org/issues/40075672", "status": "Assigned", "severity": "S3-Low", "component": "Enterprise, Platform>Extensions", "reporter": "fa...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-10-26T11:13:32+00:00", "year": 2023, "attachment_count": 7, "local_path": "issues/40075672", "has_markdown": true }, { "id": "40075655", "title": "UAF in GrDrawOpAtlas (with --headless mode)", "url": "https://issues.chromium.org/issues/40075655", "status": "Accepted", "severity": "S3-Low", "component": "Internals>Skia", "reporter": "em...@gmail.com", "cve_ids": [], "bounty_amount": 10000.0, "reward_amount_meta": 10000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-10-26T07:45:36+00:00", "year": 2023, "attachment_count": 2, "local_path": "issues/40075655", "has_markdown": true }, { "id": "40075535", "title": "iOS Chrome Media Permission Privilege Escalation", "url": "https://issues.chromium.org/issues/40075535", "status": "Assigned", "severity": "S3-Low", "component": "Blink>GetUserMedia, Internals>Permissions>Model", "reporter": "pr...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-10-24T21:30:01+00:00", "year": 2023, "attachment_count": 1, "local_path": "issues/40075535", "has_markdown": true }, { "id": "40075409", "title": "Security: UAF in gcm::GCMDriver::Shutdown", "url": "https://issues.chromium.org/issues/40075409", "status": "Fixed", "severity": "S3-Low", "component": "Unknown", "reporter": "0x...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-10-23T00:53:02+00:00", "year": 2023, "attachment_count": 0, "local_path": "issues/40075409", "has_markdown": true }, { "id": "40075394", "title": "Security: Google Chrome MetalCompiler OOB Access Vulnerability", "url": "https://issues.chromium.org/issues/40075394", "status": "Assigned", "severity": "S3-Low", "component": "Blink>WebGL, Internals>GPU, Internals>GPU>ANGLE", "reporter": "pw...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-10-22T11:43:24+00:00", "year": 2023, "attachment_count": 2, "local_path": "issues/40075394", "has_markdown": true }, { "id": "40937251", "title": "UAF in vk::Format::getAspectFormat(unsigned int)", "url": "https://issues.chromium.org/issues/40937251", "status": "Assigned", "severity": "S3-Low", "component": "Internals>GPU>SwiftShader", "reporter": "em...@gmail.com", "cve_ids": [], "bounty_amount": 10000.0, "reward_amount_meta": 10000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-10-22T02:09:01+00:00", "year": 2023, "attachment_count": 2, "local_path": "issues/40937251", "has_markdown": true }, { "id": "40075363", "title": "heap-buffer-overflow in ~SingleShotFrameHandler(imagecapture/image_capture_frame_grabber.cc)", "url": "https://issues.chromium.org/issues/40075363", "status": "Assigned", "severity": "S3-Low", "component": "Blink>ImageCapture, Blink>Scheduling", "reporter": "em...@gmail.com", "cve_ids": [], "bounty_amount": 8000.0, "reward_amount_meta": 8000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-10-21T05:38:57+00:00", "year": 2023, "attachment_count": 4, "local_path": "issues/40075363", "has_markdown": true }, { "id": "40075359", "title": "Security: Heap-use-after-free in lens::OpenLensRegionSearchInstructions", "url": "https://issues.chromium.org/issues/40075359", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>SearchSidePanel", "reporter": "ch...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-10-21T04:19:45+00:00", "year": 2023, "attachment_count": 1, "local_path": "issues/40075359", "has_markdown": true }, { "id": "40075342", "title": "Security: UAF in MojoPipe", "url": "https://issues.chromium.org/issues/40075342", "status": "Assigned", "severity": "S3-Low", "component": "Internals>Mojo, Internals>Mojo>Bindings", "reporter": "le...@gmail.com", "cve_ids": [], "bounty_amount": 31000.0, "reward_amount_meta": 31000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-10-20T19:10:08+00:00", "year": 2023, "attachment_count": 5, "local_path": "issues/40075342", "has_markdown": true }, { "id": "40936633", "title": "Security: Heap-use-after-free in ReadAnythingUntrustedPageHandler::LogTextStyle", "url": "https://issues.chromium.org/issues/40936633", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>TopChrome>SidePanel", "reporter": "me...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-10-17T15:57:26+00:00", "year": 2023, "attachment_count": 3, "local_path": "issues/40936633", "has_markdown": true }, { "id": "40075024", "title": "Security: Popup window tab doesn't show the origin elided from the right", "url": "https://issues.chromium.org/issues/40075024", "status": "Accepted", "severity": "S3-Low", "component": "UI>Browser>TopChrome>TabStrip>HoverCards", "reporter": "ch...@gmail.com", "cve_ids": [], "bounty_amount": 500.0, "reward_amount_meta": 500.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-10-17T02:10:35+00:00", "year": 2023, "attachment_count": 1, "local_path": "issues/40075024", "has_markdown": true }, { "id": "40074918", "title": "Security: Bypass the Protection of input fields cache (Autofill) Similar to (1358647 ,1395164 ,1108181) with Different Vector", "url": "https://issues.chromium.org/issues/40074918", "status": "Accepted", "severity": "S3-Low", "component": "UI>Browser>Autofill", "reporter": "el...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-10-14T22:21:20+00:00", "year": 2023, "attachment_count": 7, "local_path": "issues/40074918", "has_markdown": true }, { "id": "40074906", "title": "Security: No Origin For PresentAPI", "url": "https://issues.chromium.org/issues/40074906", "status": "Verified", "severity": "S3-Low", "component": "Internals>Cast>UI", "reporter": "ia...@gmail.com", "cve_ids": [], "bounty_amount": 500.0, "reward_amount_meta": 500.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-10-14T09:17:53+00:00", "year": 2023, "attachment_count": 3, "local_path": "issues/40074906", "has_markdown": true }, { "id": "40936265", "title": "Security: Persistent XSS via malicious user-uploaded PaymentRequest manifest and service worker", "url": "https://issues.chromium.org/issues/40936265", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Payments", "reporter": "se...@gmail.com", "cve_ids": [], "bounty_amount": 16000.0, "reward_amount_meta": 16000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-10-14T08:17:28+00:00", "year": 2023, "attachment_count": 7, "local_path": "issues/40936265", "has_markdown": true }, { "id": "40074800", "title": "Security: opens a new window at the same time as the previous window in fullscreen mode, (the window enters fullscreen mode which is closed by another new window) leads to spoof", "url": "https://issues.chromium.org/issues/40074800", "status": "Accepted", "severity": "S3-Low", "component": "Blink>Fullscreen", "reporter": "sa...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-10-13T07:44:09+00:00", "year": 2023, "attachment_count": 5, "local_path": "issues/40074800", "has_markdown": true }, { "id": "40936128", "title": "Security: readanything render frame UAF fix of crbug.com/1488268 is not robust.", "url": "https://issues.chromium.org/issues/40936128", "status": "Assigned", "severity": "S4-Minimal", "component": "UI>Accessibility>ReadingMode", "reporter": "zh...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-10-13T07:42:25+00:00", "year": 2023, "attachment_count": 3, "local_path": "issues/40936128", "has_markdown": true }, { "id": "40074795", "title": "Uaf in EmbeddedPermissionPrompt::~EmbeddedPermissionPrompt And defects in raw_ptr with ASAN", "url": "https://issues.chromium.org/issues/40074795", "status": "Accepted", "severity": "S3-Low", "component": "UI>Browser>Permissions>Prompts", "reporter": "me...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-10-13T06:37:27+00:00", "year": 2023, "attachment_count": 6, "local_path": "issues/40074795", "has_markdown": true }, { "id": "40074794", "title": "Security: UAF in UsbDeviceHandleMac::AsyncIoCallback", "url": "https://issues.chromium.org/issues/40074794", "status": "Assigned", "severity": "S3-Low", "component": "IO>USB", "reporter": "vu...@darknavy.com", "cve_ids": [], "bounty_amount": 8000.0, "reward_amount_meta": 8000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-10-13T06:33:12+00:00", "year": 2023, "attachment_count": 3, "local_path": "issues/40074794", "has_markdown": true }, { "id": "40074792", "title": "Security: Out of bounds access in UsbDeviceHandleUsbfs::IsochronousTransferInternal", "url": "https://issues.chromium.org/issues/40074792", "status": "Assigned", "severity": "S3-Low", "component": "IO>USB", "reporter": "vu...@darknavy.com", "cve_ids": [], "bounty_amount": 11000.0, "reward_amount_meta": 11000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-10-13T06:29:33+00:00", "year": 2023, "attachment_count": 2, "local_path": "issues/40074792", "has_markdown": true }, { "id": "40074630", "title": "Security: Google Chrome MetalCompiler OOB Access Vulnerability", "url": "https://issues.chromium.org/issues/40074630", "status": "Assigned", "severity": "S3-Low", "component": "Blink>WebGL, Internals>GPU, Internals>GPU>ANGLE", "reporter": "pw...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-10-11T14:43:45+00:00", "year": 2023, "attachment_count": 1, "local_path": "issues/40074630", "has_markdown": true }, { "id": "40935719", "title": "Security: heap-use-after-free on BrandcodeConfigFetcher::OnSimpleLoaderComplete", "url": "https://issues.chromium.org/issues/40935719", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>Profiles", "reporter": "18...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-10-10T04:02:12+00:00", "year": 2023, "attachment_count": 4, "local_path": "issues/40935719", "has_markdown": true }, { "id": "40074483", "title": "Security: Inappropriate implementation in Fullscreen API", "url": "https://issues.chromium.org/issues/40074483", "status": "Accepted", "severity": "S3-Low", "component": "UI>Browser>FullScreen, UI>Browser>Mobile>EdgeToEdge", "reporter": "ch...@gmail.com", "cve_ids": [], "bounty_amount": 500.0, "reward_amount_meta": 500.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-10-10T02:08:13+00:00", "year": 2023, "attachment_count": 1, "local_path": "issues/40074483", "has_markdown": true }, { "id": "40074376", "title": "Security: XSS in contenteditable elements via svg>use xlink:href ", "url": "https://issues.chromium.org/issues/40074376", "status": "Accepted", "severity": "S3-Low", "component": "Blink>DataTransfer, Blink>Editing>Paste, Blink>SecurityFeature>SanitizerAPI", "reporter": "su...@gmail.com", "cve_ids": [], "bounty_amount": 500.0, "reward_amount_meta": 500.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-10-07T16:26:52+00:00", "year": 2023, "attachment_count": 8, "local_path": "issues/40074376", "has_markdown": true }, { "id": "40074299", "title": "Security: Bypassing Chrome's File URI Restrictions with View-Source in Extensions", "url": "https://issues.chromium.org/issues/40074299", "status": "Accepted", "severity": "Unknown", "component": "Platform>Extensions", "reporter": "nd...@protonmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-10-06T17:42:35+00:00", "year": 2023, "attachment_count": 5, "local_path": "issues/40074299", "has_markdown": true }, { "id": "40074269", "title": "Security: Extension has access to a custom NTP", "url": "https://issues.chromium.org/issues/40074269", "status": "Accepted", "severity": "S3-Low", "component": "Platform>Extensions", "reporter": "fa...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-10-06T11:58:46+00:00", "year": 2023, "attachment_count": 9, "local_path": "issues/40074269", "has_markdown": true }, { "id": "40073848", "title": "ArrayBuffer OOR/W in glBufferData_Exec", "url": "https://issues.chromium.org/issues/40073848", "status": "Assigned", "severity": "S3-Low", "component": "Internals>GPU>ANGLE", "reporter": "no...@ssd-disclosure.com", "cve_ids": [], "bounty_amount": 10000.0, "reward_amount_meta": 10000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-10-01T10:32:00+00:00", "year": 2023, "attachment_count": 5, "local_path": "issues/40073848", "has_markdown": true }, { "id": "40073847", "title": "Chrome's Reading Mode UAF", "url": "https://issues.chromium.org/issues/40073847", "status": "Assigned", "severity": "S4-Minimal", "component": "UI>Accessibility", "reporter": "no...@ssd-disclosure.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-10-01T10:29:11+00:00", "year": 2023, "attachment_count": 3, "local_path": "issues/40073847", "has_markdown": true }, { "id": "40934491", "title": "Chrome's Profile Picker UAF", "url": "https://issues.chromium.org/issues/40934491", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>Profiles", "reporter": "no...@ssd-disclosure.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-10-01T10:26:34+00:00", "year": 2023, "attachment_count": 2, "local_path": "issues/40934491", "has_markdown": true }, { "id": "40073846", "title": "Crash in v8::internal::EvacuationVerifier::VerifyEvacuation", "url": "https://issues.chromium.org/issues/40073846", "status": "Assigned", "severity": "S4-Minimal", "component": "Blink>JavaScript>GarbageCollection", "reporter": "m....@gmail.com", "cve_ids": [], "bounty_amount": 9000.0, "reward_amount_meta": 9000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-10-01T08:55:42+00:00", "year": 2023, "attachment_count": 0, "local_path": "issues/40073846", "has_markdown": true }, { "id": "40073817", "title": "Security: Download started notification can suppressed \"exit full screen\" notification lead to spoof", "url": "https://issues.chromium.org/issues/40073817", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Fullscreen, UI>Browser>Downloads, UI>Browser>FullScreen", "reporter": "sa...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-09-30T03:53:10+00:00", "year": 2023, "attachment_count": 4, "local_path": "issues/40073817", "has_markdown": true }, { "id": "40073792", "title": "UAF in vk::Buffer::getOffsetPointer", "url": "https://issues.chromium.org/issues/40073792", "status": "Assigned", "severity": "S3-Low", "component": "Internals>GPU>SwiftShader", "reporter": "em...@gmail.com", "cve_ids": [], "bounty_amount": 11000.0, "reward_amount_meta": 11000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-09-29T19:08:33+00:00", "year": 2023, "attachment_count": 2, "local_path": "issues/40073792", "has_markdown": true }, { "id": "40073755", "title": "Security: heap after free at `RenderFrameHostManager::GetFrameHostForNavigation`", "url": "https://issues.chromium.org/issues/40073755", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>Navigation", "reporter": "18...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-09-29T13:02:23+00:00", "year": 2023, "attachment_count": 8, "local_path": "issues/40073755", "has_markdown": true }, { "id": "40073505", "title": "Security: heap-use-after-free on RenderFrameHostImpl::Init", "url": "https://issues.chromium.org/issues/40073505", "status": "New", "severity": "S3-Low", "component": "Internals>Sandbox>SiteIsolation, Platform>Apps>BrowserTag", "reporter": "18...@gmail.com", "cve_ids": [], "bounty_amount": 28000.0, "reward_amount_meta": 28000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-09-27T09:02:12+00:00", "year": 2023, "attachment_count": 2, "local_path": "issues/40073505", "has_markdown": true }, { "id": "40073339", "title": "Security: Debug check failed: output_instr_index_ == definition_block->last_instruction_index() in v8/src/compiler/backend/mid-tier-register-allocator.cc:583", "url": "https://issues.chromium.org/issues/40073339", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript>Compiler>Turbofan, Blink>JavaScript>WebAssembly", "reporter": "al...@goodmanemail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-09-25T16:29:10+00:00", "year": 2023, "attachment_count": 2, "local_path": "issues/40073339", "has_markdown": true }, { "id": "40073299", "title": "potentional UAF ", "url": "https://issues.chromium.org/issues/40073299", "status": "Assigned", "severity": "S3-Low", "component": "Internals>Network>Logging", "reporter": "li...@gmail.com", "cve_ids": [], "bounty_amount": null, "reward_amount_meta": 0.0, "public_issue": true, "inclusion_reason": "award_text", "award_text_found": true, "created_date": "2023-09-25T10:36:35+00:00", "year": 2023, "attachment_count": 0, "local_path": "issues/40073299", "has_markdown": true }, { "id": "40073262", "title": "Security: Race Condition UAF in virtio_transport_space_update", "url": "https://issues.chromium.org/issues/40073262", "status": "Assigned", "severity": "S3-Low", "component": "Unknown", "reporter": "da...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-09-24T15:46:45+00:00", "year": 2023, "attachment_count": 2, "local_path": "issues/40073262", "has_markdown": true }, { "id": "40072988", "title": "Security: Android: URL spoofing in address bar if scheme is later in URL", "url": "https://issues.chromium.org/issues/40072988", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>Omnibox", "reporter": "al...@alesandroortiz.com", "cve_ids": [], "bounty_amount": 8500.0, "reward_amount_meta": 8500.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-09-21T07:35:22+00:00", "year": 2023, "attachment_count": 4, "local_path": "issues/40072988", "has_markdown": true }, { "id": "40072724", "title": "GPU failure in blink::AXObject::RepairMissingParent", "url": "https://issues.chromium.org/issues/40072724", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Accessibility", "reporter": "cl...@chromium.org", "cve_ids": [], "bounty_amount": 9000.0, "reward_amount_meta": 9000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-09-19T01:09:39+00:00", "year": 2023, "attachment_count": 0, "local_path": "issues/40072724", "has_markdown": true }, { "id": "40072664", "title": "Security: UAF in cast_channel::CastSocketServiceImpl::OpenSocket", "url": "https://issues.chromium.org/issues/40072664", "status": "Assigned", "severity": "S3-Low", "component": "Internals>Cast", "reporter": "vu...@darknavy.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-09-18T09:35:47+00:00", "year": 2023, "attachment_count": 1, "local_path": "issues/40072664", "has_markdown": true }, { "id": "40072662", "title": "Security: arbitrary address access in vrend_renderer_blit_gl", "url": "https://issues.chromium.org/issues/40072662", "status": "Assigned", "severity": "S3-Low", "component": "Unknown", "reporter": "da...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-09-18T08:53:19+00:00", "year": 2023, "attachment_count": 1, "local_path": "issues/40072662", "has_markdown": true }, { "id": "40072651", "title": "Security: UAF in base::win::MessageWindow::WindowProc", "url": "https://issues.chromium.org/issues/40072651", "status": "Assigned", "severity": "S3-Low", "component": "Internals>PlatformIntegration", "reporter": "ki...@gmail.com", "cve_ids": [], "bounty_amount": 4000.0, "reward_amount_meta": 4000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-09-18T01:43:49+00:00", "year": 2023, "attachment_count": 3, "local_path": "issues/40072651", "has_markdown": true }, { "id": "40072461", "title": "Security: heap-use-after-free on vrend_renderer_get_meminfo", "url": "https://issues.chromium.org/issues/40072461", "status": "Assigned", "severity": "S3-Low", "component": "Unknown", "reporter": "ph...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-09-15T15:59:07+00:00", "year": 2023, "attachment_count": 2, "local_path": "issues/40072461", "has_markdown": true }, { "id": "40072430", "title": "Security: Container-Overflow in chrome_pdf::PDFiumRange::GetScreenRects", "url": "https://issues.chromium.org/issues/40072430", "status": "Assigned", "severity": "S3-Low", "component": "Internals>Plugins>PDF", "reporter": "pw...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-09-15T08:52:50+00:00", "year": 2023, "attachment_count": 2, "local_path": "issues/40072430", "has_markdown": true }, { "id": "40072334", "title": "Security: SOP bypass: Portal activation bypasses same-page drag and drop source check", "url": "https://issues.chromium.org/issues/40072334", "status": "Accepted", "severity": "S3-Low", "component": "Blink>DataTransfer, Blink>Portals", "reporter": "st...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-09-14T15:25:15+00:00", "year": 2023, "attachment_count": 4, "local_path": "issues/40072334", "has_markdown": true }, { "id": "40072287", "title": "Security: Fatal error in ../../src/ast/ast.h, line 1477", "url": "https://issues.chromium.org/issues/40072287", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript>Compiler, Blink>JavaScript>Interpreter, Blink>JavaScript>Parser", "reporter": "be...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-09-14T08:50:10+00:00", "year": 2023, "attachment_count": 1, "local_path": "issues/40072287", "has_markdown": true }, { "id": "40072274", "title": "Bypass PaymentRequest.show() calls after the first.", "url": "https://issues.chromium.org/issues/40072274", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Payments", "reporter": "nd...@protonmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-09-14T04:13:54+00:00", "year": 2023, "attachment_count": 7, "local_path": "issues/40072274", "has_markdown": true }, { "id": "40072134", "title": "URL Spoofing in Document PiP; related to issue 1450376; regression?", "url": "https://issues.chromium.org/issues/40072134", "status": "Accepted", "severity": "S3-Low", "component": "Blink>Media>PictureInPicture", "reporter": "js...@gmail.com", "cve_ids": [], "bounty_amount": 500.0, "reward_amount_meta": 500.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-09-13T05:34:06+00:00", "year": 2023, "attachment_count": 3, "local_path": "issues/40072134", "has_markdown": true }, { "id": "40071901", "title": "UAF in AutocompleteController::Observer", "url": "https://issues.chromium.org/issues/40071901", "status": "Assigned", "severity": "S4-Minimal", "component": "UI>Browser>Omnibox", "reporter": "he...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-09-11T04:17:26+00:00", "year": 2023, "attachment_count": 7, "local_path": "issues/40071901", "has_markdown": true }, { "id": "40930463", "title": "Security: Use-After-Free in chrome_pdf::PdfViewWebPlugin::PrintEnd", "url": "https://issues.chromium.org/issues/40930463", "status": "Assigned", "severity": "S3-Low", "component": "Internals>Printing", "reporter": "pw...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-09-10T13:22:02+00:00", "year": 2023, "attachment_count": 3, "local_path": "issues/40930463", "has_markdown": true }, { "id": "40071686", "title": "Security: Use-After-Free in WebContentsFrameTracker::OnPossibleTargetChange", "url": "https://issues.chromium.org/issues/40071686", "status": "Assigned", "severity": "S3-Low", "component": "Internals>Media>SurfaceCapture", "reporter": "pw...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-09-07T22:36:06+00:00", "year": 2023, "attachment_count": 1, "local_path": "issues/40071686", "has_markdown": true }, { "id": "40071635", "title": "Security: manipulating the cvs data ", "url": "https://issues.chromium.org/issues/40071635", "status": "Accepted", "severity": "S3-Low", "component": "Tools", "reporter": "an...@gmail.com", "cve_ids": [], "bounty_amount": 500.0, "reward_amount_meta": 500.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-09-07T15:58:29+00:00", "year": 2023, "attachment_count": 0, "local_path": "issues/40071635", "has_markdown": true }, { "id": "40071416", "title": "Security vulnerability in WebP", "url": "https://issues.chromium.org/issues/40071416", "status": "New", "severity": "S3-Low", "component": "Internals>Images>Codecs", "reporter": "mk...@chromium.org", "cve_ids": [], "bounty_amount": 10000.0, "reward_amount_meta": 10000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-09-06T05:29:02+00:00", "year": 2023, "attachment_count": 4, "local_path": "issues/40071416", "has_markdown": true }, { "id": "40071366", "title": "Security: heap-buffer-overflow vrend_read_from_iovec", "url": "https://issues.chromium.org/issues/40071366", "status": "Assigned", "severity": "S3-Low", "component": "Unknown", "reporter": "ph...@gmail.com", "cve_ids": [], "bounty_amount": 250.0, "reward_amount_meta": 250.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-09-05T12:29:39+00:00", "year": 2023, "attachment_count": 1, "local_path": "issues/40071366", "has_markdown": true }, { "id": "40071324", "title": "Security: Use-After-Free in PasswordManagerPorter::FileSelectionCanceled", "url": "https://issues.chromium.org/issues/40071324", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>Passwords", "reporter": "pw...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-09-05T03:02:43+00:00", "year": 2023, "attachment_count": 2, "local_path": "issues/40071324", "has_markdown": true }, { "id": "40071255", "title": "Security: Bypass the Protection of input fields cache (Autofill) due to inappropriate code design (Bypass 1472404),Similar to(1449874)", "url": "https://issues.chromium.org/issues/40071255", "status": "Accepted", "severity": "S4-Minimal", "component": "UI>Browser>Autofill", "reporter": "el...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-09-03T20:48:16+00:00", "year": 2023, "attachment_count": 8, "local_path": "issues/40071255", "has_markdown": true }, { "id": "40071209", "title": "Security: heap-buffer-overflow vrend_write_to_iovec", "url": "https://issues.chromium.org/issues/40071209", "status": "Assigned", "severity": "S3-Low", "component": "Unknown", "reporter": "ph...@gmail.com", "cve_ids": [], "bounty_amount": 250.0, "reward_amount_meta": 250.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-09-02T07:50:55+00:00", "year": 2023, "attachment_count": 1, "local_path": "issues/40071209", "has_markdown": true }, { "id": "40071202", "title": "Security: heap-use-after-free in vrend_destroy_surface", "url": "https://issues.chromium.org/issues/40071202", "status": "Assigned", "severity": "S3-Low", "component": "Unknown", "reporter": "fi...@gmail.com", "cve_ids": [], "bounty_amount": 4000.0, "reward_amount_meta": 4000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-09-02T04:33:16+00:00", "year": 2023, "attachment_count": 2, "local_path": "issues/40071202", "has_markdown": true }, { "id": "40071201", "title": "Security: heap-use-after-free in vrend_destroy_so_target", "url": "https://issues.chromium.org/issues/40071201", "status": "Assigned", "severity": "S3-Low", "component": "Unknown", "reporter": "fi...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-09-02T04:32:23+00:00", "year": 2023, "attachment_count": 2, "local_path": "issues/40071201", "has_markdown": true }, { "id": "40071200", "title": "Security: heap-use-after-free in vrend_destroy_sampler_view", "url": "https://issues.chromium.org/issues/40071200", "status": "Assigned", "severity": "S3-Low", "component": "Unknown", "reporter": "fi...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-09-02T04:31:00+00:00", "year": 2023, "attachment_count": 2, "local_path": "issues/40071200", "has_markdown": true }, { "id": "40071186", "title": "Security: Pdfium heap-buffer-overflow in downsample_3_2()", "url": "https://issues.chromium.org/issues/40071186", "status": "Assigned", "severity": "S3-Low", "component": "Internals>Plugins>PDF", "reporter": "d1...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-09-01T21:28:23+00:00", "year": 2023, "attachment_count": 1, "local_path": "issues/40071186", "has_markdown": true }, { "id": "40071155", "title": "UAF in v8_inspector DomainDispatcherImpl", "url": "https://issues.chromium.org/issues/40071155", "status": "Assigned", "severity": "S3-Low", "component": "Platform>DevTools>Extensions", "reporter": "he...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-09-01T16:25:22+00:00", "year": 2023, "attachment_count": 5, "local_path": "issues/40071155", "has_markdown": true }, { "id": "40071138", "title": "Security: Cookie leaking from the request object in chrome.devtools.network in onRequestFinished event", "url": "https://issues.chromium.org/issues/40071138", "status": "Assigned", "severity": "S3-Low", "component": "Platform>Extensions>API", "reporter": "ha...@gmail.com", "cve_ids": [], "bounty_amount": 500.0, "reward_amount_meta": 500.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-09-01T11:55:43+00:00", "year": 2023, "attachment_count": 4, "local_path": "issues/40071138", "has_markdown": true }, { "id": "40071126", "title": "Security: UAF in: gpu::raster::RasterDecoderImpl::Initialize", "url": "https://issues.chromium.org/issues/40071126", "status": "Assigned", "severity": "S3-Low", "component": "Internals>Compositing>OOP-Raster", "reporter": "zh...@gmail.com", "cve_ids": [], "bounty_amount": 15000.0, "reward_amount_meta": 15000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-09-01T10:00:16+00:00", "year": 2023, "attachment_count": 4, "local_path": "issues/40071126", "has_markdown": true }, { "id": "40071026", "title": "Security: Trick user into thinking they have escaped fullscreen on MacOS", "url": "https://issues.chromium.org/issues/40071026", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>FullScreen, UI>Browser>Permissions>Prompts", "reporter": "ha...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-08-31T10:56:13+00:00", "year": 2023, "attachment_count": 4, "local_path": "issues/40071026", "has_markdown": true }, { "id": "40070964", "title": "Security: https://bugs.chromium.org/p/chromium/issues/detail?id=1259694 can be reproduced", "url": "https://issues.chromium.org/issues/40070964", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Contacts", "reporter": "du...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-08-30T15:10:38+00:00", "year": 2023, "attachment_count": 1, "local_path": "issues/40070964", "has_markdown": true }, { "id": "40070902", "title": "heap-use-after-free in ReadAnythingAppController::OnActiveAXTreeIDChanged(ui::AXTreeID const&, long long, GURL const&)", "url": "https://issues.chromium.org/issues/40070902", "status": "Assigned", "severity": "S4-Minimal", "component": "UI>Accessibility>ReadingMode, UI>Browser>TopChrome>SidePanel", "reporter": "zy...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-08-30T07:23:45+00:00", "year": 2023, "attachment_count": 4, "local_path": "issues/40070902", "has_markdown": true }, { "id": "40070873", "title": "Security: Bypassing of security interstitials using devtools API", "url": "https://issues.chromium.org/issues/40070873", "status": "Assigned", "severity": "S3-Low", "component": "Platform>DevTools>Extensions", "reporter": "ha...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-08-29T18:47:45+00:00", "year": 2023, "attachment_count": 4, "local_path": "issues/40070873", "has_markdown": true }, { "id": "40070732", "title": "Security: V8: Fatal error in ../../src/objects/property-array-inl.h", "url": "https://issues.chromium.org/issues/40070732", "status": "Assigned", "severity": "S4-Minimal", "component": "Blink>JavaScript>Runtime", "reporter": "sw...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-08-28T01:18:40+00:00", "year": 2023, "attachment_count": 1, "local_path": "issues/40070732", "has_markdown": true }, { "id": "40070513", "title": "Security: heap-use-after-free in mojo::StringDataSource::Read", "url": "https://issues.chromium.org/issues/40070513", "status": "Assigned", "severity": "S3-Low", "component": "Platform>Extensions", "reporter": "st...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-08-24T21:29:10+00:00", "year": 2023, "attachment_count": 4, "local_path": "issues/40070513", "has_markdown": true }, { "id": "40070322", "title": "Security: DoS due to check missing", "url": "https://issues.chromium.org/issues/40070322", "status": "Accepted", "severity": "S3-Low", "component": "Unknown", "reporter": "bu...@gmail.com", "cve_ids": [], "bounty_amount": 500.0, "reward_amount_meta": 500.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-08-23T12:02:26+00:00", "year": 2023, "attachment_count": 1, "local_path": "issues/40070322", "has_markdown": true }, { "id": "40070305", "title": "UAF in blink::IDBFactoryClient::DeleteSuccess", "url": "https://issues.chromium.org/issues/40070305", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Storage>IndexedDB", "reporter": "em...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-08-23T10:24:40+00:00", "year": 2023, "attachment_count": 3, "local_path": "issues/40070305", "has_markdown": true }, { "id": "40070140", "title": "security: libmbim | heap-buffer-overflow on mbim-message.c", "url": "https://issues.chromium.org/issues/40070140", "status": "Accepted", "severity": "S3-Low", "component": "Unknown", "reporter": "rh...@gmail.com", "cve_ids": [], "bounty_amount": 750.0, "reward_amount_meta": 750.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-08-21T18:44:26+00:00", "year": 2023, "attachment_count": 0, "local_path": "issues/40070140", "has_markdown": true }, { "id": "40070139", "title": "security: libmbim | out-of-bounds access on mbim-message.c", "url": "https://issues.chromium.org/issues/40070139", "status": "Assigned", "severity": "S3-Low", "component": "Unknown", "reporter": "rh...@gmail.com", "cve_ids": [], "bounty_amount": 250.0, "reward_amount_meta": 250.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-08-21T18:42:20+00:00", "year": 2023, "attachment_count": 0, "local_path": "issues/40070139", "has_markdown": true }, { "id": "40070117", "title": "Security: Out-of-Bound Write due to bound check missing", "url": "https://issues.chromium.org/issues/40070117", "status": "Assigned", "severity": "S3-Low", "component": "Unknown", "reporter": "bu...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-08-21T14:45:19+00:00", "year": 2023, "attachment_count": 4, "local_path": "issues/40070117", "has_markdown": true }, { "id": "40070055", "title": "Security: V8 SEGV_ACCERR 02b6beadbef2", "url": "https://issues.chromium.org/issues/40070055", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript, Blink>JavaScript>GarbageCollection", "reporter": "dd...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-08-21T01:22:12+00:00", "year": 2023, "attachment_count": 2, "local_path": "issues/40070055", "has_markdown": true }, { "id": "40070041", "title": "Security: UAF in UnblockPendingSubframeNavigationRequestsIfNeeded", "url": "https://issues.chromium.org/issues/40070041", "status": "Assigned", "severity": "S3-Low", "component": "Blink>History", "reporter": "yq...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-08-20T15:13:35+00:00", "year": 2023, "attachment_count": 0, "local_path": "issues/40070041", "has_markdown": true }, { "id": "40070037", "title": "Security: OOB read in TGSI_OPCODE_EMIT", "url": "https://issues.chromium.org/issues/40070037", "status": "Assigned", "severity": "S3-Low", "component": "Unknown", "reporter": "ph...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-08-20T11:24:54+00:00", "year": 2023, "attachment_count": 1, "local_path": "issues/40070037", "has_markdown": true }, { "id": "40069958", "title": "use-after-poison in blink::CollectChildrenAndRemoveFromOldParent", "url": "https://issues.chromium.org/issues/40069958", "status": "Accepted", "severity": "S3-Low", "component": "Blink>DOM", "reporter": "em...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-08-18T16:18:51+00:00", "year": 2023, "attachment_count": 2, "local_path": "issues/40069958", "has_markdown": true }, { "id": "40927191", "title": "Security: Chrome Download UI Clickjacking", "url": "https://issues.chromium.org/issues/40927191", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>Bubbles>Download", "reporter": "fa...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-08-18T14:15:54+00:00", "year": 2023, "attachment_count": 2, "local_path": "issues/40927191", "has_markdown": true }, { "id": "40069946", "title": "Security: Heap buffer overflow write due to bound check missing", "url": "https://issues.chromium.org/issues/40069946", "status": "Assigned", "severity": "S3-Low", "component": "Unknown", "reporter": "bu...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-08-18T14:13:54+00:00", "year": 2023, "attachment_count": 4, "local_path": "issues/40069946", "has_markdown": true }, { "id": "40069798", "title": "Security: CSA_DCHECK failed: Torque assert 'Is(o)' failed", "url": "https://issues.chromium.org/issues/40069798", "status": "Assigned", "severity": "S4-Minimal", "component": "Blink>JavaScript, Blink>JavaScript>Runtime", "reporter": "ki...@gmail.com", "cve_ids": [], "bounty_amount": 16000.0, "reward_amount_meta": 16000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-08-17T13:26:55+00:00", "year": 2023, "attachment_count": 6, "local_path": "issues/40069798", "has_markdown": true }, { "id": "40069646", "title": "Security: UAP in IDBFactory::DidAllowIndexedDB", "url": "https://issues.chromium.org/issues/40069646", "status": "Accepted", "severity": "S3-Low", "component": "Blink>Storage>IndexedDB", "reporter": "ki...@gmail.com", "cve_ids": [], "bounty_amount": 8000.0, "reward_amount_meta": 8000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-08-16T02:23:42+00:00", "year": 2023, "attachment_count": 7, "local_path": "issues/40069646", "has_markdown": true }, { "id": "40069622", "title": "Iframe sandbox allow-popups-to-escape-sandbox bypass", "url": "https://issues.chromium.org/issues/40069622", "status": "Accepted", "severity": "S3-Low", "component": "Blink>SecurityFeature>IFrameSandbox", "reporter": "nd...@protonmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-08-15T16:59:26+00:00", "year": 2023, "attachment_count": 4, "local_path": "issues/40069622", "has_markdown": true }, { "id": "40069603", "title": "Security: Heap buffer overflow", "url": "https://issues.chromium.org/issues/40069603", "status": "Assigned", "severity": "S3-Low", "component": "Unknown", "reporter": "bu...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-08-15T12:47:24+00:00", "year": 2023, "attachment_count": 3, "local_path": "issues/40069603", "has_markdown": true }, { "id": "40069590", "title": "Security: Experimental features : ASAN error : GetNamedPropertyHandler", "url": "https://issues.chromium.org/issues/40069590", "status": "Accepted", "severity": "S3-Low", "component": "Blink>JavaScript>Compiler>Turbofan", "reporter": "sw...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-08-15T09:01:34+00:00", "year": 2023, "attachment_count": 0, "local_path": "issues/40069590", "has_markdown": true }, { "id": "40069581", "title": "Security: heap-use-after-free in vkr_ring_start", "url": "https://issues.chromium.org/issues/40069581", "status": "Assigned", "severity": "S3-Low", "component": "Unknown", "reporter": "fi...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-08-15T05:12:41+00:00", "year": 2023, "attachment_count": 2, "local_path": "issues/40069581", "has_markdown": true }, { "id": "40069571", "title": "chrome.inspectedWindow.eval execution on Web Store with trailing URL dot", "url": "https://issues.chromium.org/issues/40069571", "status": "Accepted", "severity": "S3-Low", "component": "Platform>Extensions>API", "reporter": "ma...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-08-14T23:15:53+00:00", "year": 2023, "attachment_count": 7, "local_path": "issues/40069571", "has_markdown": true }, { "id": "40069462", "title": "Security: Heap buffer overflow due to Integer Overflow", "url": "https://issues.chromium.org/issues/40069462", "status": "Assigned", "severity": "S3-Low", "component": "Unknown", "reporter": "bu...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-08-13T13:42:56+00:00", "year": 2023, "attachment_count": 8, "local_path": "issues/40069462", "has_markdown": true }, { "id": "40069458", "title": " Inadequate Registry management within the Chrome uninstaller resulting in privilege escalation", "url": "https://issues.chromium.org/issues/40069458", "status": "Accepted", "severity": "S3-Low", "component": "Internals>Installer", "reporter": "b....@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-08-13T10:36:07+00:00", "year": 2023, "attachment_count": 2, "local_path": "issues/40069458", "has_markdown": true }, { "id": "40069440", "title": "Use-After-Free in MediaStreamDeviceObserver::OnDeviceStopped", "url": "https://issues.chromium.org/issues/40069440", "status": "Assigned", "severity": "S3-Low", "component": "Blink>MediaStream", "reporter": "fw...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-08-12T06:23:33+00:00", "year": 2023, "attachment_count": 4, "local_path": "issues/40069440", "has_markdown": true }, { "id": "40069416", "title": "heap-buffer-overflow in StringForwardingTable::UpdateAfterFullEvacuation", "url": "https://issues.chromium.org/issues/40069416", "status": "Accepted", "severity": "S3-Low", "component": "Blink>JavaScript>GarbageCollection", "reporter": "em...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-08-11T18:47:18+00:00", "year": 2023, "attachment_count": 5, "local_path": "issues/40069416", "has_markdown": true }, { "id": "40069340", "title": "Security: UAF in SimpleHostResolverImpl::ResolveHost with chrome", "url": "https://issues.chromium.org/issues/40069340", "status": "Assigned", "severity": "S3-Low", "component": "Internals>Network, Internals>Services>Network", "reporter": "ki...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-08-11T01:45:55+00:00", "year": 2023, "attachment_count": 4, "local_path": "issues/40069340", "has_markdown": true }, { "id": "40069061", "title": "Security: Cookie for enterprise-policy blocked hosts leaking from the request object in chrome.devtools.network. ", "url": "https://issues.chromium.org/issues/40069061", "status": "Accepted", "severity": "S3-Low", "component": "Platform>Extensions>API", "reporter": "ha...@gmail.com", "cve_ids": [], "bounty_amount": 500.0, "reward_amount_meta": 500.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-08-08T20:30:43+00:00", "year": 2023, "attachment_count": 4, "local_path": "issues/40069061", "has_markdown": true }, { "id": "40069052", "title": "Security: virglrenderer | heap-buffer-overflow on vrend_set_constants", "url": "https://issues.chromium.org/issues/40069052", "status": "Assigned", "severity": "S3-Low", "component": "Unknown", "reporter": "rh...@gmail.com", "cve_ids": [], "bounty_amount": 4000.0, "reward_amount_meta": 4000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-08-08T16:24:09+00:00", "year": 2023, "attachment_count": 1, "local_path": "issues/40069052", "has_markdown": true }, { "id": "40926043", "title": "Security: Overflow in compareUTF32Strings()", "url": "https://issues.chromium.org/issues/40926043", "status": "Fixed", "severity": "S3-Low", "component": "Mobile>iOSWeb", "reporter": "pe...@gmail.com", "cve_ids": [ "CVE-2023-42852" ], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-08-08T09:40:26+00:00", "year": 2023, "attachment_count": 1, "local_path": "issues/40926043", "has_markdown": true }, { "id": "40069005", "title": "UAF in webrtc::SctpDataChannel::UpdateState (WEBRTC)", "url": "https://issues.chromium.org/issues/40069005", "status": "Assigned", "severity": "S3-Low", "component": "Blink>WebRTC>DataChannel", "reporter": "em...@gmail.com", "cve_ids": [], "bounty_amount": 10000.0, "reward_amount_meta": 10000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-08-08T07:15:03+00:00", "year": 2023, "attachment_count": 6, "local_path": "issues/40069005", "has_markdown": true }, { "id": "40068966", "title": "Security: virglrenderer | heap-buffer-overflow on vrend_decode_set_debug_mask", "url": "https://issues.chromium.org/issues/40068966", "status": "Assigned", "severity": "S3-Low", "component": "Unknown", "reporter": "rh...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-08-07T17:31:50+00:00", "year": 2023, "attachment_count": 0, "local_path": "issues/40068966", "has_markdown": true }, { "id": "40068868", "title": "Security: UAF in It2MeNativeMessagingHostLacros::OnSupportSessionStarted", "url": "https://issues.chromium.org/issues/40068868", "status": "Assigned", "severity": "S3-Low", "component": "Unknown", "reporter": "zh...@gmail.com", "cve_ids": [], "bounty_amount": 11000.0, "reward_amount_meta": 11000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-08-06T15:15:14+00:00", "year": 2023, "attachment_count": 5, "local_path": "issues/40068868", "has_markdown": true }, { "id": "40068844", "title": "Security: stack-use-after-scope", "url": "https://issues.chromium.org/issues/40068844", "status": "Assigned", "severity": "S4-Minimal", "component": "Blink>CSS", "reporter": "f0...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-08-05T17:40:56+00:00", "year": 2023, "attachment_count": 2, "local_path": "issues/40068844", "has_markdown": true }, { "id": "40068825", "title": "Security: Debug check failed: HasBytecodeArray()", "url": "https://issues.chromium.org/issues/40068825", "status": "Accepted", "severity": "S3-Low", "component": "Blink>JavaScript>Runtime, Blink>JavaScript>WebAssembly", "reporter": "dd...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-08-05T04:18:42+00:00", "year": 2023, "attachment_count": 3, "local_path": "issues/40068825", "has_markdown": true }, { "id": "40068664", "title": "Security: Use After Free in NetworkStateNotifier", "url": "https://issues.chromium.org/issues/40068664", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Network, Platform", "reporter": "ka...@gmail.com", "cve_ids": [], "bounty_amount": 11000.0, "reward_amount_meta": 11000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-08-03T16:26:11+00:00", "year": 2023, "attachment_count": 2, "local_path": "issues/40068664", "has_markdown": true }, { "id": "40068612", "title": "Security: Type cast failed in v8", "url": "https://issues.chromium.org/issues/40068612", "status": "Assigned", "severity": "S4-Minimal", "component": "Blink>JavaScript, Blink>JavaScript>Runtime", "reporter": "ki...@gmail.com", "cve_ids": [], "bounty_amount": 8000.0, "reward_amount_meta": 8000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-08-03T08:55:40+00:00", "year": 2023, "attachment_count": 4, "local_path": "issues/40068612", "has_markdown": true }, { "id": "40068607", "title": "Security: Hide Fullscreen Notification ", "url": "https://issues.chromium.org/issues/40068607", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>FullScreen", "reporter": "pu...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-08-03T06:26:49+00:00", "year": 2023, "attachment_count": 4, "local_path": "issues/40068607", "has_markdown": true }, { "id": "40068602", "title": "Security: Heap-use-after-free in blink::ThrottlingURLLoader::OnReceiveResponse", "url": "https://issues.chromium.org/issues/40068602", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Loader, Platform>Extensions", "reporter": "m....@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-08-03T02:41:49+00:00", "year": 2023, "attachment_count": 3, "local_path": "issues/40068602", "has_markdown": true }, { "id": "40068570", "title": "Security: Bypass about:blank#blocked In Drag & Drop", "url": "https://issues.chromium.org/issues/40068570", "status": "Accepted", "severity": "S3-Low", "component": "Blink>DataTransfer, UI>Browser>Omnibox", "reporter": "pu...@gmail.com", "cve_ids": [], "bounty_amount": 500.0, "reward_amount_meta": 500.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-08-02T13:50:42+00:00", "year": 2023, "attachment_count": 6, "local_path": "issues/40068570", "has_markdown": true }, { "id": "40068543", "title": "UAF in rx::vk::DynamicDescriptorPool::destroyCachedDescriptorSet", "url": "https://issues.chromium.org/issues/40068543", "status": "Assigned", "severity": "S3-Low", "component": "Internals>GPU>Vulkan", "reporter": "em...@gmail.com", "cve_ids": [], "bounty_amount": 10000.0, "reward_amount_meta": 10000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-08-02T10:36:05+00:00", "year": 2023, "attachment_count": 2, "local_path": "issues/40068543", "has_markdown": true }, { "id": "40068394", "title": "Uaf in OmniboxPopupPresenter::WaitForHandler", "url": "https://issues.chromium.org/issues/40068394", "status": "Accepted", "severity": "S3-Low", "component": "UI>Browser>Omnibox", "reporter": "tt...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-07-31T06:43:47+00:00", "year": 2023, "attachment_count": 4, "local_path": "issues/40068394", "has_markdown": true }, { "id": "40068389", "title": "Security: stack-use-after-return in tint::wgsl::writer::ASTPrinter::EmitStructType", "url": "https://issues.chromium.org/issues/40068389", "status": "Fixed", "severity": "S3-Low", "component": "Dawn>Tint", "reporter": "st...@gmail.com", "cve_ids": [], "bounty_amount": 11000.0, "reward_amount_meta": 11000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-07-30T23:09:39+00:00", "year": 2023, "attachment_count": 1, "local_path": "issues/40068389", "has_markdown": true }, { "id": "40068379", "title": "Security: heap-use-after-free on ash/wm/overview/overview_item.cc", "url": "https://issues.chromium.org/issues/40068379", "status": "Assigned", "severity": "S3-Low", "component": "Unknown", "reporter": "rh...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-07-30T16:08:50+00:00", "year": 2023, "attachment_count": 2, "local_path": "issues/40068379", "has_markdown": true }, { "id": "40068268", "title": "Security: Debug check failed: page->area_size() >= static_cast(page->live_bytes())", "url": "https://issues.chromium.org/issues/40068268", "status": "Assigned", "severity": "S3-Low", "component": "Blink>GarbageCollection", "reporter": "dd...@gmail.com", "cve_ids": [], "bounty_amount": 10000.0, "reward_amount_meta": 10000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-07-28T06:46:21+00:00", "year": 2023, "attachment_count": 1, "local_path": "issues/40068268", "has_markdown": true }, { "id": "40068263", "title": "Security: heap-use-after-free in vkr_context_submit_fence", "url": "https://issues.chromium.org/issues/40068263", "status": "Assigned", "severity": "S3-Low", "component": "Unknown", "reporter": "fi...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-07-28T02:13:10+00:00", "year": 2023, "attachment_count": 2, "local_path": "issues/40068263", "has_markdown": true }, { "id": "40068144", "title": "Security: heap-use-after-free on ash/wm/desks/desks_controller.cc", "url": "https://issues.chromium.org/issues/40068144", "status": "Assigned", "severity": "S3-Low", "component": "Unknown", "reporter": "rh...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-07-26T19:01:51+00:00", "year": 2023, "attachment_count": 2, "local_path": "issues/40068144", "has_markdown": true }, { "id": "40068096", "title": "Security: chrome.devtools.inspectedWindow.eval can bypass enterprise-policy blocked hosts using subframes", "url": "https://issues.chromium.org/issues/40068096", "status": "Assigned", "severity": "S3-Low", "component": "Platform>Extensions>API", "reporter": "ha...@gmail.com", "cve_ids": [], "bounty_amount": 500.0, "reward_amount_meta": 500.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-07-26T06:54:29+00:00", "year": 2023, "attachment_count": 4, "local_path": "issues/40068096", "has_markdown": true }, { "id": "40068091", "title": "Security: chrome.devtools.inspectedWindow.getResources allows resources from enterprise policy-blocked hosts", "url": "https://issues.chromium.org/issues/40068091", "status": "Assigned", "severity": "S3-Low", "component": "Platform>Extensions>API", "reporter": "ha...@gmail.com", "cve_ids": [], "bounty_amount": 500.0, "reward_amount_meta": 500.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-07-26T06:23:47+00:00", "year": 2023, "attachment_count": 4, "local_path": "issues/40068091", "has_markdown": true }, { "id": "40068069", "title": "CCT Clipboard Content Sniffing - Task Hijacking", "url": "https://issues.chromium.org/issues/40068069", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>Mobile>CustomTabs", "reporter": "le...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-07-25T20:05:24+00:00", "year": 2023, "attachment_count": 7, "local_path": "issues/40068069", "has_markdown": true }, { "id": "40068001", "title": "Security: Bypass the Protection of input fields cache (Autofill) ,and Autofill popup can be made hidden", "url": "https://issues.chromium.org/issues/40068001", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>Autofill", "reporter": "el...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-07-24T21:41:51+00:00", "year": 2023, "attachment_count": 11, "local_path": "issues/40068001", "has_markdown": true }, { "id": "40067954", "title": "Security: Extension Has Access to File URL Despite Access is Disabled", "url": "https://issues.chromium.org/issues/40067954", "status": "Assigned", "severity": "S3-Low", "component": "Platform>Extensions", "reporter": "fa...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-07-24T07:31:31+00:00", "year": 2023, "attachment_count": 9, "local_path": "issues/40067954", "has_markdown": true }, { "id": "40067948", "title": "Security: Heap-use-after-free in GetAuthorizationRightsWithPrompt", "url": "https://issues.chromium.org/issues/40067948", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>Passwords", "reporter": "me...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-07-24T06:18:07+00:00", "year": 2023, "attachment_count": 5, "local_path": "issues/40067948", "has_markdown": true }, { "id": "40067943", "title": "Security: V8: Debug check failed: result_type.IsSubtypeOf(output_graph_types_[index]).", "url": "https://issues.chromium.org/issues/40067943", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript>Compiler>Turbofan", "reporter": "sw...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-07-24T02:35:17+00:00", "year": 2023, "attachment_count": 1, "local_path": "issues/40067943", "has_markdown": true }, { "id": "40067914", "title": "Security: [Esc] KeyPress Does Not Work in FullScreen While navigator.share Is Active", "url": "https://issues.chromium.org/issues/40067914", "status": "Assigned", "severity": "S3-Low", "component": "Blink>WebShare, UI>Browser>FullScreen", "reporter": "pu...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-07-22T09:30:23+00:00", "year": 2023, "attachment_count": 4, "local_path": "issues/40067914", "has_markdown": true }, { "id": "40067758", "title": "Security: Heap-use-after-free in HostResolverManager::Job::RunNextTask", "url": "https://issues.chromium.org/issues/40067758", "status": "Assigned", "severity": "S3-Low", "component": "Internals>Network>DNS", "reporter": "me...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-07-20T09:27:56+00:00", "year": 2023, "attachment_count": 6, "local_path": "issues/40067758", "has_markdown": true }, { "id": "40067712", "title": "Security: Memory corrupt in v8, leading to RCE", "url": "https://issues.chromium.org/issues/40067712", "status": "Assigned", "severity": "S4-Minimal", "component": "Blink>JavaScript>WebAssembly", "reporter": "je...@gmail.com", "cve_ids": [], "bounty_amount": 23000.0, "reward_amount_meta": 23000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-07-19T17:07:59+00:00", "year": 2023, "attachment_count": 16, "local_path": "issues/40067712", "has_markdown": true }, { "id": "40067612", "title": "Security: heap-use-after-free in network::NetworkContext::DestroyURLLoaderFactory", "url": "https://issues.chromium.org/issues/40067612", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Loader, Blink>SecurityFeature>CORS, Internals>Network", "reporter": "hi...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-07-18T12:30:37+00:00", "year": 2023, "attachment_count": 1, "local_path": "issues/40067612", "has_markdown": true }, { "id": "40067530", "title": "Security: Type confusion in VisitFindNonDefaultConstructorOrConstruct of Maglev", "url": "https://issues.chromium.org/issues/40067530", "status": "Assigned", "severity": "S4-Minimal", "component": "Blink>JavaScript>Compiler>Maglev", "reporter": "m-...@github.com", "cve_ids": [], "bounty_amount": 21000.0, "reward_amount_meta": 21000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-07-17T12:25:03+00:00", "year": 2023, "attachment_count": 3, "local_path": "issues/40067530", "has_markdown": true }, { "id": "40067522", "title": "Security: Heap-use-after-free in BrowsingTopicsServiceImpl::GetBrowsingTopicsStateForWebUi", "url": "https://issues.chromium.org/issues/40067522", "status": "Assigned", "severity": "S3-Low", "component": "Blink>TopicsAPI", "reporter": "me...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-07-17T09:20:40+00:00", "year": 2023, "attachment_count": 3, "local_path": "issues/40067522", "has_markdown": true }, { "id": "40067517", "title": "Initiator origin not propagated on cross-profile navigations", "url": "https://issues.chromium.org/issues/40067517", "status": "Verified", "severity": "S3-Low", "component": "Internals>Permissions", "reporter": "al...@gmail.com", "cve_ids": [], "bounty_amount": 500.0, "reward_amount_meta": 500.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-07-17T08:02:23+00:00", "year": 2023, "attachment_count": 5, "local_path": "issues/40067517", "has_markdown": true }, { "id": "40067505", "title": "[Autofill] Keyboard accessory, bottom sheet accept unintentional user input", "url": "https://issues.chromium.org/issues/40067505", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>Autofill", "reporter": "st...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-07-16T22:39:41+00:00", "year": 2023, "attachment_count": 4, "local_path": "issues/40067505", "has_markdown": true }, { "id": "40067499", "title": "XSS on Image Loader extension and chrome://resources, abusable by extensions to access private APIs", "url": "https://issues.chromium.org/issues/40067499", "status": "Assigned", "severity": "S3-Low", "component": "Unknown", "reporter": "ma...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-07-16T16:34:09+00:00", "year": 2023, "attachment_count": 6, "local_path": "issues/40067499", "has_markdown": true }, { "id": "40067496", "title": "Security: Memory corruption due to HeapVector iterator invalidation", "url": "https://issues.chromium.org/issues/40067496", "status": "Assigned", "severity": "S3-Low", "component": "Platform>DevTools", "reporter": "m....@gmail.com", "cve_ids": [], "bounty_amount": 4000.0, "reward_amount_meta": 4000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-07-16T13:57:32+00:00", "year": 2023, "attachment_count": 4, "local_path": "issues/40067496", "has_markdown": true }, { "id": "40067485", "title": "Security: Debug check failed: !s.InSharedHeap().", "url": "https://issues.chromium.org/issues/40067485", "status": "Assigned", "severity": "S4-Minimal", "component": "Blink>JavaScript>Compiler>Turbofan", "reporter": "wh...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-07-15T12:30:02+00:00", "year": 2023, "attachment_count": 0, "local_path": "issues/40067485", "has_markdown": true }, { "id": "40067456", "title": "Security: Desktop permission prompt tapjacking", "url": "https://issues.chromium.org/issues/40067456", "status": "Accepted", "severity": "S3-Low", "component": "Internals>Views", "reporter": "st...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-07-14T19:32:15+00:00", "year": 2023, "attachment_count": 3, "local_path": "issues/40067456", "has_markdown": true }, { "id": "40067406", "title": "Security: UaF in Mirroring", "url": "https://issues.chromium.org/issues/40067406", "status": "Accepted", "severity": "S3-Low", "component": "Internals>Cast>Streaming", "reporter": "av...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-07-14T00:29:07+00:00", "year": 2023, "attachment_count": 5, "local_path": "issues/40067406", "has_markdown": true }, { "id": "40067401", "title": "Security: PiP window can obscure sensitive UI: External protocol dialog", "url": "https://issues.chromium.org/issues/40067401", "status": "Accepted", "severity": "S3-Low", "component": "Blink>Media>PictureInPicture", "reporter": "al...@alesandroortiz.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-07-13T22:16:05+00:00", "year": 2023, "attachment_count": 10, "local_path": "issues/40067401", "has_markdown": true }, { "id": "40067380", "title": "Security: UAF in VisualSearchClassifierHost::StartClassificationWithModel", "url": "https://issues.chromium.org/issues/40067380", "status": "Accepted", "severity": "S4-Minimal", "component": "UI>Browser", "reporter": "zh...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-07-13T16:19:05+00:00", "year": 2023, "attachment_count": 3, "local_path": "issues/40067380", "has_markdown": true }, { "id": "40067329", "title": "XSS on chrome://file-manager, abusable by extensions", "url": "https://issues.chromium.org/issues/40067329", "status": "Assigned", "severity": "S3-Low", "component": "Internals>Sandbox>SiteIsolation, Platform>Extensions", "reporter": "ma...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-07-13T04:49:48+00:00", "year": 2023, "attachment_count": 7, "local_path": "issues/40067329", "has_markdown": true }, { "id": "40067327", "title": "UAF in gsm_cleanup_mux", "url": "https://issues.chromium.org/issues/40067327", "status": "Assigned", "severity": "S3-Low", "component": "Unknown", "reporter": "he...@gmail.com", "cve_ids": [], "bounty_amount": 1500.0, "reward_amount_meta": 1500.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-07-13T03:59:55+00:00", "year": 2023, "attachment_count": 3, "local_path": "issues/40067327", "has_markdown": true }, { "id": "40067324", "title": "Security: Chrome OS: bluez missed patch can cause remotely information leak in function cli_feat_read_cb", "url": "https://issues.chromium.org/issues/40067324", "status": "Assigned", "severity": "S3-Low", "component": "Unknown", "reporter": "pi...@gmail.com", "cve_ids": [], "bounty_amount": 500.0, "reward_amount_meta": 500.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-07-13T03:04:27+00:00", "year": 2023, "attachment_count": 0, "local_path": "issues/40067324", "has_markdown": true }, { "id": "40067259", "title": "Race Condition UAF in DRM_IOCTL_MODE_ATOMIC", "url": "https://issues.chromium.org/issues/40067259", "status": "Assigned", "severity": "S3-Low", "component": "Unknown", "reporter": "sh...@gmail.com", "cve_ids": [], "bounty_amount": 750.0, "reward_amount_meta": 750.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-07-12T04:42:55+00:00", "year": 2023, "attachment_count": 3, "local_path": "issues/40067259", "has_markdown": true }, { "id": "40067239", "title": "I'm reporting an incomplete fix for a prior report (1451211) and (1427865).", "url": "https://issues.chromium.org/issues/40067239", "status": "Assigned", "severity": "S3-Low", "component": "Blink>WebGL, Blink>WebGPU, Internals>GPU>ANGLE, Internals>GPU>SwiftShader", "reporter": "au...@gmail.com", "cve_ids": [], "bounty_amount": 15000.0, "reward_amount_meta": 15000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-07-11T20:11:40+00:00", "year": 2023, "attachment_count": 8, "local_path": "issues/40067239", "has_markdown": true }, { "id": "40067231", "title": "Extensions on lens.google.com can bypass host permissions and open chrome-untrusted:// URLs with side panel", "url": "https://issues.chromium.org/issues/40067231", "status": "Assigned", "severity": "S3-Low", "component": "Internals>Sandbox>SiteIsolation, Platform>Extensions, UI>Browser>TopChrome>SidePanel", "reporter": "ma...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-07-11T18:22:04+00:00", "year": 2023, "attachment_count": 9, "local_path": "issues/40067231", "has_markdown": true }, { "id": "40067213", "title": "Fullscreen Window is opened behind other windows", "url": "https://issues.chromium.org/issues/40067213", "status": "Assigned", "severity": "Unknown", "component": "Blink>Fullscreen, UI>Browser>FullScreen", "reporter": "pu...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-07-11T12:48:54+00:00", "year": 2023, "attachment_count": 6, "local_path": "issues/40067213", "has_markdown": true }, { "id": "40067195", "title": "Security: ChromeOS: Information leak due to type confusion in u32 classifier", "url": "https://issues.chromium.org/issues/40067195", "status": "Assigned", "severity": "S3-Low", "component": "Unknown", "reporter": "mg...@gmail.com", "cve_ids": [], "bounty_amount": 750.0, "reward_amount_meta": 750.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-07-11T10:18:07+00:00", "year": 2023, "attachment_count": 1, "local_path": "issues/40067195", "has_markdown": true }, { "id": "40067181", "title": "Security: Segment Fault in v8 wasm at address > page size", "url": "https://issues.chromium.org/issues/40067181", "status": "Assigned", "severity": "S4-Minimal", "component": "Blink>JavaScript, Blink>JavaScript>Compiler", "reporter": "je...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-07-11T03:24:40+00:00", "year": 2023, "attachment_count": 2, "local_path": "issues/40067181", "has_markdown": true }, { "id": "40067152", "title": "Extensions can open chrome-untrusted:// URLs with identity.launchWebAuthFlow", "url": "https://issues.chromium.org/issues/40067152", "status": "Assigned", "severity": "S3-Low", "component": "Unknown", "reporter": "ma...@gmail.com", "cve_ids": [], "bounty_amount": 750.0, "reward_amount_meta": 750.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-07-10T15:53:17+00:00", "year": 2023, "attachment_count": 3, "local_path": "issues/40067152", "has_markdown": true }, { "id": "40067111", "title": "memory corruption in perfetto", "url": "https://issues.chromium.org/issues/40067111", "status": "Accepted", "severity": "S3-Low", "component": "Speed>Tracing", "reporter": "em...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-07-09T16:36:39+00:00", "year": 2023, "attachment_count": 6, "local_path": "issues/40067111", "has_markdown": true }, { "id": "40067078", "title": "Security: Device chooser dialogs do not show origin correctly for web pages with non-standard URLs", "url": "https://issues.chromium.org/issues/40067078", "status": "Fixed", "severity": "Unknown", "component": "Blink>Bluetooth, Blink>HID, Blink>Serial, Blink>USB", "reporter": "al...@alesandroortiz.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-07-08T00:55:56+00:00", "year": 2023, "attachment_count": 2, "local_path": "issues/40067078", "has_markdown": true }, { "id": "40067050", "title": "Security: Type Confusion in V8 WebAssembly, leading to RCE", "url": "https://issues.chromium.org/issues/40067050", "status": "Assigned", "severity": "S4-Minimal", "component": "Blink>JavaScript>WebAssembly", "reporter": "je...@gmail.com", "cve_ids": [], "bounty_amount": 20000.0, "reward_amount_meta": 20000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-07-07T15:46:44+00:00", "year": 2023, "attachment_count": 8, "local_path": "issues/40067050", "has_markdown": true }, { "id": "40066990", "title": "Security: Eyedropper API can confuse real cursor position which can cause users to be tricked into clicking unwanted positions (ie. accepting permission prompts)", "url": "https://issues.chromium.org/issues/40066990", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Forms>Color", "reporter": "ha...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-07-06T20:46:52+00:00", "year": 2023, "attachment_count": 4, "local_path": "issues/40066990", "has_markdown": true }, { "id": "40066948", "title": "Security: Chrome OS : Two security bugs of mwifiex", "url": "https://issues.chromium.org/issues/40066948", "status": "Assigned", "severity": "S3-Low", "component": "Unknown", "reporter": "pi...@gmail.com", "cve_ids": [], "bounty_amount": 1500.0, "reward_amount_meta": 1500.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-07-06T09:27:34+00:00", "year": 2023, "attachment_count": 0, "local_path": "issues/40066948", "has_markdown": true }, { "id": "40066828", "title": "Incognito Mode Leaving Alert Dialog Box Tapjacking on DoubleClick", "url": "https://issues.chromium.org/issues/40066828", "status": "Accepted", "severity": "S3-Low", "component": "UI>Browser>Incognito", "reporter": "sh...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-07-04T11:06:40+00:00", "year": 2023, "attachment_count": 3, "local_path": "issues/40066828", "has_markdown": true }, { "id": "40066811", "title": "Race Condition UAF in KVM_DEV_VFIO_GROUP", "url": "https://issues.chromium.org/issues/40066811", "status": "Assigned", "severity": "S3-Low", "component": "Unknown", "reporter": "sh...@gmail.com", "cve_ids": [], "bounty_amount": 9500.0, "reward_amount_meta": 9500.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-07-04T05:43:36+00:00", "year": 2023, "attachment_count": 1, "local_path": "issues/40066811", "has_markdown": true }, { "id": "40066798", "title": "chrome.devtools.inspectedWindow origin limitations are very broken and can be bypassed", "url": "https://issues.chromium.org/issues/40066798", "status": "Assigned", "severity": "S3-Low", "component": "Platform>DevTools>Extensions", "reporter": "ma...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-07-03T18:36:42+00:00", "year": 2023, "attachment_count": 1, "local_path": "issues/40066798", "has_markdown": true }, { "id": "40066780", "title": "Security: Document PIP URL address spoofing using long about:blank URL", "url": "https://issues.chromium.org/issues/40066780", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Media>PictureInPicture", "reporter": "ha...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-07-03T14:53:22+00:00", "year": 2023, "attachment_count": 6, "local_path": "issues/40066780", "has_markdown": true }, { "id": "40066756", "title": "Security: Heap-use-after-free in WaitForStoreInitializeTask::UpgradeDone", "url": "https://issues.chromium.org/issues/40066756", "status": "Fixed", "severity": "S3-Low", "component": "Internals>Media>Feeds, UI>Browser>ContentSuggestions>Feed", "reporter": "ch...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-07-03T10:04:49+00:00", "year": 2023, "attachment_count": 2, "local_path": "issues/40066756", "has_markdown": true }, { "id": "40066754", "title": "Security: Heap-use-after-free in Browser::GetBrowserForOpeningWebUi", "url": "https://issues.chromium.org/issues/40066754", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Media>PictureInPicture", "reporter": "ch...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-07-03T10:03:07+00:00", "year": 2023, "attachment_count": 2, "local_path": "issues/40066754", "has_markdown": true }, { "id": "40066643", "title": "Security: about:blank origin shown in Bluetooth and other permission dialogs", "url": "https://issues.chromium.org/issues/40066643", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Bluetooth, Blink>HID, Blink>Serial, Blink>USB, UI>Browser>Permissions>Prompts", "reporter": "al...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-06-29T16:12:11+00:00", "year": 2023, "attachment_count": 1, "local_path": "issues/40066643", "has_markdown": true }, { "id": "40066578", "title": "Security: Bypass Spoofing download domain Chrome Windows ", "url": "https://issues.chromium.org/issues/40066578", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>Downloads", "reporter": "fe...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-06-28T16:16:42+00:00", "year": 2023, "attachment_count": 3, "local_path": "issues/40066578", "has_markdown": true }, { "id": "40066577", "title": "Security: Libxslt arbitrary file reading using document() method and external entities.", "url": "https://issues.chromium.org/issues/40066577", "status": "Assigned", "severity": "S3-Low", "component": "Blink>XML", "reporter": "c0...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-06-28T16:00:21+00:00", "year": 2023, "attachment_count": 3, "local_path": "issues/40066577", "has_markdown": true }, { "id": "40066575", "title": "Security: Heap-buffer-overflow in CompositorFrameSinkSupport::DidPresentCompositorFrame", "url": "https://issues.chromium.org/issues/40066575", "status": "Assigned", "severity": "S3-Low", "component": "Internals>GPU, Internals>Services>Viz", "reporter": "hi...@gmail.com", "cve_ids": [], "bounty_amount": 17000.0, "reward_amount_meta": 17000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-06-28T13:39:59+00:00", "year": 2023, "attachment_count": 4, "local_path": "issues/40066575", "has_markdown": true }, { "id": "40066572", "title": "Security: Chrome OS : Multiple bugs in cros_gralloc", "url": "https://issues.chromium.org/issues/40066572", "status": "Assigned", "severity": "S3-Low", "component": "Unknown", "reporter": "pi...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-06-28T12:51:50+00:00", "year": 2023, "attachment_count": 0, "local_path": "issues/40066572", "has_markdown": true }, { "id": "40066476", "title": "Security: Heap-use-after-free in KeyRotationLauncherImpl::SynchronizePublicKey", "url": "https://issues.chromium.org/issues/40066476", "status": "Assigned", "severity": "S3-Low", "component": "Enterprise>Connectors", "reporter": "me...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-06-27T06:58:01+00:00", "year": 2023, "attachment_count": 5, "local_path": "issues/40066476", "has_markdown": true }, { "id": "40066473", "title": "Security: V8: Fatal error in ../../src/api/api-inl.h, line 55", "url": "https://issues.chromium.org/issues/40066473", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript>Compiler>Maglev", "reporter": "sw...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-06-27T06:05:26+00:00", "year": 2023, "attachment_count": 1, "local_path": "issues/40066473", "has_markdown": true }, { "id": "40066392", "title": "Security: [ANGLE] metal : Out-of-bounds memory can be accessed on DrawCmd", "url": "https://issues.chromium.org/issues/40066392", "status": "Assigned", "severity": "S3-Low", "component": "Blink>WebGL, Internals>GPU>ANGLE", "reporter": "ne...@nesk.kr", "cve_ids": [], "bounty_amount": 10000.0, "reward_amount_meta": 10000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-06-26T07:04:11+00:00", "year": 2023, "attachment_count": 2, "local_path": "issues/40066392", "has_markdown": true }, { "id": "40066368", "title": "UAF in media_router::IssuesObserver::~IssuesObserver()", "url": "https://issues.chromium.org/issues/40066368", "status": "Assigned", "severity": "S3-Low", "component": "Internals>Cast", "reporter": "em...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-06-25T06:14:59+00:00", "year": 2023, "attachment_count": 4, "local_path": "issues/40066368", "has_markdown": true }, { "id": "40066351", "title": "memory corruption in MarkCompactCollector::ProcessMarkingWorklist(v8)", "url": "https://issues.chromium.org/issues/40066351", "status": "Accepted", "severity": "S3-Low", "component": "Blink>JavaScript>GarbageCollection", "reporter": "em...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-06-24T15:47:36+00:00", "year": 2023, "attachment_count": 5, "local_path": "issues/40066351", "has_markdown": true }, { "id": "40918488", "title": "Security: [Fix bypass] PWA Install prompt can still be overlaid over other origins", "url": "https://issues.chromium.org/issues/40918488", "status": "Accepted", "severity": "S4-Minimal", "component": "Platform>WebAppProvider", "reporter": "ha...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-06-24T06:42:06+00:00", "year": 2023, "attachment_count": 5, "local_path": "issues/40918488", "has_markdown": true }, { "id": "40066346", "title": "Initiator origin not shown in external protocol dialog with context menu open in new window / open in incognito window options inside an iframe", "url": "https://issues.chromium.org/issues/40066346", "status": "Accepted", "severity": "Unknown", "component": "UI>Browser>Navigation", "reporter": "fe...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-06-24T04:52:59+00:00", "year": 2023, "attachment_count": 5, "local_path": "issues/40066346", "has_markdown": true }, { "id": "40066280", "title": "Security: UAF in webrtc::SctpDataChannel::SetState", "url": "https://issues.chromium.org/issues/40066280", "status": "Assigned", "severity": "S3-Low", "component": "Blink>WebRTC>DataChannel", "reporter": "ki...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-06-23T04:30:21+00:00", "year": 2023, "attachment_count": 4, "local_path": "issues/40066280", "has_markdown": true }, { "id": "40066213", "title": "Security: use-after-free/data-race (in off-by-default JavaScriptExperimentalSharedMemory feature)", "url": "https://issues.chromium.org/issues/40066213", "status": "Fixed", "severity": "S3-Low", "component": "Blink>JavaScript", "reporter": "kv...@googlecontrib.kvakil.me", "cve_ids": [], "bounty_amount": 10000.0, "reward_amount_meta": 10000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-06-22T05:37:35+00:00", "year": 2023, "attachment_count": 2, "local_path": "issues/40066213", "has_markdown": true }, { "id": "40066208", "title": "Security: SoftNavigation + first-paint can leak history information", "url": "https://issues.chromium.org/issues/40066208", "status": "Assigned", "severity": "S3-Low", "component": "Blink>PerformanceAPIs", "reporter": "da...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-06-22T00:27:27+00:00", "year": 2023, "attachment_count": 2, "local_path": "issues/40066208", "has_markdown": true }, { "id": "40918159", "title": "Security: (Android) file download with long name cannot show the extension file it lead to spoof", "url": "https://issues.chromium.org/issues/40918159", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>Downloads", "reporter": "sa...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-06-21T19:47:54+00:00", "year": 2023, "attachment_count": 4, "local_path": "issues/40918159", "has_markdown": true }, { "id": "40066145", "title": "Race Condition UAF in amdgpu_cs_wait_fences_ioctl", "url": "https://issues.chromium.org/issues/40066145", "status": "Assigned", "severity": "S3-Low", "component": "Unknown", "reporter": "sh...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-06-21T00:28:02+00:00", "year": 2023, "attachment_count": 0, "local_path": "issues/40066145", "has_markdown": true }, { "id": "40066076", "title": "Security: [ANGLE] opengl : Out-of-bounds memory can be accessed using offsets in vertexAttribPointer", "url": "https://issues.chromium.org/issues/40066076", "status": "Assigned", "severity": "S3-Low", "component": "Blink>WebGL, Internals>GPU>ANGLE", "reporter": "ne...@nesk.kr", "cve_ids": [], "bounty_amount": 10000.0, "reward_amount_meta": 10000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-06-20T06:09:42+00:00", "year": 2023, "attachment_count": 2, "local_path": "issues/40066076", "has_markdown": true }, { "id": "40065952", "title": "Security: Local privilege escalation & sandbox escaping via chromeos-6.1 kernel BUG (DirtyVMA)", "url": "https://issues.chromium.org/issues/40065952", "status": "Accepted", "severity": "S3-Low", "component": "Unknown", "reporter": "lr...@gmail.com", "cve_ids": [], "bounty_amount": 500.0, "reward_amount_meta": 500.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-06-17T02:11:38+00:00", "year": 2023, "attachment_count": 2, "local_path": "issues/40065952", "has_markdown": true }, { "id": "40065894", "title": "Security: Heap-use-after-free in ui::PropertyHandler::GetPropertyInternal", "url": "https://issues.chromium.org/issues/40065894", "status": "Assigned", "severity": "S3-Low", "component": "Internals>Views, UI>Browser>Sharing", "reporter": "ch...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-06-16T01:00:28+00:00", "year": 2023, "attachment_count": 1, "local_path": "issues/40065894", "has_markdown": true }, { "id": "40065872", "title": "Security: Autofill Exploit Using Custom CSS Cursor", "url": "https://issues.chromium.org/issues/40065872", "status": "Accepted", "severity": "S3-Low", "component": "UI>Browser>Autofill", "reporter": "fa...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-06-15T16:08:59+00:00", "year": 2023, "attachment_count": 7, "local_path": "issues/40065872", "has_markdown": true }, { "id": "40065810", "title": "Security: Users cannot escape the full screen mode in this offline .html file", "url": "https://issues.chromium.org/issues/40065810", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>FullScreen", "reporter": "du...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-06-14T15:53:02+00:00", "year": 2023, "attachment_count": 2, "local_path": "issues/40065810", "has_markdown": true }, { "id": "40065774", "title": "Security: Chrome OS: OOB read and write in venus_read_queue and venus_write_queue of venus driver", "url": "https://issues.chromium.org/issues/40065774", "status": "Assigned", "severity": "S3-Low", "component": "Unknown", "reporter": "pi...@gmail.com", "cve_ids": [], "bounty_amount": 500.0, "reward_amount_meta": 500.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-06-13T22:54:21+00:00", "year": 2023, "attachment_count": 1, "local_path": "issues/40065774", "has_markdown": true }, { "id": "40065759", "title": "Security: Cursor hijacking mitigation bypass if iframe's content area is outside the top-layer content area", "url": "https://issues.chromium.org/issues/40065759", "status": "Assigned", "severity": "S3-Low", "component": "Blink>CSS, Blink>HTML>IFrame, Blink>Input", "reporter": "ha...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-06-13T17:24:42+00:00", "year": 2023, "attachment_count": 9, "local_path": "issues/40065759", "has_markdown": true }, { "id": "40065715", "title": "Security: OOB in evdi_gem_fault", "url": "https://issues.chromium.org/issues/40065715", "status": "Assigned", "severity": "S3-Low", "component": "Unknown", "reporter": "ha...@gmail.com", "cve_ids": [], "bounty_amount": 1500.0, "reward_amount_meta": 1500.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-06-13T07:24:04+00:00", "year": 2023, "attachment_count": 0, "local_path": "issues/40065715", "has_markdown": true }, { "id": "40065704", "title": "Security: Out of bound in intel_pxp_sm_ioctl_query_pxp_tag", "url": "https://issues.chromium.org/issues/40065704", "status": "Assigned", "severity": "S3-Low", "component": "Unknown", "reporter": "yq...@gmail.com", "cve_ids": [], "bounty_amount": 1500.0, "reward_amount_meta": 1500.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-06-13T02:26:50+00:00", "year": 2023, "attachment_count": 1, "local_path": "issues/40065704", "has_markdown": true }, { "id": "40065676", "title": "Security: heap-buffer-overflow in vkr_dispatch_vkAllocateMemory", "url": "https://issues.chromium.org/issues/40065676", "status": "Assigned", "severity": "S3-Low", "component": "Unknown", "reporter": "fi...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-06-12T14:58:04+00:00", "year": 2023, "attachment_count": 2, "local_path": "issues/40065676", "has_markdown": true }, { "id": "40065675", "title": "UAF in webrtc::DataChannelController::OnChannelStateChanged", "url": "https://issues.chromium.org/issues/40065675", "status": "Assigned", "severity": "S3-Low", "component": "Blink>WebRTC>DataChannel", "reporter": "em...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-06-12T14:09:18+00:00", "year": 2023, "attachment_count": 3, "local_path": "issues/40065675", "has_markdown": true }, { "id": "40065644", "title": "Security: Fatal error in ../../src/compiler/turboshaft/types.h", "url": "https://issues.chromium.org/issues/40065644", "status": "Accepted", "severity": "S4-Minimal", "component": "Blink>JavaScript>Compiler", "reporter": "sw...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-06-12T02:35:14+00:00", "year": 2023, "attachment_count": 1, "local_path": "issues/40065644", "has_markdown": true }, { "id": "40065634", "title": "Security: Chrome OS: OOB write in function session_get_prop_buf_req of venus driver", "url": "https://issues.chromium.org/issues/40065634", "status": "Assigned", "severity": "S3-Low", "component": "Unknown", "reporter": "pi...@gmail.com", "cve_ids": [], "bounty_amount": 500.0, "reward_amount_meta": 500.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-06-11T13:46:09+00:00", "year": 2023, "attachment_count": 2, "local_path": "issues/40065634", "has_markdown": true }, { "id": "40065633", "title": "Security: Chrome OS: Multiple Heap Buffer OOB write bugs in venus driver because of reenter in hfi_parser function", "url": "https://issues.chromium.org/issues/40065633", "status": "Assigned", "severity": "S3-Low", "component": "Unknown", "reporter": "pi...@gmail.com", "cve_ids": [], "bounty_amount": 500.0, "reward_amount_meta": 500.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-06-11T12:24:15+00:00", "year": 2023, "attachment_count": 2, "local_path": "issues/40065633", "has_markdown": true }, { "id": "40065632", "title": "Security: Chrome OS: Heap Buffer OOB write in function init_codecs of venus driver", "url": "https://issues.chromium.org/issues/40065632", "status": "Assigned", "severity": "S3-Low", "component": "Unknown", "reporter": "pi...@gmail.com", "cve_ids": [], "bounty_amount": 500.0, "reward_amount_meta": 500.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-06-11T12:02:23+00:00", "year": 2023, "attachment_count": 2, "local_path": "issues/40065632", "has_markdown": true }, { "id": "40065630", "title": "Security: Chrome OS: Buffer overflow in function parse_raw_formats of venus driver", "url": "https://issues.chromium.org/issues/40065630", "status": "Assigned", "severity": "S3-Low", "component": "Unknown", "reporter": "pi...@gmail.com", "cve_ids": [], "bounty_amount": 500.0, "reward_amount_meta": 500.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-06-11T10:05:46+00:00", "year": 2023, "attachment_count": 2, "local_path": "issues/40065630", "has_markdown": true }, { "id": "40065604", "title": "Security: Page can obtain autofill data with two consecutive taps using EyeDropper API (bypass of multiple prior fixes)", "url": "https://issues.chromium.org/issues/40065604", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>Autofill>AddressesAndMore, UI>Browser>Autofill>Payments", "reporter": "al...@alesandroortiz.com", "cve_ids": [], "bounty_amount": 10000.0, "reward_amount_meta": 10000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-06-09T23:50:10+00:00", "year": 2023, "attachment_count": 7, "local_path": "issues/40065604", "has_markdown": true }, { "id": "40065577", "title": "Security: Stack-use-after-return in BrowserAttestationService::OnChallengeValidated", "url": "https://issues.chromium.org/issues/40065577", "status": "Accepted", "severity": "S3-Low", "component": "Enterprise>Connectors", "reporter": "me...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-06-09T13:37:15+00:00", "year": 2023, "attachment_count": 8, "local_path": "issues/40065577", "has_markdown": true }, { "id": "40065570", "title": "Security: UAF in gpu::ClientSharedImageInterface::DestroySharedImage(browser process)", "url": "https://issues.chromium.org/issues/40065570", "status": "Accepted", "severity": "S3-Low", "component": "Internals>Services>Viz", "reporter": "0x...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-06-09T10:42:08+00:00", "year": 2023, "attachment_count": 2, "local_path": "issues/40065570", "has_markdown": true }, { "id": "40065552", "title": "Security: Multiple cros_ec bugs when handling host commands from Application Processor", "url": "https://issues.chromium.org/issues/40065552", "status": "Accepted", "severity": "S3-Low", "component": "Unknown", "reporter": "pi...@gmail.com", "cve_ids": [], "bounty_amount": 500.0, "reward_amount_meta": 500.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-06-09T05:51:24+00:00", "year": 2023, "attachment_count": 3, "local_path": "issues/40065552", "has_markdown": true }, { "id": "40065551", "title": "Security: URLBlocklist can be bypassed using chrome://download-internals", "url": "https://issues.chromium.org/issues/40065551", "status": "Assigned", "severity": "S3-Low", "component": "Enterprise, UI>Browser>Downloads, UI>Browser>WebUI", "reporter": "tu...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-06-09T05:27:16+00:00", "year": 2023, "attachment_count": 4, "local_path": "issues/40065551", "has_markdown": true }, { "id": "40065546", "title": "Security: heap-use-after-free on chrome/browser/ui/views/tabs/tab_strip.cc:220:5", "url": "https://issues.chromium.org/issues/40065546", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>TopChrome>TabStrip>TabGroups", "reporter": "rh...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-06-09T01:22:30+00:00", "year": 2023, "attachment_count": 5, "local_path": "issues/40065546", "has_markdown": true }, { "id": "40065507", "title": "Security: Heap-use-after-free in UploadToReportingServer", "url": "https://issues.chromium.org/issues/40065507", "status": "Assigned", "severity": "S3-Low", "component": "Enterprise", "reporter": "me...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-06-08T10:25:28+00:00", "year": 2023, "attachment_count": 4, "local_path": "issues/40065507", "has_markdown": true }, { "id": "40065483", "title": "Security: Possible Tapjacking PWA Installation in Android Chrome.", "url": "https://issues.chromium.org/issues/40065483", "status": "Accepted", "severity": "S3-Low", "component": "UI>Browser>WebAppInstalls>Android", "reporter": "fa...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-06-07T20:18:56+00:00", "year": 2023, "attachment_count": 12, "local_path": "issues/40065483", "has_markdown": true }, { "id": "40065473", "title": "Security: Type confusion in v8 caused by incorrect side effect modelling of JSStackCheck", "url": "https://issues.chromium.org/issues/40065473", "status": "Assigned", "severity": "S4-Minimal", "component": "Blink>JavaScript, Blink>JavaScript>Runtime", "reporter": "m-...@github.com", "cve_ids": [], "bounty_amount": 20000.0, "reward_amount_meta": 20000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-06-07T14:58:26+00:00", "year": 2023, "attachment_count": 2, "local_path": "issues/40065473", "has_markdown": true }, { "id": "40065422", "title": "Security : Heap UaF on ash/wm/splitview/split_view_divider_view.cc:168:23", "url": "https://issues.chromium.org/issues/40065422", "status": "Assigned", "severity": "S3-Low", "component": "Unknown", "reporter": "rh...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-06-06T15:32:25+00:00", "year": 2023, "attachment_count": 2, "local_path": "issues/40065422", "has_markdown": true }, { "id": "40065403", "title": "Security: Tapjacking Android Chrome APK Warning", "url": "https://issues.chromium.org/issues/40065403", "status": "Accepted", "severity": "S4-Minimal", "component": "UI>Browser>Downloads", "reporter": "fa...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-06-06T08:47:47+00:00", "year": 2023, "attachment_count": 6, "local_path": "issues/40065403", "has_markdown": true }, { "id": "40065395", "title": "Security: OOB in vb2ops_venc_queue_setup", "url": "https://issues.chromium.org/issues/40065395", "status": "Assigned", "severity": "S3-Low", "component": "Unknown", "reporter": "yq...@gmail.com", "cve_ids": [], "bounty_amount": 500.0, "reward_amount_meta": 500.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-06-06T04:07:51+00:00", "year": 2023, "attachment_count": 0, "local_path": "issues/40065395", "has_markdown": true }, { "id": "40065384", "title": "Security: Spoof empty titlebar via javascript: URI in Document PIP", "url": "https://issues.chromium.org/issues/40065384", "status": "Accepted", "severity": "S3-Low", "component": "Blink>Media>PictureInPicture", "reporter": "ha...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-06-05T19:12:28+00:00", "year": 2023, "attachment_count": 11, "local_path": "issues/40065384", "has_markdown": true }, { "id": "40065267", "title": "Security: UAF in ash::diagnostics::AsyncLog::Append", "url": "https://issues.chromium.org/issues/40065267", "status": "Assigned", "severity": "S3-Low", "component": "Unknown", "reporter": "zh...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-06-04T05:53:30+00:00", "year": 2023, "attachment_count": 2, "local_path": "issues/40065267", "has_markdown": true }, { "id": "40065258", "title": "chrome.devtools.inspectedWindow.reload can run scripts on the Chrome Web Store", "url": "https://issues.chromium.org/issues/40065258", "status": "Assigned", "severity": "S3-Low", "component": "Platform>Extensions", "reporter": "ma...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-06-03T20:43:21+00:00", "year": 2023, "attachment_count": 6, "local_path": "issues/40065258", "has_markdown": true }, { "id": "40065256", "title": "Heap-use-after-free in ui::AXTreeSerializer::AnyDescendantWasReparented", "url": "https://issues.chromium.org/issues/40065256", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Accessibility, Internals>Accessibility", "reporter": "m....@gmail.com", "cve_ids": [], "bounty_amount": 9000.0, "reward_amount_meta": 9000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-06-03T17:44:18+00:00", "year": 2023, "attachment_count": 1, "local_path": "issues/40065256", "has_markdown": true }, { "id": "40065200", "title": "UAF in MarkingWorklists::Local::IsEmpty(v8)", "url": "https://issues.chromium.org/issues/40065200", "status": "Accepted", "severity": "S3-Low", "component": "Blink>JavaScript>GarbageCollection", "reporter": "em...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-06-02T08:26:07+00:00", "year": 2023, "attachment_count": 7, "local_path": "issues/40065200", "has_markdown": true }, { "id": "40065191", "title": "Security: UAF in extensions::OffscreenCreateDocumentFunction::OnExtensionHostDestroyed (browser process)", "url": "https://issues.chromium.org/issues/40065191", "status": "Assigned", "severity": "S3-Low", "component": "Platform>Extensions", "reporter": "0x...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-06-02T05:03:34+00:00", "year": 2023, "attachment_count": 2, "local_path": "issues/40065191", "has_markdown": true }, { "id": "40065188", "title": "Security: v8 crash Bytecode mismatch at offset 78", "url": "https://issues.chromium.org/issues/40065188", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript>Interpreter", "reporter": "be...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-06-02T02:35:44+00:00", "year": 2023, "attachment_count": 2, "local_path": "issues/40065188", "has_markdown": true }, { "id": "40065154", "title": "Security: UAF in AutofillSnackbarController", "url": "https://issues.chromium.org/issues/40065154", "status": "New", "severity": "S3-Low", "component": "UI>Browser>Autofill>Payments", "reporter": "jt...@gmail.com", "cve_ids": [], "bounty_amount": 21000.0, "reward_amount_meta": 21000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-06-01T13:12:25+00:00", "year": 2023, "attachment_count": 3, "local_path": "issues/40065154", "has_markdown": true }, { "id": "40065124", "title": "Security: UAF in guest_view::GuestViewManager::EmbedderProcessDestroyed(browser process)", "url": "https://issues.chromium.org/issues/40065124", "status": "Assigned", "severity": "S3-Low", "component": "Platform>Apps>BrowserTag", "reporter": "0x...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-05-31T23:41:47+00:00", "year": 2023, "attachment_count": 7, "local_path": "issues/40065124", "has_markdown": true }, { "id": "40065117", "title": "Security: Document PiP URL spoof", "url": "https://issues.chromium.org/issues/40065117", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Media>PictureInPicture", "reporter": "st...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-05-31T22:38:42+00:00", "year": 2023, "attachment_count": 3, "local_path": "issues/40065117", "has_markdown": true }, { "id": "40065052", "title": "Security: OOB in NotificationDaemon::OnClicked", "url": "https://issues.chromium.org/issues/40065052", "status": "Accepted", "severity": "S3-Low", "component": "Unknown", "reporter": "yq...@gmail.com", "cve_ids": [], "bounty_amount": 500.0, "reward_amount_meta": 500.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-05-31T02:54:11+00:00", "year": 2023, "attachment_count": 0, "local_path": "issues/40065052", "has_markdown": true }, { "id": "40065050", "title": "CHECK failure: !v8::internal::v8_flags.enable_slow_asserts.value() || (IsSeqOneByteString_NonIn", "url": "https://issues.chromium.org/issues/40065050", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript", "reporter": "5n...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-05-31T02:18:07+00:00", "year": 2023, "attachment_count": 1, "local_path": "issues/40065050", "has_markdown": true }, { "id": "40065022", "title": "Security: heap-use-after-free on AudioManagerWin", "url": "https://issues.chromium.org/issues/40065022", "status": "Assigned", "severity": "S3-Low", "component": "Internals>Media>Audio", "reporter": "ki...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-05-30T15:25:04+00:00", "year": 2023, "attachment_count": 11, "local_path": "issues/40065022", "has_markdown": true }, { "id": "40065011", "title": "Security: SEGV on emit_ios_generic_outputs", "url": "https://issues.chromium.org/issues/40065011", "status": "Assigned", "severity": "S3-Low", "component": "Unknown", "reporter": "fi...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-05-30T12:26:58+00:00", "year": 2023, "attachment_count": 2, "local_path": "issues/40065011", "has_markdown": true }, { "id": "40065003", "title": "Security: Bypass the Protection of input fields cache (Autofill) due to inappropriate code design (Bypass 1108181)", "url": "https://issues.chromium.org/issues/40065003", "status": "Accepted", "severity": "S4-Minimal", "component": "UI>Browser>Autofill", "reporter": "el...@gmail.com", "cve_ids": [], "bounty_amount": 6000.0, "reward_amount_meta": 6000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-05-30T11:11:16+00:00", "year": 2023, "attachment_count": 10, "local_path": "issues/40065003", "has_markdown": true }, { "id": "40064983", "title": "Security: type mismatch with jit,0 vs 65536", "url": "https://issues.chromium.org/issues/40064983", "status": "Fixed", "severity": "S3-Low", "component": "Blink>JavaScript>Compiler", "reporter": "be...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-05-29T23:53:35+00:00", "year": 2023, "attachment_count": 2, "local_path": "issues/40064983", "has_markdown": true }, { "id": "40064965", "title": "Security: heap-use-after-free on LibcastSocketService", "url": "https://issues.chromium.org/issues/40064965", "status": "New", "severity": "S3-Low", "component": "Internals>Cast>Providers", "reporter": "je...@gmail.com", "cve_ids": [], "bounty_amount": 16000.0, "reward_amount_meta": 16000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-05-29T14:27:06+00:00", "year": 2023, "attachment_count": 2, "local_path": "issues/40064965", "has_markdown": true }, { "id": "40064841", "title": "Security: Forced user interaction for Hidden permission prompts by freezing/resizing the browser Bypass of 1371215 ", "url": "https://issues.chromium.org/issues/40064841", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>Permissions>Prompts", "reporter": "el...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-05-25T21:37:54+00:00", "year": 2023, "attachment_count": 5, "local_path": "issues/40064841", "has_markdown": true }, { "id": "40064789", "title": "Security: UAF in AcquireFileAccessPermissionDoneForScheduleDownload", "url": "https://issues.chromium.org/issues/40064789", "status": "Assigned", "severity": "S3-Low", "component": "Internals>Network, UI>Browser>Offline", "reporter": "ss...@gmail.com", "cve_ids": [], "bounty_amount": 30000.0, "reward_amount_meta": 30000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-05-24T14:37:06+00:00", "year": 2023, "attachment_count": 6, "local_path": "issues/40064789", "has_markdown": true }, { "id": "40064754", "title": "Security: Spoofing Permission Prompts UI behind PIP overlay-Bypass of 1394410 ", "url": "https://issues.chromium.org/issues/40064754", "status": "Accepted", "severity": "S3-Low", "component": "Blink>Media>PictureInPicture, UI>Browser>Permissions>Prompts", "reporter": "el...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-05-23T15:44:46+00:00", "year": 2023, "attachment_count": 7, "local_path": "issues/40064754", "has_markdown": true }, { "id": "40064747", "title": "Security: Heap Buffer Overflow and Security DCHECK failed: IsA(from) in MediaStreamTrackImpl::stopTrack", "url": "https://issues.chromium.org/issues/40064747", "status": "Assigned", "severity": "S3-Low", "component": "Blink>MediaStream", "reporter": "je...@gmail.com", "cve_ids": [], "bounty_amount": 11000.0, "reward_amount_meta": 11000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-05-23T10:13:04+00:00", "year": 2023, "attachment_count": 8, "local_path": "issues/40064747", "has_markdown": true }, { "id": "40064728", "title": "Security: TALOS-2023-1751 - Google Chrome VideoEncoder av1_svc_check_reset_layer_rc_flag use-after-free vulnerability", "url": "https://issues.chromium.org/issues/40064728", "status": "Assigned", "severity": "S3-Low", "component": "Internals>Media", "reporter": "pi...@thelead82.com", "cve_ids": [], "bounty_amount": 10000.0, "reward_amount_meta": 10000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-05-22T15:25:55+00:00", "year": 2023, "attachment_count": 3, "local_path": "issues/40064728", "has_markdown": true }, { "id": "40064697", "title": "Integer overflow in vkr_cs_encoder_set_stream", "url": "https://issues.chromium.org/issues/40064697", "status": "Assigned", "severity": "S3-Low", "component": "Internals>GPU>Internals", "reporter": "fi...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-05-21T07:51:58+00:00", "year": 2023, "attachment_count": 2, "local_path": "issues/40064697", "has_markdown": true }, { "id": "40064696", "title": "Security:Integer overflow in vn_decode_vkExecuteCommandStreamsMESA_args_temp", "url": "https://issues.chromium.org/issues/40064696", "status": "Assigned", "severity": "S3-Low", "component": "Internals>GPU>Internals", "reporter": "fi...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-05-21T06:59:00+00:00", "year": 2023, "attachment_count": 2, "local_path": "issues/40064696", "has_markdown": true }, { "id": "40064688", "title": "Security: the autofill prompt appears together with the requesfullscreen, the autofill prompt does not close it can confuse lead to spoof", "url": "https://issues.chromium.org/issues/40064688", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>Autofill", "reporter": "sa...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-05-19T23:22:08+00:00", "year": 2023, "attachment_count": 8, "local_path": "issues/40064688", "has_markdown": true }, { "id": "40064686", "title": "Security: Chrome for Android Slowdown with JS then Navigate able to Hide Omnibox", "url": "https://issues.chromium.org/issues/40064686", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>Navigation>BFCache", "reporter": "su...@gmail.com", "cve_ids": [], "bounty_amount": 7500.0, "reward_amount_meta": 7500.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-05-19T21:26:33+00:00", "year": 2023, "attachment_count": 5, "local_path": "issues/40064686", "has_markdown": true }, { "id": "40064642", "title": "Security: Bypass Of 1342072", "url": "https://issues.chromium.org/issues/40064642", "status": "Assigned", "severity": "S3-Low", "component": "Blink>PresentationAPI, UI>Security (Use Subcomponent)>UrlFormatting", "reporter": "ia...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-05-18T19:23:31+00:00", "year": 2023, "attachment_count": 7, "local_path": "issues/40064642", "has_markdown": true }, { "id": "40064636", "title": "Security: (Android) PWA Install Dialogs can be overlaid over other origins (PWA install dialog spoofing while navigation).", "url": "https://issues.chromium.org/issues/40064636", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>Mobile>CompositedUI, UI>Browser>Mobile>CustomTabs, UI>Browser>Mobile>Messages, UI>Browser>WebAppInstalls>Android", "reporter": "el...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-05-18T16:38:35+00:00", "year": 2023, "attachment_count": 8, "local_path": "issues/40064636", "has_markdown": true }, { "id": "40064616", "title": "Security: Side-channel attack allows accessing the browsing history", "url": "https://issues.chromium.org/issues/40064616", "status": "Accepted", "severity": "S3-Low", "component": "Blink>Paint, Internals>GPU", "reporter": "is...@oy.ne.ro", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-05-17T12:12:17+00:00", "year": 2023, "attachment_count": 1, "local_path": "issues/40064616", "has_markdown": true }, { "id": "40064615", "title": "Security: UAF in webrtc::PeerConnection::ReportTransportStats()", "url": "https://issues.chromium.org/issues/40064615", "status": "Assigned", "severity": "S3-Low", "component": "Blink>WebRTC", "reporter": "0x...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-05-17T11:22:13+00:00", "year": 2023, "attachment_count": 4, "local_path": "issues/40064615", "has_markdown": true }, { "id": "40064598", "title": "intent:// restrictions bypassed via firebase dynamic links", "url": "https://issues.chromium.org/issues/40064598", "status": "Assigned", "severity": "S3-Low", "component": "Blink>SecurityFeature>ContentSecurityPolicy, Mobile>Intents", "reporter": "nd...@protonmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-05-16T16:10:07+00:00", "year": 2023, "attachment_count": 1, "local_path": "issues/40064598", "has_markdown": true }, { "id": "40064579", "title": "Security: Chrome iOS iframe SandBox Download", "url": "https://issues.chromium.org/issues/40064579", "status": "Accepted", "severity": "S3-Low", "component": "Mobile>iOSWeb>Security", "reporter": "ia...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-05-15T18:54:37+00:00", "year": 2023, "attachment_count": 3, "local_path": "issues/40064579", "has_markdown": true }, { "id": "40064571", "title": "Security: Heap-use-after-free in AboutThisSiteSidePanelView::HandleKeyboardEvent", "url": "https://issues.chromium.org/issues/40064571", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>Bubbles>PageInfo", "reporter": "me...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-05-15T11:29:42+00:00", "year": 2023, "attachment_count": 3, "local_path": "issues/40064571", "has_markdown": true }, { "id": "40064564", "title": "Security: Use-after-free in CPWL_ComboBox::OnKeyDown", "url": "https://issues.chromium.org/issues/40064564", "status": "Assigned", "severity": "S3-Low", "component": "Internals>Plugins>PDF", "reporter": "qu...@gmail.com", "cve_ids": [], "bounty_amount": 9000.0, "reward_amount_meta": 9000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-05-15T04:42:40+00:00", "year": 2023, "attachment_count": 2, "local_path": "issues/40064564", "has_markdown": true }, { "id": "40064543", "title": "Audio player's download functionality allows bypassing the \"allow-downloads\" flag of sandboxed iframes", "url": "https://issues.chromium.org/issues/40064543", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Media>Audio, Blink>SecurityFeature>IFrameSandbox, UI>Browser>Downloads", "reporter": "he...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-05-13T02:35:10+00:00", "year": 2023, "attachment_count": 9, "local_path": "issues/40064543", "has_markdown": true }, { "id": "40064538", "title": "Security: Chrome German capital sharp s \"ẞ\"", "url": "https://issues.chromium.org/issues/40064538", "status": "Accepted", "severity": "S3-Low", "component": "Blink>Network, Internals>Network, UI>Security (Use Subcomponent)>UrlFormatting", "reporter": "he...@googlemail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-05-12T22:35:55+00:00", "year": 2023, "attachment_count": 1, "local_path": "issues/40064538", "has_markdown": true }, { "id": "40064508", "title": "Security: A use after free vulnerability exists in ChromeOS Kernel", "url": "https://issues.chromium.org/issues/40064508", "status": "Assigned", "severity": "S3-Low", "component": "Unknown", "reporter": "ay...@gmail.com", "cve_ids": [], "bounty_amount": 15000.0, "reward_amount_meta": 15000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-05-11T16:20:57+00:00", "year": 2023, "attachment_count": 2, "local_path": "issues/40064508", "has_markdown": true }, { "id": "40064493", "title": "Security: another UAF in content::SyntheticPointerAction::ForwardTouchOrMouseInputEvents(browser process)", "url": "https://issues.chromium.org/issues/40064493", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Input", "reporter": "0x...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-05-11T00:54:35+00:00", "year": 2023, "attachment_count": 6, "local_path": "issues/40064493", "has_markdown": true }, { "id": "40064490", "title": "Security: PDFium (XFA) Use-after-free in CFFL_ListBox::SaveData", "url": "https://issues.chromium.org/issues/40064490", "status": "Assigned", "severity": "S3-Low", "component": "Internals>Plugins>PDF", "reporter": "hu...@gmail.com", "cve_ids": [], "bounty_amount": 9000.0, "reward_amount_meta": 9000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-05-10T23:51:50+00:00", "year": 2023, "attachment_count": 1, "local_path": "issues/40064490", "has_markdown": true }, { "id": "40064476", "title": "Security: UAF in CommitErrorPage", "url": "https://issues.chromium.org/issues/40064476", "status": "New", "severity": "S3-Low", "component": "UI>Browser>Navigation", "reporter": "hi...@gmail.com", "cve_ids": [], "bounty_amount": 31000.0, "reward_amount_meta": 31000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-05-10T10:39:31+00:00", "year": 2023, "attachment_count": 4, "local_path": "issues/40064476", "has_markdown": true }, { "id": "40064463", "title": "Security: PDFium (XFA) Use-after-free in CPWL_ComboBox::OnChar", "url": "https://issues.chromium.org/issues/40064463", "status": "Assigned", "severity": "S3-Low", "component": "Internals>Plugins>PDF", "reporter": "hu...@gmail.com", "cve_ids": [], "bounty_amount": 9000.0, "reward_amount_meta": 9000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-05-09T23:37:12+00:00", "year": 2023, "attachment_count": 1, "local_path": "issues/40064463", "has_markdown": true }, { "id": "40064452", "title": "Heap-use-after-free in v8::internal::TracedHandles::Destroy", "url": "https://issues.chromium.org/issues/40064452", "status": "Assigned", "severity": "S4-Minimal", "component": "Blink>JavaScript>API, Blink>JavaScript>Runtime", "reporter": "m....@gmail.com", "cve_ids": [], "bounty_amount": 9000.0, "reward_amount_meta": 9000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-05-09T13:12:28+00:00", "year": 2023, "attachment_count": 0, "local_path": "issues/40064452", "has_markdown": true }, { "id": "40064447", "title": "Security: Chrome OS cros_camera_service OOB write in function CameraDeviceAdapter::RegisterBufferLocked", "url": "https://issues.chromium.org/issues/40064447", "status": "Assigned", "severity": "S3-Low", "component": "Unknown", "reporter": "pi...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-05-09T10:47:32+00:00", "year": 2023, "attachment_count": 1, "local_path": "issues/40064447", "has_markdown": true }, { "id": "40064446", "title": "Security: Chrome OS cros_camera_service OOB read and write when handling metadata_entry", "url": "https://issues.chromium.org/issues/40064446", "status": "Assigned", "severity": "S3-Low", "component": "Unknown", "reporter": "pi...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-05-09T10:34:40+00:00", "year": 2023, "attachment_count": 1, "local_path": "issues/40064446", "has_markdown": true }, { "id": "40064445", "title": "Security: Chrome OS cros_camera_service integer overflow in calculate_camera_metadata_size can cause OOB write ", "url": "https://issues.chromium.org/issues/40064445", "status": "Assigned", "severity": "S3-Low", "component": "Unknown", "reporter": "pi...@gmail.com", "cve_ids": [], "bounty_amount": 10000.0, "reward_amount_meta": 10000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-05-09T10:05:00+00:00", "year": 2023, "attachment_count": 3, "local_path": "issues/40064445", "has_markdown": true }, { "id": "40064444", "title": "Security:stack-buffer-overflow in vrend_shader_sampler_views_mask_get bypassed", "url": "https://issues.chromium.org/issues/40064444", "status": "Assigned", "severity": "S3-Low", "component": "Unknown", "reporter": "fi...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-05-09T10:04:18+00:00", "year": 2023, "attachment_count": 1, "local_path": "issues/40064444", "has_markdown": true }, { "id": "40064442", "title": "Regression: External protocol confirmation dialog may overlap with other origins", "url": "https://issues.chromium.org/issues/40064442", "status": "Assigned", "severity": "S3-Low", "component": "Mobile>Intents, UI>Browser>Navigation", "reporter": "zy...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-05-09T02:41:20+00:00", "year": 2023, "attachment_count": 3, "local_path": "issues/40064442", "has_markdown": true }, { "id": "40064432", "title": "Security: Chrome iOS", "url": "https://issues.chromium.org/issues/40064432", "status": "Accepted", "severity": "S3-Low", "component": "Mobile>iOSWeb>Security", "reporter": "ia...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-05-08T19:21:44+00:00", "year": 2023, "attachment_count": 2, "local_path": "issues/40064432", "has_markdown": true }, { "id": "40064425", "title": "Security: UAF in extensions::WebViewFindHelper::FindReply in browser process", "url": "https://issues.chromium.org/issues/40064425", "status": "Assigned", "severity": "S3-Low", "component": "Platform>Extensions", "reporter": "0x...@gmail.com", "cve_ids": [], "bounty_amount": 10000.0, "reward_amount_meta": 10000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-05-08T12:29:55+00:00", "year": 2023, "attachment_count": 5, "local_path": "issues/40064425", "has_markdown": true }, { "id": "40064420", "title": "Security: adb wireless debugging bugfix bypass", "url": "https://issues.chromium.org/issues/40064420", "status": "Assigned", "severity": "S3-Low", "component": "Unknown", "reporter": "sm...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-05-08T05:01:15+00:00", "year": 2023, "attachment_count": 13, "local_path": "issues/40064420", "has_markdown": true }, { "id": "40064410", "title": "Security: Chrome iOS", "url": "https://issues.chromium.org/issues/40064410", "status": "Accepted", "severity": "S3-Low", "component": "Blink>SecurityFeature>Referrer", "reporter": "ia...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-05-07T16:46:38+00:00", "year": 2023, "attachment_count": 3, "local_path": "issues/40064410", "has_markdown": true }, { "id": "40064406", "title": "Security: On Chrome OS, any webpage is able to interface with the Chrome Goodies extension", "url": "https://issues.chromium.org/issues/40064406", "status": "Assigned", "severity": "S3-Low", "component": "Unknown", "reporter": "ad...@gmail.com", "cve_ids": [], "bounty_amount": 500.0, "reward_amount_meta": 500.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-05-07T06:43:17+00:00", "year": 2023, "attachment_count": 2, "local_path": "issues/40064406", "has_markdown": true }, { "id": "40064398", "title": "Security: Chrome iOS", "url": "https://issues.chromium.org/issues/40064398", "status": "Assigned", "severity": "S3-Low", "component": "Mobile>iOSWeb>Security, Mobile>iOSWeb>WebPlatform", "reporter": "ia...@gmail.com", "cve_ids": [ "CVE-2023-38572" ], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-05-06T11:44:03+00:00", "year": 2023, "attachment_count": 14, "local_path": "issues/40064398", "has_markdown": true }, { "id": "40064393", "title": "Security: Race Condition in amdgpu_ttm_tt_get_user_pages", "url": "https://issues.chromium.org/issues/40064393", "status": "Assigned", "severity": "S3-Low", "component": "Unknown", "reporter": "yq...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-05-06T02:35:35+00:00", "year": 2023, "attachment_count": 0, "local_path": "issues/40064393", "has_markdown": true }, { "id": "40910758", "title": "Security: Chrome desktop on MacOS allows websites to access a folder contains system files", "url": "https://issues.chromium.org/issues/40910758", "status": "Accepted", "severity": "S3-Low", "component": "Blink>Storage>FileSystem", "reporter": "du...@gmail.com", "cve_ids": [], "bounty_amount": 500.0, "reward_amount_meta": 500.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-05-05T05:27:04+00:00", "year": 2023, "attachment_count": 0, "local_path": "issues/40910758", "has_markdown": true }, { "id": "40064365", "title": "Security: UAF in content::BrowserPluginGuest::GetProspectiveOuterDocument() in browser process", "url": "https://issues.chromium.org/issues/40064365", "status": "Assigned", "severity": "S3-Low", "component": "Platform>Apps>BrowserTag, Platform>Extensions", "reporter": "0x...@gmail.com", "cve_ids": [], "bounty_amount": 10000.0, "reward_amount_meta": 10000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-05-04T11:39:33+00:00", "year": 2023, "attachment_count": 4, "local_path": "issues/40064365", "has_markdown": true }, { "id": "40064335", "title": "Security: PWA dialog selects an install button by default Bypassing Google Security Measures in Chrome UI ", "url": "https://issues.chromium.org/issues/40064335", "status": "Assigned", "severity": "Unknown", "component": "UI>Browser>WebAppInstalls", "reporter": "el...@gmail.com", "cve_ids": [], "bounty_amount": 1500.0, "reward_amount_meta": 1500.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-05-02T20:34:13+00:00", "year": 2023, "attachment_count": 8, "local_path": "issues/40064335", "has_markdown": true }, { "id": "40064307", "title": "Security:OOB read in vrend_set_single_image_view", "url": "https://issues.chromium.org/issues/40064307", "status": "Assigned", "severity": "S3-Low", "component": "Internals>GPU>Internals", "reporter": "fi...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-05-01T13:38:53+00:00", "year": 2023, "attachment_count": 1, "local_path": "issues/40064307", "has_markdown": true }, { "id": "40064290", "title": "Security: Calling ash::DiagnosticsDialog::ShowDialog multiple times can result in an Use-After-Free (UAF) error in ash::diagnostics::NetworkingLog::UpdateNetworkList.", "url": "https://issues.chromium.org/issues/40064290", "status": "Assigned", "severity": "S3-Low", "component": "Unknown", "reporter": "zh...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-04-30T06:29:05+00:00", "year": 2023, "attachment_count": 4, "local_path": "issues/40064290", "has_markdown": true }, { "id": "40064282", "title": "Security:Debug check failed: HasBuiltinId() implies builtin_id() != Builtin::kCompileLazy.", "url": "https://issues.chromium.org/issues/40064282", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript, Blink>JavaScript>Runtime", "reporter": "wh...@gmail.com", "cve_ids": [], "bounty_amount": 8000.0, "reward_amount_meta": 8000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-04-29T14:43:16+00:00", "year": 2023, "attachment_count": 1, "local_path": "issues/40064282", "has_markdown": true }, { "id": "40064274", "title": "Security: Select option can cover permission buble , lead to spoof", "url": "https://issues.chromium.org/issues/40064274", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>Permissions>Prompts", "reporter": "sa...@gmail.com", "cve_ids": [], "bounty_amount": 500.0, "reward_amount_meta": 500.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-04-29T04:45:14+00:00", "year": 2023, "attachment_count": 5, "local_path": "issues/40064274", "has_markdown": true }, { "id": "40064253", "title": "Security: [swiftshader] heap-use-after-free on vk::Query::start (another)", "url": "https://issues.chromium.org/issues/40064253", "status": "Assigned", "severity": "S4-Minimal", "component": "Internals>GPU>SwiftShader", "reporter": "ne...@nesk.kr", "cve_ids": [], "bounty_amount": 10000.0, "reward_amount_meta": 10000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-04-27T16:16:20+00:00", "year": 2023, "attachment_count": 2, "local_path": "issues/40064253", "has_markdown": true }, { "id": "40064246", "title": "Security: heap-use-after-free in vrend_apply_sampler_state", "url": "https://issues.chromium.org/issues/40064246", "status": "Assigned", "severity": "S3-Low", "component": "Unknown", "reporter": "fi...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-04-27T11:10:52+00:00", "year": 2023, "attachment_count": 2, "local_path": "issues/40064246", "has_markdown": true }, { "id": "40064228", "title": "Security: heap-use-after-free in vrend_set_single_image_view", "url": "https://issues.chromium.org/issues/40064228", "status": "Assigned", "severity": "S3-Low", "component": "Unknown", "reporter": "fi...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-04-25T23:44:55+00:00", "year": 2023, "attachment_count": 0, "local_path": "issues/40064228", "has_markdown": true }, { "id": "40064227", "title": "Security: heap-use-after-free in vrend_set_uniform_buffer", "url": "https://issues.chromium.org/issues/40064227", "status": "Assigned", "severity": "S3-Low", "component": "Unknown", "reporter": "fi...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-04-25T23:44:32+00:00", "year": 2023, "attachment_count": 0, "local_path": "issues/40064227", "has_markdown": true }, { "id": "40064191", "title": "Security: UAF in SaveUPIOfferBubbleViews::WindowClosing", "url": "https://issues.chromium.org/issues/40064191", "status": "Accepted", "severity": "S3-Low", "component": "UI>Browser>Autofill", "reporter": "zh...@gmail.com", "cve_ids": [], "bounty_amount": 6000.0, "reward_amount_meta": 6000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-04-24T09:30:58+00:00", "year": 2023, "attachment_count": 5, "local_path": "issues/40064191", "has_markdown": true }, { "id": "40064189", "title": "Security: Heap-use-after-free in SearchCompanionSidePanelCoordinator::CreateCompanionEntry", "url": "https://issues.chromium.org/issues/40064189", "status": "Accepted", "severity": "S3-Low", "component": "UI>Browser>TopChrome>SidePanel", "reporter": "me...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-04-24T09:14:10+00:00", "year": 2023, "attachment_count": 4, "local_path": "issues/40064189", "has_markdown": true }, { "id": "40064176", "title": "Security: Chrome OS amd drm gpu driver UAF bug in amdgpu_sched_ioctl which can be triggered from chrome browser context", "url": "https://issues.chromium.org/issues/40064176", "status": "Assigned", "severity": "S3-Low", "component": "Internals>GPU>Internals", "reporter": "pi...@gmail.com", "cve_ids": [], "bounty_amount": 10000.0, "reward_amount_meta": 10000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-04-23T07:33:41+00:00", "year": 2023, "attachment_count": 2, "local_path": "issues/40064176", "has_markdown": true }, { "id": "40064170", "title": "Portals URL spoof after crash", "url": "https://issues.chromium.org/issues/40064170", "status": "Accepted", "severity": "S3-Low", "component": "Blink>Portals", "reporter": "nd...@protonmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-04-23T02:43:43+00:00", "year": 2023, "attachment_count": 1, "local_path": "issues/40064170", "has_markdown": true }, { "id": "40064169", "title": "Security: out-of-bounds access in tgsi_scan_shader", "url": "https://issues.chromium.org/issues/40064169", "status": "Assigned", "severity": "S3-Low", "component": "Unknown", "reporter": "fi...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-04-23T02:06:33+00:00", "year": 2023, "attachment_count": 4, "local_path": "issues/40064169", "has_markdown": true }, { "id": "40064163", "title": "Security: out-of-bounds write in tgsi_scan_shader", "url": "https://issues.chromium.org/issues/40064163", "status": "Assigned", "severity": "S3-Low", "component": "Unknown", "reporter": "fi...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-04-22T10:03:06+00:00", "year": 2023, "attachment_count": 4, "local_path": "issues/40064163", "has_markdown": true }, { "id": "40064150", "title": "Security: stack-buffer-overflow in prepare_so_movs", "url": "https://issues.chromium.org/issues/40064150", "status": "Assigned", "severity": "S3-Low", "component": "Unknown", "reporter": "fi...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-04-21T14:19:07+00:00", "year": 2023, "attachment_count": 3, "local_path": "issues/40064150", "has_markdown": true }, { "id": "40064142", "title": "Security: UAF in DevToolsDataSource::OnLoadComplete", "url": "https://issues.chromium.org/issues/40064142", "status": "Assigned", "severity": "S3-Low", "component": "Platform>DevTools, UI>Browser>WebUI", "reporter": "0x...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-04-21T00:29:05+00:00", "year": 2023, "attachment_count": 6, "local_path": "issues/40064142", "has_markdown": true }, { "id": "40064140", "title": "Security: UAF in base::ObserverListShell", "reporter": "0x...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-04-20T23:38:04+00:00", "year": 2023, "attachment_count": 0, "local_path": "issues/40064140", "has_markdown": true }, { "id": "40064112", "title": "Security: UAF in ReadAnythingAppController::OnAXTreeDistilled", "url": "https://issues.chromium.org/issues/40064112", "status": "Accepted", "severity": "S3-Low", "component": "UI>Accessibility", "reporter": "zh...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-04-19T13:59:43+00:00", "year": 2023, "attachment_count": 6, "local_path": "issues/40064112", "has_markdown": true }, { "id": "40064099", "title": "Security: Custom Tab Scroll Inference", "url": "https://issues.chromium.org/issues/40064099", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Scroll, UI>Browser>Mobile>CustomTabs", "reporter": "ph...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-04-18T20:02:26+00:00", "year": 2023, "attachment_count": 1, "local_path": "issues/40064099", "has_markdown": true }, { "id": "40064089", "title": "Security: cursor pointer can cover autofill prompt", "url": "https://issues.chromium.org/issues/40064089", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>Autofill", "reporter": "sa...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-04-18T14:51:04+00:00", "year": 2023, "attachment_count": 4, "local_path": "issues/40064089", "has_markdown": true }, { "id": "40064086", "title": "Security:heap-buffer-overflow in rewrite_1d_image_coordinate", "url": "https://issues.chromium.org/issues/40064086", "status": "Assigned", "severity": "S3-Low", "component": "Unknown", "reporter": "fi...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-04-18T09:20:51+00:00", "year": 2023, "attachment_count": 2, "local_path": "issues/40064086", "has_markdown": true }, { "id": "40064080", "title": "Security: arbitrary address write in allocate_temp_range", "url": "https://issues.chromium.org/issues/40064080", "status": "Assigned", "severity": "S3-Low", "component": "Unknown", "reporter": "fi...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-04-17T12:35:17+00:00", "year": 2023, "attachment_count": 2, "local_path": "issues/40064080", "has_markdown": true }, { "id": "40064072", "title": "Security: heap-use-after-free ui/ozone/platform/wayland/host/wayland_connection.cc", "url": "https://issues.chromium.org/issues/40064072", "status": "Assigned", "severity": "S3-Low", "component": "Internals>Ozone", "reporter": "rh...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-04-17T06:18:22+00:00", "year": 2023, "attachment_count": 4, "local_path": "issues/40064072", "has_markdown": true }, { "id": "40064067", "title": "Security: heap-use-after-free in vrend_draw_bind_abo_shader", "url": "https://issues.chromium.org/issues/40064067", "status": "Assigned", "severity": "S3-Low", "component": "Unknown", "reporter": "fi...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-04-16T03:40:38+00:00", "year": 2023, "attachment_count": 2, "local_path": "issues/40064067", "has_markdown": true }, { "id": "40064062", "title": "Security:stack buffer overflow in set_stream_out_varyings", "url": "https://issues.chromium.org/issues/40064062", "status": "Assigned", "severity": "S3-Low", "component": "Unknown", "reporter": "fi...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-04-15T13:27:53+00:00", "year": 2023, "attachment_count": 2, "local_path": "issues/40064062", "has_markdown": true }, { "id": "40064061", "title": "Security: Chrome OS i915 drm gpu driver create_clone UAF", "url": "https://issues.chromium.org/issues/40064061", "status": "Assigned", "severity": "S3-Low", "component": "Unknown", "reporter": "pi...@gmail.com", "cve_ids": [], "bounty_amount": 10000.0, "reward_amount_meta": 10000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-04-15T10:59:36+00:00", "year": 2023, "attachment_count": 2, "local_path": "issues/40064061", "has_markdown": true }, { "id": "40064054", "title": " heap-buffer-overflow in SavedTabGroup", "url": "https://issues.chromium.org/issues/40064054", "status": "Accepted", "severity": "S3-Low", "component": "UI>Browser>TopChrome>TabStrip>TabGroups", "reporter": "xp...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-04-14T16:52:26+00:00", "year": 2023, "attachment_count": 3, "local_path": "issues/40064054", "has_markdown": true }, { "id": "40064044", "title": "Security: use-after-poison libANGLE\\renderer\\d3d\\d3d11\\VertexBuffer11.cpp:129 in rx::VertexBuffer11::storeVertexAttributes", "url": "https://issues.chromium.org/issues/40064044", "status": "Assigned", "severity": "S3-Low", "component": "Blink>WebGL", "reporter": "m....@gmail.com", "cve_ids": [], "bounty_amount": 11000.0, "reward_amount_meta": 11000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-04-14T04:51:50+00:00", "year": 2023, "attachment_count": 9, "local_path": "issues/40064044", "has_markdown": true }, { "id": "40064002", "title": "Security: CSA_DCHECK failed: Torque assert 'IsConstructor(target)'", "url": "https://issues.chromium.org/issues/40064002", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript>Compiler", "reporter": "wh...@gmail.com", "cve_ids": [], "bounty_amount": 10000.0, "reward_amount_meta": 10000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-04-12T06:40:33+00:00", "year": 2023, "attachment_count": 4, "local_path": "issues/40064002", "has_markdown": true }, { "id": "40063918", "title": "Security: Picture in picture can hide fullscreen notification", "url": "https://issues.chromium.org/issues/40063918", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>FullScreen", "reporter": "sa...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-04-06T03:25:22+00:00", "year": 2023, "attachment_count": 3, "local_path": "issues/40063918", "has_markdown": true }, { "id": "40063907", "title": "Permission Tapjacking Is Possible In Android Custom Tabs", "url": "https://issues.chromium.org/issues/40063907", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>Mobile>CustomTabs, UI>Browser>Permissions>Prompts", "reporter": "le...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-04-05T17:03:21+00:00", "year": 2023, "attachment_count": 3, "local_path": "issues/40063907", "has_markdown": true }, { "id": "40063900", "title": "Security: heap-buffer-overflow on WebSQL sqlite3VdbeSorterInit", "url": "https://issues.chromium.org/issues/40063900", "status": "Assigned", "severity": "S4-Minimal", "component": "Internals>Storage", "reporter": "et...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-04-05T02:35:22+00:00", "year": 2023, "attachment_count": 2, "local_path": "issues/40063900", "has_markdown": true }, { "id": "40063894", "title": "Security: UAF in vrend_renderer_pipe_resource_set_type", "url": "https://issues.chromium.org/issues/40063894", "status": "Assigned", "severity": "S3-Low", "component": "Internals>GPU", "reporter": "fi...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-04-04T10:54:16+00:00", "year": 2023, "attachment_count": 3, "local_path": "issues/40063894", "has_markdown": true }, { "id": "40063893", "title": "Security: UAF in vrend_update_stencil_state", "url": "https://issues.chromium.org/issues/40063893", "status": "Assigned", "severity": "S3-Low", "component": "Internals>GPU>Internals", "reporter": "fi...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-04-04T03:39:44+00:00", "year": 2023, "attachment_count": 2, "local_path": "issues/40063893", "has_markdown": true }, { "id": "40063885", "title": "Security: Very long extension name spoofs debugging infobar and breaks other UI", "url": "https://issues.chromium.org/issues/40063885", "status": "Accepted", "severity": "S1-High", "component": "Platform>DevTools>Privacy and Security, Platform>Extensions", "reporter": "re...@gmail.com", "cve_ids": [], "bounty_amount": 500.0, "reward_amount_meta": 500.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-04-03T21:55:30+00:00", "year": 2023, "attachment_count": 11, "local_path": "issues/40063885", "has_markdown": true }, { "id": "40063880", "title": "Security: UAF in sampler_state", "url": "https://issues.chromium.org/issues/40063880", "status": "Assigned", "severity": "S3-Low", "component": "Unknown", "reporter": "fi...@gmail.com", "cve_ids": [], "bounty_amount": 10000.0, "reward_amount_meta": 10000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-04-03T15:23:41+00:00", "year": 2023, "attachment_count": 3, "local_path": "issues/40063880", "has_markdown": true }, { "id": "40063879", "title": "Security: heap-use-after-free on ash/drag_drop/tab_drag_drop_windows_hider.cc", "url": "https://issues.chromium.org/issues/40063879", "status": "Assigned", "severity": "S3-Low", "component": "Unknown", "reporter": "rh...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-04-03T14:46:53+00:00", "year": 2023, "attachment_count": 1, "local_path": "issues/40063879", "has_markdown": true }, { "id": "40063876", "title": "Security: Heap-use-after-free in SavedTabGroupButton::MoveGroupToNewWindowPressed", "url": "https://issues.chromium.org/issues/40063876", "status": "Accepted", "severity": "S3-Low", "component": "UI>Browser>TopChrome>TabStrip>TabGroups", "reporter": "me...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-04-03T08:52:45+00:00", "year": 2023, "attachment_count": 3, "local_path": "issues/40063876", "has_markdown": true }, { "id": "40063868", "title": "Apply Local Network Access permission to workers", "url": "https://issues.chromium.org/issues/40063868", "status": "Assigned", "severity": "S3-Low", "component": "Blink>SecurityFeature>DeprecatedPrivateNetworkAccess", "reporter": "ct...@chromium.org", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": null, "public_issue": true, "inclusion_reason": "award_text", "award_text_found": true, "created_date": "2023-04-02T02:48:52+00:00", "year": 2023, "attachment_count": 1, "local_path": "issues/40063868", "has_markdown": true }, { "id": "40063861", "title": "Security: Heap-use-after-free in views::View::VisibilityChangedImpl ", "url": "https://issues.chromium.org/issues/40063861", "status": "Accepted", "severity": "S3-Low", "component": "Platform>Extensions", "reporter": "ch...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-04-01T04:53:46+00:00", "year": 2023, "attachment_count": 3, "local_path": "issues/40063861", "has_markdown": true }, { "id": "40063839", "title": "Security: Memory corruption due to HeapVector iterator invalidation", "url": "https://issues.chromium.org/issues/40063839", "status": "Assigned", "severity": "S3-Low", "component": "Blink>ServiceWorker", "reporter": "jt...@gmail.com", "cve_ids": [], "bounty_amount": 8000.0, "reward_amount_meta": 8000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-03-30T10:19:35+00:00", "year": 2023, "attachment_count": 3, "local_path": "issues/40063839", "has_markdown": true }, { "id": "40063838", "title": "Security: Memory corruption due to accessing invalid context", "url": "https://issues.chromium.org/issues/40063838", "status": "Assigned", "severity": "S3-Low", "component": "Blink>ServiceWorker", "reporter": "jt...@gmail.com", "cve_ids": [], "bounty_amount": 8000.0, "reward_amount_meta": 8000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-03-30T10:01:42+00:00", "year": 2023, "attachment_count": 2, "local_path": "issues/40063838", "has_markdown": true }, { "id": "40063818", "title": "memory corruption in v8", "url": "https://issues.chromium.org/issues/40063818", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript>GarbageCollection", "reporter": "em...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-03-29T04:51:11+00:00", "year": 2023, "attachment_count": 2, "local_path": "issues/40063818", "has_markdown": true }, { "id": "40063810", "title": "Security: Chrome on IOS ignores Content-Type header when rendering XML and SVG content", "url": "https://issues.chromium.org/issues/40063810", "status": "Fixed", "severity": "S3-Low", "component": "Unknown", "reporter": "jo...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-03-28T22:04:57+00:00", "year": 2023, "attachment_count": 1, "local_path": "issues/40063810", "has_markdown": true }, { "id": "40063799", "title": "Security: Heap-use-after-free in ScreenAIService::TriggerProcessingNextTaskInQueue", "url": "https://issues.chromium.org/issues/40063799", "status": "Assigned", "severity": "S4-Minimal", "component": "UI>Accessibility, UI>Accessibility>MachineIntelligence", "reporter": "me...@gmail.com", "cve_ids": [], "bounty_amount": 11000.0, "reward_amount_meta": 11000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-03-28T03:16:11+00:00", "year": 2023, "attachment_count": 5, "local_path": "issues/40063799", "has_markdown": true }, { "id": "40063777", "title": "Security:UAF in content::SyntheticPointerAction::ForwardTouchOrMouseInputEvents(browser process)", "url": "https://issues.chromium.org/issues/40063777", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Input", "reporter": "0x...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-03-27T01:50:07+00:00", "year": 2023, "attachment_count": 4, "local_path": "issues/40063777", "has_markdown": true }, { "id": "40063770", "title": "Arbitrary OOB read and write with WebGL via SwiftShader", "url": "https://issues.chromium.org/issues/40063770", "status": "Assigned", "severity": "S3-Low", "component": "Blink>WebGL, Internals>GPU>ANGLE", "reporter": "ma...@gmail.com", "cve_ids": [], "bounty_amount": 10000.0, "reward_amount_meta": 10000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-03-26T10:34:26+00:00", "year": 2023, "attachment_count": 0, "local_path": "issues/40063770", "has_markdown": true }, { "id": "40063759", "title": "Security: UAF in extensions::SupervisedUserExtensionsDelegateImpl::ShowParentPermissionDialogForExtension", "url": "https://issues.chromium.org/issues/40063759", "status": "Accepted", "severity": "S3-Low", "component": "Platform>Extensions", "reporter": "zh...@gmail.com", "cve_ids": [], "bounty_amount": 4000.0, "reward_amount_meta": 4000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-03-25T09:55:09+00:00", "year": 2023, "attachment_count": 7, "local_path": "issues/40063759", "has_markdown": true }, { "id": "40063748", "title": "UAF in content::NavigationState::RunCommitSameDocumentNavigationCallback", "url": "https://issues.chromium.org/issues/40063748", "status": "Assigned", "severity": "S4-Minimal", "component": "UI>Browser>Navigation", "reporter": "em...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-03-24T15:21:13+00:00", "year": 2023, "attachment_count": 2, "local_path": "issues/40063748", "has_markdown": true }, { "id": "40063745", "title": "Chrome Crashpad arbitrary file create", "url": "https://issues.chromium.org/issues/40063745", "status": "Assigned", "severity": "S3-Low", "component": "Internals>Installer", "reporter": "yc...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-03-24T13:47:24+00:00", "year": 2023, "attachment_count": 0, "local_path": "issues/40063745", "has_markdown": true }, { "id": "40063741", "title": "Security: Error Path Double Free in __i915_gem_ttm_object_init", "url": "https://issues.chromium.org/issues/40063741", "status": "Assigned", "severity": "S3-Low", "component": "Internals>GPU", "reporter": "lm...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-03-24T07:07:56+00:00", "year": 2023, "attachment_count": 0, "local_path": "issues/40063741", "has_markdown": true }, { "id": "40063734", "title": "Heap-use-after-free in SavedTabGroupBar", "url": "https://issues.chromium.org/issues/40063734", "status": "Accepted", "severity": "S3-Low", "component": "UI>Browser>TopChrome>TabStrip>TabGroups", "reporter": "me...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-03-23T08:41:22+00:00", "year": 2023, "attachment_count": 3, "local_path": "issues/40063734", "has_markdown": true }, { "id": "40063731", "title": "Security: Race Condition UAF in l2cap_disconnect_req and l2cap_disconnect_rsp", "url": "https://issues.chromium.org/issues/40063731", "status": "Accepted", "severity": "S3-Low", "component": "Unknown", "reporter": "lm...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-03-23T04:00:00+00:00", "year": 2023, "attachment_count": 0, "local_path": "issues/40063731", "has_markdown": true }, { "id": "40063723", "title": "Security: Extensions with \"download\" permissions can read local files by using FSA API", "url": "https://issues.chromium.org/issues/40063723", "status": "Assigned", "severity": "S3-Low", "component": "Platform>Extensions>API, UI>Browser>Downloads", "reporter": "ha...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-03-22T13:50:31+00:00", "year": 2023, "attachment_count": 8, "local_path": "issues/40063723", "has_markdown": true }, { "id": "40063714", "title": "Security: Heap-use-after-free in ExclusiveAccessBubbleViews::UpdateBounds", "url": "https://issues.chromium.org/issues/40063714", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser", "reporter": "ch...@gmail.com", "cve_ids": [], "bounty_amount": 10000.0, "reward_amount_meta": 10000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-03-21T16:49:02+00:00", "year": 2023, "attachment_count": 2, "local_path": "issues/40063714", "has_markdown": true }, { "id": "40063713", "title": "Security: Heap-use-after-free in ash::DeskMiniView::UpdateDeskButtonVisibility", "url": "https://issues.chromium.org/issues/40063713", "status": "Assigned", "severity": "S3-Low", "component": "UI>Shell", "reporter": "ch...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-03-21T16:44:54+00:00", "year": 2023, "attachment_count": 2, "local_path": "issues/40063713", "has_markdown": true }, { "id": "40063703", "title": "Security: Heap-use-after-free in ProfileTokenNavigationThrottle::WillProcessRespons ", "url": "https://issues.chromium.org/issues/40063703", "status": "Accepted", "severity": "S3-Low", "component": "Enterprise", "reporter": "me...@gmail.com", "cve_ids": [], "bounty_amount": 4000.0, "reward_amount_meta": 4000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-03-21T07:59:18+00:00", "year": 2023, "attachment_count": 6, "local_path": "issues/40063703", "has_markdown": true }, { "id": "40063688", "title": "Security: UAF in blink::MLGraphXnnpack::ComputeOnBackgroundThread", "url": "https://issues.chromium.org/issues/40063688", "status": "Assigned", "severity": "S3-Low", "component": "Blink>WebML", "reporter": "m....@gmail.com", "cve_ids": [], "bounty_amount": 8000.0, "reward_amount_meta": 8000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-03-20T13:57:44+00:00", "year": 2023, "attachment_count": 2, "local_path": "issues/40063688", "has_markdown": true }, { "id": "40063673", "title": "Security: segv in JsonStringifier::SerializeString", "url": "https://issues.chromium.org/issues/40063673", "status": "Accepted", "severity": "S4-Minimal", "component": "Blink>JavaScript>API, Blink>JavaScript>GarbageCollection, Blink>JavaScript>Runtime", "reporter": "wh...@gmail.com", "cve_ids": [], "bounty_amount": 8000.0, "reward_amount_meta": 8000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-03-20T01:49:06+00:00", "year": 2023, "attachment_count": 2, "local_path": "issues/40063673", "has_markdown": true }, { "id": "40063655", "title": "Security: Race Condition UAF in evdi_gem_create", "url": "https://issues.chromium.org/issues/40063655", "status": "Assigned", "severity": "S3-Low", "component": "OS>Packages", "reporter": "lm...@gmail.com", "cve_ids": [], "bounty_amount": 11000.0, "reward_amount_meta": 11000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-03-18T07:59:19+00:00", "year": 2023, "attachment_count": 2, "local_path": "issues/40063655", "has_markdown": true }, { "id": "40063635", "title": "Security: UAF in MLGraphXnnpack::BuildOnBackgroundThread", "url": "https://issues.chromium.org/issues/40063635", "status": "Fixed", "severity": "S3-Low", "component": "Blink>WebML", "reporter": "m....@gmail.com", "cve_ids": [], "bounty_amount": 11000.0, "reward_amount_meta": 11000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-03-17T10:18:51+00:00", "year": 2023, "attachment_count": 3, "local_path": "issues/40063635", "has_markdown": true }, { "id": "40063634", "title": "Security: Intent URLs also bypass CSP sandbox with \"allow-popups\" set", "url": "https://issues.chromium.org/issues/40063634", "status": "Assigned", "severity": "S3-Low", "component": "Blink>SecurityFeature, Mobile>Intents", "reporter": "ha...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-03-17T09:03:41+00:00", "year": 2023, "attachment_count": 1, "local_path": "issues/40063634", "has_markdown": true }, { "id": "40063633", "title": "Security: Heap-use-after-free in LocalTabGroupListener::AddWebContents ", "url": "https://issues.chromium.org/issues/40063633", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>TopChrome>TabStrip>TabGroups", "reporter": "me...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-03-17T07:47:43+00:00", "year": 2023, "attachment_count": 3, "local_path": "issues/40063633", "has_markdown": true }, { "id": "40063621", "title": "Security: UAF in base::ObserverListBrowser>Profiles, UI>Shell", "reporter": "0x...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-03-16T12:17:57+00:00", "year": 2023, "attachment_count": 0, "local_path": "issues/40063621", "has_markdown": true }, { "id": "40063617", "title": "Security: Heap-use-after-free in TabGroupModel::GetTabGroup", "url": "https://issues.chromium.org/issues/40063617", "status": "Accepted", "severity": "S3-Low", "component": "UI>Browser>TopChrome>TabStrip>TabGroups", "reporter": "me...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-03-16T07:39:39+00:00", "year": 2023, "attachment_count": 3, "local_path": "issues/40063617", "has_markdown": true }, { "id": "40063616", "title": "Security: Debug check failed: IsSweepingInProgress()", "url": "https://issues.chromium.org/issues/40063616", "status": "Accepted", "severity": "S3-Low", "component": "Blink>JavaScript>GarbageCollection", "reporter": "wh...@gmail.com", "cve_ids": [], "bounty_amount": 8000.0, "reward_amount_meta": 8000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-03-16T01:45:03+00:00", "year": 2023, "attachment_count": 1, "local_path": "issues/40063616", "has_markdown": true }, { "id": "40063589", "title": "UAF in DevToolsAgentHostImpl::ForceDetachAllSessions(with headless mode and puppeteer) ", "url": "https://issues.chromium.org/issues/40063589", "status": "Assigned", "severity": "S3-Low", "component": "Platform>DevTools", "reporter": "em...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-03-14T10:14:47+00:00", "year": 2023, "attachment_count": 5, "local_path": "issues/40063589", "has_markdown": true }, { "id": "40063581", "title": "Security: out of bound read in vfd_out_locked", "url": "https://issues.chromium.org/issues/40063581", "status": "Assigned", "severity": "S3-Low", "component": "Unknown", "reporter": "sy...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-03-14T04:48:51+00:00", "year": 2023, "attachment_count": 0, "local_path": "issues/40063581", "has_markdown": true }, { "id": "40063579", "title": "Security: Race Condition UAF in radeon_gem_set_domain_ioctl", "url": "https://issues.chromium.org/issues/40063579", "status": "Accepted", "severity": "S3-Low", "component": "Internals>GPU>VendorSpecific", "reporter": "lm...@gmail.com", "cve_ids": [], "bounty_amount": 250.0, "reward_amount_meta": 250.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-03-14T03:48:37+00:00", "year": 2023, "attachment_count": 1, "local_path": "issues/40063579", "has_markdown": true }, { "id": "40063572", "title": "LAN9500, LAN75xx driver information leak", "url": "https://issues.chromium.org/issues/40063572", "status": "Accepted", "severity": "S3-Low", "component": "Internals>Core", "reporter": "sz...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-03-13T20:53:55+00:00", "year": 2023, "attachment_count": 2, "local_path": "issues/40063572", "has_markdown": true }, { "id": "40063547", "title": "Security: heap-use-after-free in extensions::NativeExtensionBindingsSystem::HandleResponse", "url": "https://issues.chromium.org/issues/40063547", "status": "Assigned", "severity": "S4-Minimal", "component": "Blink>ServiceWorker, Platform>Extensions", "reporter": "st...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-03-11T19:19:07+00:00", "year": 2023, "attachment_count": 3, "local_path": "issues/40063547", "has_markdown": true }, { "id": "40063545", "title": "Security: OOB Access in intel_pxp_sm_ioctl_mark_session_in_play", "url": "https://issues.chromium.org/issues/40063545", "status": "Assigned", "severity": "S4-Minimal", "component": "Internals>GPU>VendorSpecific", "reporter": "lm...@gmail.com", "cve_ids": [], "bounty_amount": 16000.0, "reward_amount_meta": 16000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-03-11T12:20:36+00:00", "year": 2023, "attachment_count": 2, "local_path": "issues/40063545", "has_markdown": true }, { "id": "40063542", "title": "Security: SEGV_ACCERR in v8", "url": "https://issues.chromium.org/issues/40063542", "status": "Accepted", "severity": "S3-Low", "component": "Blink>JavaScript>Compiler>Maglev", "reporter": "ki...@gmail.com", "cve_ids": [], "bounty_amount": 21000.0, "reward_amount_meta": 21000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-03-11T07:05:25+00:00", "year": 2023, "attachment_count": 6, "local_path": "issues/40063542", "has_markdown": true }, { "id": "40063511", "title": "Security: Permission bypass due to not erase request properly", "url": "https://issues.chromium.org/issues/40063511", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>Permissions>Prompts", "reporter": "jt...@gmail.com", "cve_ids": [], "bounty_amount": 7500.0, "reward_amount_meta": 7500.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-03-10T10:37:50+00:00", "year": 2023, "attachment_count": 1, "local_path": "issues/40063511", "has_markdown": true }, { "id": "40063506", "title": "Security: ChromeOS: Local privilege escalation due to use-after-free in u32 classifier", "url": "https://issues.chromium.org/issues/40063506", "status": "Assigned", "severity": "S3-Low", "component": "Unknown", "reporter": "mg...@gmail.com", "cve_ids": [], "bounty_amount": 500.0, "reward_amount_meta": 500.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-03-10T07:36:08+00:00", "year": 2023, "attachment_count": 2, "local_path": "issues/40063506", "has_markdown": true }, { "id": "40063505", "title": "Security: Bypass https://chromium-review.googlesource.com/c/chromium/src/+/4294941 using upper-cased file: protocol (Source maps support for file:// URLs gives devtools_page extensions local file access)", "url": "https://issues.chromium.org/issues/40063505", "status": "Assigned", "severity": "S3-Low", "component": "Platform>Extensions", "reporter": "ha...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-03-10T06:35:49+00:00", "year": 2023, "attachment_count": 8, "local_path": "issues/40063505", "has_markdown": true }, { "id": "40063469", "title": "UAF in v8_inspector", "url": "https://issues.chromium.org/issues/40063469", "status": "Assigned", "severity": "S3-Low", "component": "Unknown", "reporter": "he...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-03-09T02:29:54+00:00", "year": 2023, "attachment_count": 3, "local_path": "issues/40063469", "has_markdown": true }, { "id": "40063458", "title": "Heap-use-after-free in blink::NGTextDecorationPainter::UpdateDecorationInfo", "url": "https://issues.chromium.org/issues/40063458", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Paint", "reporter": "m....@gmail.com", "cve_ids": [], "bounty_amount": 11000.0, "reward_amount_meta": 11000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-03-08T10:36:53+00:00", "year": 2023, "attachment_count": 1, "local_path": "issues/40063458", "has_markdown": true }, { "id": "40063438", "title": "Security: Using popups, Incognito Mode-specific external protocol prompts can be overlaid on other origins on Android.", "url": "https://issues.chromium.org/issues/40063438", "status": "Fixed", "severity": "S3-Low", "component": "Mobile>Intents, UI>Browser>Incognito", "reporter": "ha...@gmail.com", "cve_ids": [], "bounty_amount": 500.0, "reward_amount_meta": 500.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-03-07T16:06:15+00:00", "year": 2023, "attachment_count": 0, "local_path": "issues/40063438", "has_markdown": true }, { "id": "40063434", "title": "Security: Race Condition UAF in evdi_painter_mode_changed_notify", "url": "https://issues.chromium.org/issues/40063434", "status": "Assigned", "severity": "S3-Low", "component": "Unknown", "reporter": "lm...@gmail.com", "cve_ids": [], "bounty_amount": 6000.0, "reward_amount_meta": 6000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-03-07T14:40:59+00:00", "year": 2023, "attachment_count": 1, "local_path": "issues/40063434", "has_markdown": true }, { "id": "40063426", "title": "Security DCHECK failed: IsA(from) blink::TimelineOffset::Create timeline_offset.cc:82", "url": "https://issues.chromium.org/issues/40063426", "status": "Fixed", "severity": "S4-Minimal", "component": "Blink>Animation", "reporter": "m....@gmail.com", "cve_ids": [], "bounty_amount": 8000.0, "reward_amount_meta": 8000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-03-07T02:53:28+00:00", "year": 2023, "attachment_count": 2, "local_path": "issues/40063426", "has_markdown": true }, { "id": "40063412", "title": "Security: use-after-free in ManagePasswordsUIController::OnChooseCredentials", "url": "https://issues.chromium.org/issues/40063412", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>Passwords", "reporter": "du...@gmail.com", "cve_ids": [], "bounty_amount": 10000.0, "reward_amount_meta": 10000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-03-06T16:29:25+00:00", "year": 2023, "attachment_count": 18, "local_path": "issues/40063412", "has_markdown": true }, { "id": "40063372", "title": "Crash in Builtins_StoreTypedElementJSAny_Int16Elements_0", "url": "https://issues.chromium.org/issues/40063372", "status": "Accepted", "severity": "S4-Minimal", "component": "Blink>JavaScript>API, Blink>JavaScript>Runtime", "reporter": "wh...@gmail.com", "cve_ids": [], "bounty_amount": 9000.0, "reward_amount_meta": 9000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-03-04T03:15:13+00:00", "year": 2023, "attachment_count": 1, "local_path": "issues/40063372", "has_markdown": true }, { "id": "40063342", "title": "ServiceWorkers in credentialless iframes could access long lived cookies", "url": "https://issues.chromium.org/issues/40063342", "status": "Assigned", "severity": "S3-Low", "component": "Blink>SecurityFeature>AnonymousIframe, Blink>ServiceWorker, Internals>Network>Cookies>PartitionedCookies, Internals>Sandbox>SiteIsolation", "reporter": "ma...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-03-02T08:55:38+00:00", "year": 2023, "attachment_count": 3, "local_path": "issues/40063342", "has_markdown": true }, { "id": "40063314", "title": "Security: heap-use-after-free in blink::WebString::WebString", "url": "https://issues.chromium.org/issues/40063314", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Input", "reporter": "st...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-03-01T06:48:37+00:00", "year": 2023, "attachment_count": 4, "local_path": "issues/40063314", "has_markdown": true }, { "id": "40063293", "title": "Security: Chrome Vulnerability Leaves Android One UI Users at Risk of Spoofing Attacks", "url": "https://issues.chromium.org/issues/40063293", "status": "Accepted", "severity": "S3-Low", "component": "Blink>Fullscreen", "reporter": "fa...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-02-28T13:19:06+00:00", "year": 2023, "attachment_count": 3, "local_path": "issues/40063293", "has_markdown": true }, { "id": "40063285", "title": "Security: Double-free in libwebp WebPEncode (with alpha) under OOM condition", "url": "https://issues.chromium.org/issues/40063285", "status": "Assigned", "severity": "S3-Low", "component": "Internals>Images>Codecs", "reporter": "su...@gmail.com", "cve_ids": [], "bounty_amount": 1337.0, "reward_amount_meta": 1337.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-02-28T01:02:01+00:00", "year": 2023, "attachment_count": 0, "local_path": "issues/40063285", "has_markdown": true }, { "id": "40063272", "title": "Security: PDFium UAF vulns", "url": "https://issues.chromium.org/issues/40063272", "status": "Assigned", "severity": "S3-Low", "component": "Internals>Plugins>PDF", "reporter": "se...@ncsc.gov.uk", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-02-27T11:30:02+00:00", "year": 2023, "attachment_count": 3, "local_path": "issues/40063272", "has_markdown": true }, { "id": "40063268", "title": "Security: Heap-use-after-free in UserNotesPageHandler::GetNoteOverviews", "url": "https://issues.chromium.org/issues/40063268", "status": "Accepted", "severity": "S3-Low", "component": "UI>Browser>TopChrome>SidePanel", "reporter": "me...@gmail.com", "cve_ids": [], "bounty_amount": 4000.0, "reward_amount_meta": 4000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-02-27T07:02:21+00:00", "year": 2023, "attachment_count": 2, "local_path": "issues/40063268", "has_markdown": true }, { "id": "40063259", "title": "Bypass 1349146, local file access checks can be bypassed by using `file:` instead of `file://`", "url": "https://issues.chromium.org/issues/40063259", "status": "Assigned", "severity": "S3-Low", "component": "Platform>Extensions", "reporter": "ma...@fingerprint.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-02-26T22:16:27+00:00", "year": 2023, "attachment_count": 4, "local_path": "issues/40063259", "has_markdown": true }, { "id": "40063257", "title": "Security: web HID memory corruption bug", "url": "https://issues.chromium.org/issues/40063257", "status": "Assigned", "severity": "S3-Low", "component": "Blink>HID", "reporter": "mo...@gmail.com", "cve_ids": [], "bounty_amount": 8000.0, "reward_amount_meta": 8000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-02-26T16:19:35+00:00", "year": 2023, "attachment_count": 2, "local_path": "issues/40063257", "has_markdown": true }, { "id": "40063230", "title": "Security: After refactor, page can use EyeDropper API to bypass mouse movement/keyboard input requirements for autofill (regression of issue 1287364)", "url": "https://issues.chromium.org/issues/40063230", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>Autofill", "reporter": "al...@alesandroortiz.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-02-24T01:35:41+00:00", "year": 2023, "attachment_count": 2, "local_path": "issues/40063230", "has_markdown": true }, { "id": "40063209", "title": "Security: heap-use-after-free worker_thread.cc:671 in blink::WorkerThread::InitializeOnWorkerThread", "url": "https://issues.chromium.org/issues/40063209", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Workers", "reporter": "m....@gmail.com", "cve_ids": [], "bounty_amount": 8000.0, "reward_amount_meta": 8000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-02-23T02:58:40+00:00", "year": 2023, "attachment_count": 4, "local_path": "issues/40063209", "has_markdown": true }, { "id": "40063208", "title": "Security: Document PIP inherits wrong origin when opened from an extension popup", "url": "https://issues.chromium.org/issues/40063208", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Media>PictureInPicture", "reporter": "st...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-02-23T01:29:21+00:00", "year": 2023, "attachment_count": 5, "local_path": "issues/40063208", "has_markdown": true }, { "id": "40063194", "title": "Security: String with different encoding mismatch, leading Out-of-bounds access.", "url": "https://issues.chromium.org/issues/40063194", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Bindings", "reporter": "sh...@alibaba-inc.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-02-22T04:38:27+00:00", "year": 2023, "attachment_count": 4, "local_path": "issues/40063194", "has_markdown": true }, { "id": "40063183", "title": "Security: Chrome on Android can self-intent into CCT, allowing sandboxed iframe allow-popups-to-escape-sandbox bypass.", "url": "https://issues.chromium.org/issues/40063183", "status": "Assigned", "severity": "S3-Low", "component": "Blink>SecurityFeature>IFrameSandbox, Mobile>Intents", "reporter": "ha...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-02-21T17:11:59+00:00", "year": 2023, "attachment_count": 0, "local_path": "issues/40063183", "has_markdown": true }, { "id": "40063167", "title": "Security: UAF in simple_devtools_protocol_client::SimpleDevToolsProtocolClient::DispatchProtocolMessageTask(", "url": "https://issues.chromium.org/issues/40063167", "status": "Assigned", "severity": "S3-Low", "component": "Internals>Headless", "reporter": "wh...@gmail.com", "cve_ids": [], "bounty_amount": 4000.0, "reward_amount_meta": 4000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-02-20T16:01:16+00:00", "year": 2023, "attachment_count": 3, "local_path": "issues/40063167", "has_markdown": true }, { "id": "40063148", "title": "[Security] V8 Debug check failed: OFFSET_OF(Isolate, string_stream_current_security_token_) == strin", "url": "https://issues.chromium.org/issues/40063148", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript", "reporter": "vi...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-02-18T10:48:15+00:00", "year": 2023, "attachment_count": 1, "local_path": "issues/40063148", "has_markdown": true }, { "id": "40063139", "title": "Security: Safe Browsing bypass via data URI, no warning if SB fails", "url": "https://issues.chromium.org/issues/40063139", "status": "Assigned", "severity": "S3-Low", "component": "Unknown", "reporter": "ym...@ym.kim", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-02-17T22:54:55+00:00", "year": 2023, "attachment_count": 4, "local_path": "issues/40063139", "has_markdown": true }, { "id": "40063132", "title": "Security: Security DCHECK failed: IsA(from) blink::StylePropertyMap::append style_property_map.cc:384", "url": "https://issues.chromium.org/issues/40063132", "status": "Assigned", "severity": "S3-Low", "component": "Blink>CSS", "reporter": "m....@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-02-17T13:35:08+00:00", "year": 2023, "attachment_count": 1, "local_path": "issues/40063132", "has_markdown": true }, { "id": "40063128", "title": "Security: UAF when code runs after NavigationThrottle's Resume() or CancelDeferredNavigation() are called", "url": "https://issues.chromium.org/issues/40063128", "status": "New", "severity": "S3-Low", "component": "Internals>Sandbox>SiteIsolation, UI>Browser>Navigation", "reporter": "jt...@gmail.com", "cve_ids": [], "bounty_amount": 10000.0, "reward_amount_meta": 10000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-02-17T09:56:04+00:00", "year": 2023, "attachment_count": 0, "local_path": "issues/40063128", "has_markdown": true }, { "id": "40063127", "title": "Security: UAF in PlatformAuthNavigationThrottle::FetchHeadersCallback", "url": "https://issues.chromium.org/issues/40063127", "status": "New", "severity": "S3-Low", "component": "Enterprise", "reporter": "jt...@gmail.com", "cve_ids": [], "bounty_amount": 38000.0, "reward_amount_meta": 38000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-02-17T08:56:57+00:00", "year": 2023, "attachment_count": 7, "local_path": "issues/40063127", "has_markdown": true }, { "id": "40063071", "title": "Security: Document PiP window can be resized and moved by compromised renderer, user can interact with sensitive UI using keyboard without being aware", "url": "https://issues.chromium.org/issues/40063071", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Media>PictureInPicture", "reporter": "al...@alesandroortiz.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-02-14T23:52:04+00:00", "year": 2023, "attachment_count": 3, "local_path": "issues/40063071", "has_markdown": true }, { "id": "40063068", "title": "Security: Document PiP can spoof top-level page origin, show attacker content in PiP window, open PiP windows from iframes", "url": "https://issues.chromium.org/issues/40063068", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Media>PictureInPicture", "reporter": "al...@alesandroortiz.com", "cve_ids": [], "bounty_amount": 4000.0, "reward_amount_meta": 4000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-02-14T22:19:15+00:00", "year": 2023, "attachment_count": 4, "local_path": "issues/40063068", "has_markdown": true }, { "id": "40063055", "title": "UAF in permissions::PermissionRequest::request_type", "url": "https://issues.chromium.org/issues/40063055", "status": "New", "severity": "S3-Low", "component": "UI>Browser>Permissions>Prompts", "reporter": "ha...@gmail.com", "cve_ids": [], "bounty_amount": 41000.0, "reward_amount_meta": 41000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-02-13T17:10:18+00:00", "year": 2023, "attachment_count": 8, "local_path": "issues/40063055", "has_markdown": true }, { "id": "40063051", "title": "Security: TALOS-2023-1724 - Google Chrome WebGL rx::Image11::disassociateStorage use-after-free vulnerability ", "url": "https://issues.chromium.org/issues/40063051", "status": "Assigned", "severity": "S3-Low", "component": "Blink>WebGL, Internals>GPU>ANGLE", "reporter": "pi...@thelead82.com", "cve_ids": [], "bounty_amount": 15000.0, "reward_amount_meta": 15000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-02-13T15:08:47+00:00", "year": 2023, "attachment_count": 2, "local_path": "issues/40063051", "has_markdown": true }, { "id": "40063041", "title": "Security: Fullscreen Confusion Attack in Chrome with Mail Application", "url": "https://issues.chromium.org/issues/40063041", "status": "Accepted", "severity": "S3-Low", "component": "Blink>Fullscreen", "reporter": "fa...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-02-12T13:04:03+00:00", "year": 2023, "attachment_count": 3, "local_path": "issues/40063041", "has_markdown": true }, { "id": "40063040", "title": "Security: Uninitialized Pointer in `msm_parse_post_deps`", "url": "https://issues.chromium.org/issues/40063040", "status": "Assigned", "severity": "S3-Low", "component": "Internals>GPU>VendorSpecific", "reporter": "lm...@gmail.com", "cve_ids": [], "bounty_amount": 16000.0, "reward_amount_meta": 16000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-02-12T11:46:34+00:00", "year": 2023, "attachment_count": 1, "local_path": "issues/40063040", "has_markdown": true }, { "id": "40063029", "title": "Security: Possible UAF in PinManager::NotifyDelete", "url": "https://issues.chromium.org/issues/40063029", "status": "Assigned", "severity": "S3-Low", "component": "UI>Shell", "reporter": "zh...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-02-11T13:17:40+00:00", "year": 2023, "attachment_count": 2, "local_path": "issues/40063029", "has_markdown": true }, { "id": "40063023", "title": "Security: Document PIP origin spoof", "url": "https://issues.chromium.org/issues/40063023", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Media>PictureInPicture, UI>Browser>Navigation", "reporter": "st...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-02-11T05:37:30+00:00", "year": 2023, "attachment_count": 2, "local_path": "issues/40063023", "has_markdown": true }, { "id": "40063021", "title": "Security: Android file picker dialog can be shown over a different tab", "url": "https://issues.chromium.org/issues/40063021", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Forms>File, UI>Browser>Navigation", "reporter": "st...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-02-10T23:50:03+00:00", "year": 2023, "attachment_count": 3, "local_path": "issues/40063021", "has_markdown": true }, { "id": "40063014", "title": "LZ and ZST files which are another form of Archive file is missing into the gesture file types", "url": "https://issues.chromium.org/issues/40063014", "status": "Accepted", "severity": "S3-Low", "component": "Unknown", "reporter": "sm...@gmail.com", "cve_ids": [], "bounty_amount": 500.0, "reward_amount_meta": 500.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-02-10T16:32:10+00:00", "year": 2023, "attachment_count": 1, "local_path": "issues/40063014", "has_markdown": true }, { "id": "40063010", "title": "Security: UAF in AppFinder::OnGetAppDescriptions", "url": "https://issues.chromium.org/issues/40063010", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Payments", "reporter": "jt...@gmail.com", "cve_ids": [], "bounty_amount": 31000.0, "reward_amount_meta": 31000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-02-10T11:23:07+00:00", "year": 2023, "attachment_count": 4, "local_path": "issues/40063010", "has_markdown": true }, { "id": "40063005", "title": "Security: Heap-use-after-free in ash::WizardController::HandleAccelerator", "url": "https://issues.chromium.org/issues/40063005", "status": "Assigned", "severity": "S3-Low", "component": "UI>Shell", "reporter": "ch...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-02-09T23:43:00+00:00", "year": 2023, "attachment_count": 1, "local_path": "issues/40063005", "has_markdown": true }, { "id": "40063002", "title": "Security: ChromeOS root privilege escalation (mount-passthrough-jailed)", "url": "https://issues.chromium.org/issues/40063002", "status": "Assigned", "severity": "S3-Low", "component": "Unknown", "reporter": "ro...@rorym.cnamara.com", "cve_ids": [], "bounty_amount": 31000.0, "reward_amount_meta": 31000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-02-09T20:51:43+00:00", "year": 2023, "attachment_count": 1, "local_path": "issues/40063002", "has_markdown": true }, { "id": "40062996", "title": "Security: Bypass Issue 1385343 Extension with permission can read arbitrary local files although (Allow access to file URLs) is disabled", "url": "https://issues.chromium.org/issues/40062996", "status": "Assigned", "severity": "S3-Low", "component": "Platform>Extensions>API", "reporter": "el...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-02-09T14:56:53+00:00", "year": 2023, "attachment_count": 4, "local_path": "issues/40062996", "has_markdown": true }, { "id": "40062988", "title": "UAF in aura::Window", "url": "https://issues.chromium.org/issues/40062988", "status": "Assigned", "severity": "S3-Low", "component": "Internals>Aura", "reporter": "he...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-02-09T06:29:12+00:00", "year": 2023, "attachment_count": 1, "local_path": "issues/40062988", "has_markdown": true }, { "id": "40062970", "title": "Security: Heap-buffer-overflow in FrameSinkManagerImpl::UnregisterFrameSinkHierarchy", "url": "https://issues.chromium.org/issues/40062970", "status": "Assigned", "severity": "S3-Low", "component": "Internals>Services>Viz", "reporter": "me...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-02-08T10:52:40+00:00", "year": 2023, "attachment_count": 5, "local_path": "issues/40062970", "has_markdown": true }, { "id": "40062962", "title": "Security: Security DCHECK failed: IsA(from) blink::LayoutMultiColumnFlowThread::ComputeSize layout_multi_column_flow_thread.cc:1666", "url": "https://issues.chromium.org/issues/40062962", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Layout", "reporter": "m....@gmail.com", "cve_ids": [], "bounty_amount": 8000.0, "reward_amount_meta": 8000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-02-08T02:53:43+00:00", "year": 2023, "attachment_count": 4, "local_path": "issues/40062962", "has_markdown": true }, { "id": "40062959", "title": "documentPictureInPicture UI spoof via opener", "url": "https://issues.chromium.org/issues/40062959", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Media>PictureInPicture, UI>Browser>Navigation", "reporter": "nd...@protonmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-02-08T01:34:08+00:00", "year": 2023, "attachment_count": 2, "local_path": "issues/40062959", "has_markdown": true }, { "id": "40062954", "title": "Fenced frame spoof documentPictureInPicture", "url": "https://issues.chromium.org/issues/40062954", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Media>PictureInPicture", "reporter": "nd...@protonmail.com", "cve_ids": [], "bounty_amount": 4000.0, "reward_amount_meta": 4000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-02-07T19:53:25+00:00", "year": 2023, "attachment_count": 0, "local_path": "issues/40062954", "has_markdown": true }, { "id": "40062949", "title": "Security: UAF in void perfetto::DataSourceTracing", "reporter": "0x...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-02-07T13:53:34+00:00", "year": 2023, "attachment_count": 1, "local_path": "issues/40062949", "has_markdown": true }, { "id": "40062944", "title": "Security: use-after-poison rtp_contributing_source_cache.cc:215 in blink::RtpContributingSourceCache::ClearCache", "url": "https://issues.chromium.org/issues/40062944", "status": "Assigned", "severity": "S3-Low", "component": "Blink>WebRTC>PeerConnection", "reporter": "m....@gmail.com", "cve_ids": [], "bounty_amount": 4000.0, "reward_amount_meta": 4000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-02-07T09:05:18+00:00", "year": 2023, "attachment_count": 3, "local_path": "issues/40062944", "has_markdown": true }, { "id": "40062941", "title": "Security: Bug 1238631 regression (Share dialog on Windows can render over address bar, window controls)", "url": "https://issues.chromium.org/issues/40062941", "status": "Accepted", "severity": "S3-Low", "component": "Blink>WebShare", "reporter": "ha...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-02-07T08:16:32+00:00", "year": 2023, "attachment_count": 4, "local_path": "issues/40062941", "has_markdown": true }, { "id": "40062938", "title": "Security: Android permission prompt tapjacking", "url": "https://issues.chromium.org/issues/40062938", "status": "Accepted", "severity": "S3-Low", "component": "UI>Browser>Permissions>Prompts", "reporter": "st...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-02-07T03:45:04+00:00", "year": 2023, "attachment_count": 4, "local_path": "issues/40062938", "has_markdown": true }, { "id": "40062927", "title": "Security: Race Condition UAF in hci_cmd_sync_work(2)", "url": "https://issues.chromium.org/issues/40062927", "status": "Assigned", "severity": "S3-Low", "component": "Unknown", "reporter": "lm...@gmail.com", "cve_ids": [], "bounty_amount": 4000.0, "reward_amount_meta": 4000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-02-06T06:36:56+00:00", "year": 2023, "attachment_count": 2, "local_path": "issues/40062927", "has_markdown": true }, { "id": "40062919", "title": "Security: Race Condition UAF in hci_cmd_sync_work", "url": "https://issues.chromium.org/issues/40062919", "status": "Assigned", "severity": "S3-Low", "component": "Platform", "reporter": "lm...@gmail.com", "cve_ids": [], "bounty_amount": 8500.0, "reward_amount_meta": 8500.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-02-05T12:09:49+00:00", "year": 2023, "attachment_count": 3, "local_path": "issues/40062919", "has_markdown": true }, { "id": "40062915", "title": "Security: A UAF in WebRTC", "url": "https://issues.chromium.org/issues/40062915", "status": "Assigned", "severity": "S3-Low", "component": "Blink>WebRTC, Internals>Media>ScreenCapture", "reporter": "om...@talon-sec.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-02-04T22:56:21+00:00", "year": 2023, "attachment_count": 7, "local_path": "issues/40062915", "has_markdown": true }, { "id": "40062907", "title": "Security: use of uninitialized member variable in omnibox_popup_view_views.cc:575", "url": "https://issues.chromium.org/issues/40062907", "status": "Fixed", "severity": "S3-Low", "component": "UI>Browser>Omnibox", "reporter": "m....@gmail.com", "cve_ids": [], "bounty_amount": 4000.0, "reward_amount_meta": 4000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-02-04T10:09:30+00:00", "year": 2023, "attachment_count": 2, "local_path": "issues/40062907", "has_markdown": true }, { "id": "40062893", "title": "Security: stack-buffer-overflow in crashpad ", "url": "https://issues.chromium.org/issues/40062893", "status": "Assigned", "severity": "S3-Low", "component": "Internals>CrashReporting", "reporter": "su...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-02-03T03:07:54+00:00", "year": 2023, "attachment_count": 0, "local_path": "issues/40062893", "has_markdown": true }, { "id": "40062890", "title": "type mismatch with turboshaft,1 vs NaN", "url": "https://issues.chromium.org/issues/40062890", "status": "Accepted", "severity": "S3-Low", "component": "Blink>JavaScript>Compiler>Turbofan", "reporter": "5n...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-02-03T01:03:28+00:00", "year": 2023, "attachment_count": 2, "local_path": "issues/40062890", "has_markdown": true }, { "id": "40062884", "title": "Security: Type confusion in v8 value serializer", "url": "https://issues.chromium.org/issues/40062884", "status": "Assigned", "severity": "S4-Minimal", "component": "Blink>JavaScript>Runtime", "reporter": "m-...@github.com", "cve_ids": [], "bounty_amount": 10000.0, "reward_amount_meta": 10000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-02-02T17:46:42+00:00", "year": 2023, "attachment_count": 2, "local_path": "issues/40062884", "has_markdown": true }, { "id": "40062875", "title": "v8 oob read in turboshaft::Graph::IncrementInputUses", "url": "https://issues.chromium.org/issues/40062875", "status": "Accepted", "severity": "S4-Minimal", "component": "Blink>JavaScript>Compiler>Turbofan", "reporter": "5n...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-02-02T09:51:36+00:00", "year": 2023, "attachment_count": 2, "local_path": "issues/40062875", "has_markdown": true }, { "id": "40062849", "title": "heap-use-after-free in Read Anything", "url": "https://issues.chromium.org/issues/40062849", "status": "Accepted", "severity": "S3-Low", "component": "UI>Accessibility", "reporter": "xp...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-01-31T22:54:40+00:00", "year": 2023, "attachment_count": 2, "local_path": "issues/40062849", "has_markdown": true }, { "id": "40062839", "title": "Segv on unknown address in v8::internal::TracedHandlesImpl::Create", "url": "https://issues.chromium.org/issues/40062839", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript>API, Blink>JavaScript>GarbageCollection, Blink>ViewTransitions", "reporter": "m....@gmail.com", "cve_ids": [], "bounty_amount": 9000.0, "reward_amount_meta": 9000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-01-31T03:13:19+00:00", "year": 2023, "attachment_count": 0, "local_path": "issues/40062839", "has_markdown": true }, { "id": "40062832", "title": "Security: [swiftshader] heap-use-after-free on vk::Query::start", "url": "https://issues.chromium.org/issues/40062832", "status": "Assigned", "severity": "S3-Low", "component": "Internals>GPU>SwiftShader", "reporter": "ne...@nesk.kr", "cve_ids": [], "bounty_amount": 15000.0, "reward_amount_meta": 15000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-01-30T09:35:42+00:00", "year": 2023, "attachment_count": 3, "local_path": "issues/40062832", "has_markdown": true }, { "id": "40062829", "title": "Security: Debug check failed: kCanBeWeak || (!IsSmi() == HAS_STRONG_HEAP_OBJECT_TAG(ptr_))", "url": "https://issues.chromium.org/issues/40062829", "status": "Fixed", "severity": "S4-Minimal", "component": "Blink>JavaScript", "reporter": "wh...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-01-30T03:20:04+00:00", "year": 2023, "attachment_count": 0, "local_path": "issues/40062829", "has_markdown": true }, { "id": "40062823", "title": "Security: Android - Bypass the Protection of input fields cache (Autofill) Bypass 1398579", "url": "https://issues.chromium.org/issues/40062823", "status": "Assigned", "severity": "S4-Minimal", "component": "UI>Browser>Autofill", "reporter": "el...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-01-29T19:55:00+00:00", "year": 2023, "attachment_count": 6, "local_path": "issues/40062823", "has_markdown": true }, { "id": "40062816", "title": "Security: SEGV_ACCERR in Maglev", "url": "https://issues.chromium.org/issues/40062816", "status": "Fixed", "severity": "S3-Low", "component": "Blink>JavaScript>Compiler>Maglev", "reporter": "p4...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-01-28T03:56:47+00:00", "year": 2023, "attachment_count": 1, "local_path": "issues/40062816", "has_markdown": true }, { "id": "40062808", "title": "heap-buffer-overflow in aom_yv12_copy_v_c", "url": "https://issues.chromium.org/issues/40062808", "status": "Assigned", "severity": "S3-Low", "component": "Internals>Media>Video", "reporter": "em...@gmail.com", "cve_ids": [], "bounty_amount": 10000.0, "reward_amount_meta": 10000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-01-27T14:18:34+00:00", "year": 2023, "attachment_count": 4, "local_path": "issues/40062808", "has_markdown": true }, { "id": "40062804", "title": "ImageBitmapRenderingContext does not work from a worker", "url": "https://issues.chromium.org/issues/40062804", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Canvas", "reporter": "gm...@greggman.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-01-27T04:15:03+00:00", "year": 2023, "attachment_count": 1, "local_path": "issues/40062804", "has_markdown": true }, { "id": "40062792", "title": "Crash in vk::ImageView::clear", "url": "https://issues.chromium.org/issues/40062792", "status": "Assigned", "severity": "S3-Low", "component": "Internals>GPU>SwiftShader", "reporter": "ne...@nesk.kr", "cve_ids": [], "bounty_amount": 15000.0, "reward_amount_meta": 15000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-01-25T15:58:52+00:00", "year": 2023, "attachment_count": 6, "local_path": "issues/40062792", "has_markdown": true }, { "id": "40062778", "title": "Security: Race Condition Double Free in i915_gem_set_tiling_ioctl", "url": "https://issues.chromium.org/issues/40062778", "status": "Assigned", "severity": "S3-Low", "component": "Internals>GPU>Internals", "reporter": "lm...@gmail.com", "cve_ids": [], "bounty_amount": 20000.0, "reward_amount_meta": 20000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-01-24T03:33:26+00:00", "year": 2023, "attachment_count": 1, "local_path": "issues/40062778", "has_markdown": true }, { "id": "40062770", "title": "Security: SwiftShader binaries are included in the following Dockerfile by just pulling them from a bucket", "url": "https://issues.chromium.org/issues/40062770", "status": "Assigned", "severity": "S3-Low", "component": "Infra", "reporter": "an...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-01-23T20:14:04+00:00", "year": 2023, "attachment_count": 0, "local_path": "issues/40062770", "has_markdown": true }, { "id": "40062739", "title": "Security: Security DCHECK failed: IsA(from) blink::`anonymous namespace'::CalcToNumericValue:css_numeric_value.cc:162", "url": "https://issues.chromium.org/issues/40062739", "status": "Fixed", "severity": "S3-Low", "component": "Blink>CSS", "reporter": "m....@gmail.com", "cve_ids": [], "bounty_amount": 8000.0, "reward_amount_meta": 8000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-01-20T09:15:11+00:00", "year": 2023, "attachment_count": 3, "local_path": "issues/40062739", "has_markdown": true }, { "id": "40062720", "title": "Crash in blink::HTMLFastPathParser::ParseAttributes", "url": "https://issues.chromium.org/issues/40062720", "status": "Assigned", "severity": "S4-Minimal", "component": "Blink>HTML>Parser", "reporter": "cl...@chromium.org", "cve_ids": [], "bounty_amount": 4000.0, "reward_amount_meta": 4000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-01-18T17:24:44+00:00", "year": 2023, "attachment_count": 0, "local_path": "issues/40062720", "has_markdown": true }, { "id": "40062717", "title": "Security: Debug check failed: pred_reverse_index != -1 (-1 vs. -1)", "url": "https://issues.chromium.org/issues/40062717", "status": "Assigned", "severity": "S4-Minimal", "component": "Blink>JavaScript>Compiler>Turbofan", "reporter": "wh...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-01-18T07:40:42+00:00", "year": 2023, "attachment_count": 0, "local_path": "issues/40062717", "has_markdown": true }, { "id": "40062710", "title": "heap overflow in ForeignSessionHandler::OpenForeignSessionWindows", "url": "https://issues.chromium.org/issues/40062710", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>History", "reporter": "wx...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-01-17T14:41:06+00:00", "year": 2023, "attachment_count": 5, "local_path": "issues/40062710", "has_markdown": true }, { "id": "40062700", "title": "Security DCHECK failure: IsA(from) in casting.h", "url": "https://issues.chromium.org/issues/40062700", "status": "Assigned", "severity": "S4-Minimal", "component": "Blink>CSS", "reporter": "m....@gmail.com", "cve_ids": [], "bounty_amount": 9000.0, "reward_amount_meta": 9000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-01-17T00:00:42+00:00", "year": 2023, "attachment_count": 0, "local_path": "issues/40062700", "has_markdown": true }, { "id": "40062697", "title": "UAF in blink::VideoFrameSubmitter::OnContextLost", "url": "https://issues.chromium.org/issues/40062697", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Media>Video", "reporter": "em...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-01-16T17:51:06+00:00", "year": 2023, "attachment_count": 9, "local_path": "issues/40062697", "has_markdown": true }, { "id": "40062684", "title": "[TF::OptimizationBug] After optimization, running the \"poc.js\" yields segmentation fault", "url": "https://issues.chromium.org/issues/40062684", "status": "Assigned", "severity": "S4-Minimal", "component": "Blink>JavaScript>API, Blink>JavaScript>Compiler, Blink>JavaScript>Runtime", "reporter": "kw...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-01-16T05:25:31+00:00", "year": 2023, "attachment_count": 0, "local_path": "issues/40062684", "has_markdown": true }, { "id": "40062671", "title": "Security: unreachable code in maglev::MaglevGraphBuilder::VisitStaCurrentContextSlot", "url": "https://issues.chromium.org/issues/40062671", "status": "Fixed", "severity": "S3-Low", "component": "Blink>JavaScript>Compiler>Maglev", "reporter": "wh...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-01-15T05:10:04+00:00", "year": 2023, "attachment_count": 0, "local_path": "issues/40062671", "has_markdown": true }, { "id": "40887781", "title": "Security: Debug check failed: var.has_value().", "url": "https://issues.chromium.org/issues/40887781", "status": "Accepted", "severity": "S4-Minimal", "component": "Blink>JavaScript", "reporter": "wh...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-01-14T00:29:11+00:00", "year": 2023, "attachment_count": 0, "local_path": "issues/40887781", "has_markdown": true }, { "id": "40062647", "title": "Security: Debug check failed: begin.valid().", "url": "https://issues.chromium.org/issues/40062647", "status": "Fixed", "severity": "S4-Minimal", "component": "Blink>JavaScript", "reporter": "wh...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-01-14T00:25:49+00:00", "year": 2023, "attachment_count": 0, "local_path": "issues/40062647", "has_markdown": true }, { "id": "40062646", "title": "Security: Debug check failed: !IsBound() || (Predecessors().size() == 1 && kind_ == Kind::kLoopHeader).", "url": "https://issues.chromium.org/issues/40062646", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript>Compiler>Turbofan", "reporter": "wh...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-01-14T00:23:46+00:00", "year": 2023, "attachment_count": 0, "local_path": "issues/40062646", "has_markdown": true }, { "id": "40062622", "title": " heap-use-after-free at browser.cc:869 in Browser::TryToCloseWindow (browser process)", "url": "https://issues.chromium.org/issues/40062622", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>Profiles, UI>Browser>TopChrome>TabStrip", "reporter": "xp...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-01-12T21:35:02+00:00", "year": 2023, "attachment_count": 8, "local_path": "issues/40062622", "has_markdown": true }, { "id": "40062619", "title": "Security: Forced user interaction for permission prompts by closing a popup window", "url": "https://issues.chromium.org/issues/40062619", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>Permissions>Indicators", "reporter": "re...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-01-12T19:15:24+00:00", "year": 2023, "attachment_count": 2, "local_path": "issues/40062619", "has_markdown": true }, { "id": "40062618", "title": "Security: FedCM should have clickjacking protection", "url": "https://issues.chromium.org/issues/40062618", "status": "Accepted", "severity": "S3-Low", "component": "Blink>Identity>FedCM", "reporter": "re...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-01-12T17:50:22+00:00", "year": 2023, "attachment_count": 8, "local_path": "issues/40062618", "has_markdown": true }, { "id": "40062610", "title": "Security: Debug check failed: old_entry.IsRegularEntry() in v8", "url": "https://issues.chromium.org/issues/40062610", "status": "Assigned", "severity": "S4-Minimal", "component": "Blink>JavaScript", "reporter": "ki...@gmail.com", "cve_ids": [], "bounty_amount": 8000.0, "reward_amount_meta": 8000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-01-12T03:51:14+00:00", "year": 2023, "attachment_count": 1, "local_path": "issues/40062610", "has_markdown": true }, { "id": "40062594", "title": "v8 oobr on an obj", "url": "https://issues.chromium.org/issues/40062594", "status": "Assigned", "severity": "S4-Minimal", "component": "Blink>JavaScript>API, Blink>JavaScript>Runtime", "reporter": "5n...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-01-11T06:34:57+00:00", "year": 2023, "attachment_count": 2, "local_path": "issues/40062594", "has_markdown": true }, { "id": "40062584", "title": "UAP in blink::WebGPUSwapBufferProvider::DiscardCurrentSwapBuffer(with --enable-unsafe-webgpu)", "url": "https://issues.chromium.org/issues/40062584", "status": "Assigned", "severity": "S3-Low", "component": "Blink>WebGPU", "reporter": "em...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-01-10T17:26:55+00:00", "year": 2023, "attachment_count": 6, "local_path": "issues/40062584", "has_markdown": true }, { "id": "40062572", "title": "v8 crash in maglev::UseMarkingProcessor::MarkUse with maglev compiler", "url": "https://issues.chromium.org/issues/40062572", "status": "Accepted", "severity": "S4-Minimal", "component": "Blink>JavaScript>Compiler>Maglev", "reporter": "5n...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-01-10T07:59:36+00:00", "year": 2023, "attachment_count": 3, "local_path": "issues/40062572", "has_markdown": true }, { "id": "40062567", "title": "Security: Android Text Selection Menu Able to Overlap Fullscreen Notification Toast", "url": "https://issues.chromium.org/issues/40062567", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>FullScreen", "reporter": "su...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-01-10T02:35:34+00:00", "year": 2023, "attachment_count": 4, "local_path": "issues/40062567", "has_markdown": true }, { "id": "40062564", "title": "memory corruption in blink::ReadableStreamDefaultControllerWithScriptScope::Enqueue", "url": "https://issues.chromium.org/issues/40062564", "status": "Assigned", "severity": "S3-Low", "component": "Blink>WebRTC", "reporter": "em...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-01-09T19:50:01+00:00", "year": 2023, "attachment_count": 8, "local_path": "issues/40062564", "has_markdown": true }, { "id": "40062543", "title": "type confusion in chrome", "url": "https://issues.chromium.org/issues/40062543", "status": "Assigned", "severity": "S3-Low", "component": "Platform>DevTools", "reporter": "wx...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-01-07T07:12:29+00:00", "year": 2023, "attachment_count": 1, "local_path": "issues/40062543", "has_markdown": true }, { "id": "40062541", "title": "Security: Race Condition Double Free in adreno_set_param", "url": "https://issues.chromium.org/issues/40062541", "status": "Assigned", "severity": "Unknown", "component": "Internals>GPU>VendorSpecific", "reporter": "lm...@gmail.com", "cve_ids": [], "bounty_amount": 21000.0, "reward_amount_meta": 21000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-01-07T03:44:25+00:00", "year": 2023, "attachment_count": 1, "local_path": "issues/40062541", "has_markdown": true }, { "id": "40062534", "title": "Security: Directory Picker Dialog gives access to write .exe/.bat files", "url": "https://issues.chromium.org/issues/40062534", "status": "Accepted", "severity": "S3-Low", "component": "Blink>Storage>FileSystem, UI>Browser>Downloads", "reporter": "am...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-01-06T12:00:03+00:00", "year": 2023, "attachment_count": 2, "local_path": "issues/40062534", "has_markdown": true }, { "id": "40062526", "title": "UAF in blink::RTCPeerConnectionHandler::OnIceCandidate", "url": "https://issues.chromium.org/issues/40062526", "status": "Assigned", "severity": "S3-Low", "component": "Blink>WebRTC", "reporter": "em...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-01-05T18:37:42+00:00", "year": 2023, "attachment_count": 3, "local_path": "issues/40062526", "has_markdown": true }, { "id": "40062523", "title": "Chrome Theme contains link to malware, safe browser does not catch it", "url": "https://issues.chromium.org/issues/40062523", "status": "Accepted", "severity": "S3-Low", "component": "UI>Browser>Themes", "reporter": "fa...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-01-05T16:05:17+00:00", "year": 2023, "attachment_count": 3, "local_path": "issues/40062523", "has_markdown": true }, { "id": "40062510", "title": "Google Chrome Console WebUI Heap-Overflow Vulnerability", "url": "https://issues.chromium.org/issues/40062510", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>WebUI", "reporter": "no...@ssd-disclosure.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-01-05T06:37:01+00:00", "year": 2023, "attachment_count": 0, "local_path": "issues/40062510", "has_markdown": true }, { "id": "40062495", "title": "Security: Integer overflows in CountPages", "url": "https://issues.chromium.org/issues/40062495", "status": "Assigned", "severity": "S3-Low", "component": "Internals>Plugins>PDF", "reporter": "vu...@gmail.com", "cve_ids": [], "bounty_amount": 11000.0, "reward_amount_meta": 11000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-01-04T06:49:15+00:00", "year": 2023, "attachment_count": 4, "local_path": "issues/40062495", "has_markdown": true }, { "id": "40062478", "title": "V8 type confusion of object as v8::Function in CallMethodOnFrame", "url": "https://issues.chromium.org/issues/40062478", "status": "Accepted", "severity": "S3-Low", "component": "Platform>DevTools", "reporter": "wx...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-01-03T14:21:30+00:00", "year": 2023, "attachment_count": 2, "local_path": "issues/40062478", "has_markdown": true }, { "id": "40062472", "title": "V8 type confusion of Undefined as v8::Function in ServiceWorkerGlobalScope::FetchHandlerType", "url": "https://issues.chromium.org/issues/40062472", "status": "Assigned", "severity": "S3-Low", "component": "Blink>ServiceWorker", "reporter": "wx...@gmail.com", "cve_ids": [], "bounty_amount": 7500.0, "reward_amount_meta": 7500.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-01-03T09:02:51+00:00", "year": 2023, "attachment_count": 2, "local_path": "issues/40062472", "has_markdown": true }, { "id": "40062470", "title": "Security: Incognito Mode-specific external protocol prompts can be overlaid on other origins on Android.", "url": "https://issues.chromium.org/issues/40062470", "status": "Accepted", "severity": "S3-Low", "component": "Mobile>Intents, UI>Browser>Incognito", "reporter": "ha...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-01-03T05:55:14+00:00", "year": 2023, "attachment_count": 1, "local_path": "issues/40062470", "has_markdown": true }, { "id": "40062462", "title": "Security: Possible to include mixed content in an about:blank popup opened by a https page", "url": "https://issues.chromium.org/issues/40062462", "status": "Accepted", "severity": "S3-Low", "component": "Blink>SecurityFeature", "reporter": "fa...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2023-01-02T16:08:01+00:00", "year": 2023, "attachment_count": 5, "local_path": "issues/40062462", "has_markdown": true }, { "id": "40062445", "title": "Security: (Android) PWA Install prompt can be overlaid over other origins.", "url": "https://issues.chromium.org/issues/40062445", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>WebAppInstalls>Android", "reporter": "ha...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-12-30T07:47:47+00:00", "year": 2022, "attachment_count": 8, "local_path": "issues/40062445", "has_markdown": true }, { "id": "40062432", "title": "Security: segmentation fault in ResizableArrayBuffer in v8", "url": "https://issues.chromium.org/issues/40062432", "status": "Assigned", "severity": "S4-Minimal", "component": "Blink>JavaScript>API, Blink>JavaScript>Runtime", "reporter": "ki...@gmail.com", "cve_ids": [], "bounty_amount": 8000.0, "reward_amount_meta": 8000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-12-29T07:13:31+00:00", "year": 2022, "attachment_count": 1, "local_path": "issues/40062432", "has_markdown": true }, { "id": "40062430", "title": "Security: Debug check failed: ReadOnlyHeap::Contains(object) || heap_->Contains(object)", "url": "https://issues.chromium.org/issues/40062430", "status": "Fixed", "severity": "S3-Low", "component": "Blink>JavaScript", "reporter": "wh...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-12-29T03:58:40+00:00", "year": 2022, "attachment_count": 1, "local_path": "issues/40062430", "has_markdown": true }, { "id": "40062426", "title": "[ChromeOS Security] Multiple Share Memory TOCTOU Vulnerabilities in Qualcomm Snapdragon 7c Gen 2 Camera Drivers Which can be triggered from Chome Browser Context", "url": "https://issues.chromium.org/issues/40062426", "status": "Assigned", "severity": "S3-Low", "component": "OS>Packages", "reporter": "pi...@gmail.com", "cve_ids": [], "bounty_amount": 10000.0, "reward_amount_meta": 10000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-12-29T00:22:38+00:00", "year": 2022, "attachment_count": 1, "local_path": "issues/40062426", "has_markdown": true }, { "id": "40062424", "title": "Security: PWA Install prompt can be overlaid over other origins.", "url": "https://issues.chromium.org/issues/40062424", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>WebAppInstalls", "reporter": "ha...@gmail.com", "cve_ids": [], "bounty_amount": 4000.0, "reward_amount_meta": 4000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-12-28T20:17:16+00:00", "year": 2022, "attachment_count": 7, "local_path": "issues/40062424", "has_markdown": true }, { "id": "40062412", "title": "Security: PWA Installation can be unknowingly installed and launched into by pressing the \"Enter\" button repeatedly", "url": "https://issues.chromium.org/issues/40062412", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>WebAppInstalls", "reporter": "ha...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-12-27T17:51:58+00:00", "year": 2022, "attachment_count": 7, "local_path": "issues/40062412", "has_markdown": true }, { "id": "40062398", "title": "Security: Improper origin elision in downloads prompt initiated in Chrome Custom Tab (Android)", "url": "https://issues.chromium.org/issues/40062398", "status": "Accepted", "severity": "S3-Low", "component": "UI>Browser>Downloads", "reporter": "ha...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-12-26T18:52:46+00:00", "year": 2022, "attachment_count": 1, "local_path": "issues/40062398", "has_markdown": true }, { "id": "40062384", "title": "register assign error with jit", "url": "https://issues.chromium.org/issues/40062384", "status": "Assigned", "severity": "S4-Minimal", "component": "Blink>JavaScript>API, Blink>JavaScript>Runtime", "reporter": "5n...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-12-25T09:15:34+00:00", "year": 2022, "attachment_count": 2, "local_path": "issues/40062384", "has_markdown": true }, { "id": "40062383", "title": "oob in RTCStatsCollector::ProduceTransportStats_n", "url": "https://issues.chromium.org/issues/40062383", "status": "Assigned", "severity": "S3-Low", "component": "Blink>WebRTC>PeerConnection", "reporter": "em...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-12-25T09:13:47+00:00", "year": 2022, "attachment_count": 5, "local_path": "issues/40062383", "has_markdown": true }, { "id": "40062377", "title": "Security: PaymentRequest dialog selects an accept button by default", "url": "https://issues.chromium.org/issues/40062377", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Payments", "reporter": "st...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-12-24T17:23:32+00:00", "year": 2022, "attachment_count": 6, "local_path": "issues/40062377", "has_markdown": true }, { "id": "40062372", "title": "UAF in AsyncCompileJob::Abort", "url": "https://issues.chromium.org/issues/40062372", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript>WebAssembly", "reporter": "em...@gmail.com", "cve_ids": [], "bounty_amount": 10000.0, "reward_amount_meta": 10000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-12-24T15:08:02+00:00", "year": 2022, "attachment_count": 2, "local_path": "issues/40062372", "has_markdown": true }, { "id": "40062369", "title": "Heap Buffer Overflow in AudioWorkletProcessor::ClonePortTopology", "url": "https://issues.chromium.org/issues/40062369", "status": "Assigned", "severity": "S4-Minimal", "component": "Blink>WebAudio", "reporter": "em...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-12-24T08:30:11+00:00", "year": 2022, "attachment_count": 3, "local_path": "issues/40062369", "has_markdown": true }, { "id": "40062366", "title": "Security: PaymentRequest dialog susceptible to clickjacking", "url": "https://issues.chromium.org/issues/40062366", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Payments", "reporter": "st...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-12-24T00:51:24+00:00", "year": 2022, "attachment_count": 6, "local_path": "issues/40062366", "has_markdown": true }, { "id": "40062350", "title": "Security: Heap-use-after-free in ExtensionViewHost::OnDidStopFirstLoad", "url": "https://issues.chromium.org/issues/40062350", "status": "Assigned", "severity": "S3-Low", "component": "Platform>Extensions", "reporter": "me...@gmail.com", "cve_ids": [], "bounty_amount": 4000.0, "reward_amount_meta": 4000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-12-22T07:07:36+00:00", "year": 2022, "attachment_count": 4, "local_path": "issues/40062350", "has_markdown": true }, { "id": "40062345", "title": "Security: Fatal error in ../../src/heap/mark-compact.cc", "url": "https://issues.chromium.org/issues/40062345", "status": "Assigned", "severity": "S4-Minimal", "component": "Blink>JavaScript", "reporter": "wh...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-12-22T03:19:20+00:00", "year": 2022, "attachment_count": 2, "local_path": "issues/40062345", "has_markdown": true }, { "id": "40062320", "title": "Debug check failed: value.IsForeign().", "url": "https://issues.chromium.org/issues/40062320", "status": "Assigned", "severity": "S4-Minimal", "component": "Blink>JavaScript, Blink>JavaScript>WebAssembly", "reporter": "qp...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-12-18T07:28:37+00:00", "year": 2022, "attachment_count": 0, "local_path": "issues/40062320", "has_markdown": true }, { "id": "40062302", "title": "Security: heap-buffer-overflow in HidDeviceManager::GetApiDevicesFromList", "url": "https://issues.chromium.org/issues/40062302", "status": "Assigned", "severity": "S3-Low", "component": "Platform>Apps>API>HID, Platform>Extensions>API", "reporter": "un...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-12-17T11:04:48+00:00", "year": 2022, "attachment_count": 14, "local_path": "issues/40062302", "has_markdown": true }, { "id": "40062298", "title": "Security: Container-overflow in SavedTabGroupModel::RemoveTabFromGroup", "url": "https://issues.chromium.org/issues/40062298", "status": "Accepted", "severity": "S3-Low", "component": "UI>Browser>TopChrome>TabStrip>TabGroups", "reporter": "ch...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-12-17T02:15:24+00:00", "year": 2022, "attachment_count": 4, "local_path": "issues/40062298", "has_markdown": true }, { "id": "40062221", "title": "Security: UAF in GuestViewBase::StopTrackingEmbedderZoomLevel", "url": "https://issues.chromium.org/issues/40062221", "status": "Assigned", "severity": "S3-Low", "component": "Platform>Apps>BrowserTag", "reporter": "ss...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-12-14T01:35:26+00:00", "year": 2022, "attachment_count": 4, "local_path": "issues/40062221", "has_markdown": true }, { "id": "40062211", "title": "Buffer overflow in the rndis_wlan driver for Linux kernel", "url": "https://issues.chromium.org/issues/40062211", "status": "Assigned", "severity": "S3-Low", "component": "Unknown", "reporter": "sz...@gmail.com", "cve_ids": [ "CVE-2023-23559" ], "bounty_amount": 20000.0, "reward_amount_meta": 20000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-12-13T08:09:35+00:00", "year": 2022, "attachment_count": 0, "local_path": "issues/40062211", "has_markdown": true }, { "id": "40062206", "title": "Security: heap-use-after-free in blink::PropertyTreeManager::EnsureCompositorTransformNode", "url": "https://issues.chromium.org/issues/40062206", "status": "Fixed", "severity": "S3-Low", "component": "Internals>Compositing", "reporter": "st...@gmail.com", "cve_ids": [], "bounty_amount": 8000.0, "reward_amount_meta": 8000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-12-13T01:09:46+00:00", "year": 2022, "attachment_count": 6, "local_path": "issues/40062206", "has_markdown": true }, { "id": "40062170", "title": "Security: Race Condition UAF in panfrost_ioctl_create_bo", "url": "https://issues.chromium.org/issues/40062170", "status": "Assigned", "severity": "S3-Low", "component": "OS>Packages", "reporter": "lm...@gmail.com", "cve_ids": [], "bounty_amount": 20000.0, "reward_amount_meta": 20000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-12-11T08:34:42+00:00", "year": 2022, "attachment_count": 3, "local_path": "issues/40062170", "has_markdown": true }, { "id": "40062164", "title": "Security: Debug check failed: Shared heap must not have clients at teardown, leading to SEGV_ACCERR", "url": "https://issues.chromium.org/issues/40062164", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript>Runtime", "reporter": "ki...@gmail.com", "cve_ids": [], "bounty_amount": 8000.0, "reward_amount_meta": 8000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-12-10T08:13:29+00:00", "year": 2022, "attachment_count": 1, "local_path": "issues/40062164", "has_markdown": true }, { "id": "40062163", "title": "Security: Debug check failed: string->InSharedHeap() in v8", "url": "https://issues.chromium.org/issues/40062163", "status": "Fixed", "severity": "S3-Low", "component": "Blink>JavaScript>Runtime", "reporter": "ki...@gmail.com", "cve_ids": [], "bounty_amount": 8000.0, "reward_amount_meta": 8000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-12-10T07:21:06+00:00", "year": 2022, "attachment_count": 1, "local_path": "issues/40062163", "has_markdown": true }, { "id": "40062161", "title": "Security: UAF in VIRTGPU_RESOURCE_CREATE and VIRTGPU_RESOURCE_CREATE_BLOB", "url": "https://issues.chromium.org/issues/40062161", "status": "Accepted", "severity": "S3-Low", "component": "OS>Packages", "reporter": "lm...@gmail.com", "cve_ids": [], "bounty_amount": 21000.0, "reward_amount_meta": 21000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-12-10T03:37:56+00:00", "year": 2022, "attachment_count": 3, "local_path": "issues/40062161", "has_markdown": true }, { "id": "40062153", "title": "Security: Container Overflow in UDPSocket::OnLeaveGroupCompleted", "url": "https://issues.chromium.org/issues/40062153", "status": "Assigned", "severity": "S3-Low", "component": "Platform>Apps>API", "reporter": "ss...@gmail.com", "cve_ids": [], "bounty_amount": 10000.0, "reward_amount_meta": 10000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-12-09T20:11:18+00:00", "year": 2022, "attachment_count": 5, "local_path": "issues/40062153", "has_markdown": true }, { "id": "40062152", "title": "Insufficient fix for Cross-Origin (Partial) Status Code leak (XS-Leak)", "url": "https://issues.chromium.org/issues/40062152", "status": "Assigned", "severity": "S3-Low", "component": "Blink>SecurityFeature>CORS", "reporter": "ku...@googlemail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-12-09T17:23:50+00:00", "year": 2022, "attachment_count": 2, "local_path": "issues/40062152", "has_markdown": true }, { "id": "40062145", "title": "stack use after return in gpu::raster::(anonymous namespace)::OnReadYUVImagePixelsDone", "url": "https://issues.chromium.org/issues/40062145", "status": "Assigned", "severity": "S3-Low", "component": "Internals>GPU>Vulkan", "reporter": "em...@gmail.com", "cve_ids": [], "bounty_amount": 10000.0, "reward_amount_meta": 10000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-12-09T07:38:06+00:00", "year": 2022, "attachment_count": 4, "local_path": "issues/40062145", "has_markdown": true }, { "id": "40062130", "title": "Security: UAF in MojoQueryQuotaIpcz", "url": "https://issues.chromium.org/issues/40062130", "status": "Assigned", "severity": "S3-Low", "component": "Internals>Mojo", "reporter": "ss...@gmail.com", "cve_ids": [], "bounty_amount": 30000.0, "reward_amount_meta": 30000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-12-08T14:16:10+00:00", "year": 2022, "attachment_count": 3, "local_path": "issues/40062130", "has_markdown": true }, { "id": "40062114", "title": " Security: libtiff CVE vulnerabilities in Chromium 106.0.5249.103", "url": "https://issues.chromium.org/issues/40062114", "status": "Assigned", "severity": "S3-Low", "component": "Internals>Plugins>PDF", "reporter": "sa...@gmail.com", "cve_ids": [ "CVE-2022-0891", "CVE-2022-1354", "CVE-2022-1355", "CVE-2022-2867", "CVE-2022-2868", "CVE-2022-2869", "CVE-2022-2953", "CVE-2022-3570", "CVE-2022-3597", "CVE-2022-3598", "CVE-2022-3599", "CVE-2022-3626", "CVE-2022-3627" ], "bounty_amount": 500.0, "reward_amount_meta": 500.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-12-07T18:03:03+00:00", "year": 2022, "attachment_count": 0, "local_path": "issues/40062114", "has_markdown": true }, { "id": "40062113", "title": "Security: ChromeOS wpa_supplicant arbitrary shared object load", "url": "https://issues.chromium.org/issues/40062113", "status": "Accepted", "severity": "S3-Low", "component": "Unknown", "reporter": "ro...@rorym.cnamara.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-12-07T17:28:24+00:00", "year": 2022, "attachment_count": 0, "local_path": "issues/40062113", "has_markdown": true }, { "id": "40062108", "title": "Security: ChromeOS pluginvm arbitrary chmod 777", "url": "https://issues.chromium.org/issues/40062108", "status": "Accepted", "severity": "S3-Low", "component": "Unknown", "reporter": "ro...@rorym.cnamara.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-12-07T17:28:12+00:00", "year": 2022, "attachment_count": 1, "local_path": "issues/40062108", "has_markdown": true }, { "id": "40062107", "title": "Security: ChromeOS Arbitrary Root File Delete", "url": "https://issues.chromium.org/issues/40062107", "status": "Assigned", "severity": "S3-Low", "component": "Unknown", "reporter": "ro...@rorym.cnamara.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-12-07T17:28:10+00:00", "year": 2022, "attachment_count": 1, "local_path": "issues/40062107", "has_markdown": true }, { "id": "40062106", "title": "Security: ChromeOS On halt/reboot root file overwrite", "url": "https://issues.chromium.org/issues/40062106", "status": "Assigned", "severity": "S3-Low", "component": "Unknown", "reporter": "ro...@rorym.cnamara.com", "cve_ids": [], "bounty_amount": 20000.0, "reward_amount_meta": 20000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-12-07T17:28:07+00:00", "year": 2022, "attachment_count": 0, "local_path": "issues/40062106", "has_markdown": true }, { "id": "40062098", "title": "Security: Android - Bypass the Protection of input fields cache (Autofill) ", "url": "https://issues.chromium.org/issues/40062098", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>Autofill", "reporter": "el...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-12-07T14:33:16+00:00", "year": 2022, "attachment_count": 6, "local_path": "issues/40062098", "has_markdown": true }, { "id": "40062087", "title": "memory corruption in v8", "url": "https://issues.chromium.org/issues/40062087", "status": "Assigned", "severity": "S4-Minimal", "component": "Blink>JavaScript>Compiler", "reporter": "em...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-12-07T05:43:01+00:00", "year": 2022, "attachment_count": 3, "local_path": "issues/40062087", "has_markdown": true }, { "id": "40062078", "title": "Use-after-poison in content::InspectorMediaEventHandler::SendQueuedMediaEvents", "url": "https://issues.chromium.org/issues/40062078", "status": "Assigned", "severity": "S4-Minimal", "component": "Internals>Core, Internals>Media", "reporter": "cl...@chromium.org", "cve_ids": [], "bounty_amount": 9000.0, "reward_amount_meta": 9000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-12-07T00:47:49+00:00", "year": 2022, "attachment_count": 0, "local_path": "issues/40062078", "has_markdown": true }, { "id": "40062066", "title": "UAF in GpuChannel", "url": "https://issues.chromium.org/issues/40062066", "status": "Accepted", "severity": "S3-Low", "component": "Internals>GPU", "reporter": "he...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-12-06T12:38:21+00:00", "year": 2022, "attachment_count": 2, "local_path": "issues/40062066", "has_markdown": true }, { "id": "40062062", "title": "Security: CVE-2022-3970 was fixed in libtiff and published but not propagated to Pdfium yet", "url": "https://issues.chromium.org/issues/40062062", "status": "Assigned", "severity": "S3-Low", "component": "Internals>Plugins>PDF", "reporter": "ri...@sap.com", "cve_ids": [ "CVE-2022-3970" ], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-12-06T10:21:03+00:00", "year": 2022, "attachment_count": 0, "local_path": "issues/40062062", "has_markdown": true }, { "id": "40062058", "title": "Security: Fatal error in ../../src/heap/sweeper.cc", "url": "https://issues.chromium.org/issues/40062058", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript>GarbageCollection", "reporter": "wh...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-12-06T08:37:14+00:00", "year": 2022, "attachment_count": 0, "local_path": "issues/40062058", "has_markdown": true }, { "id": "40062056", "title": "UAF in SharedImageManager of GPU", "url": "https://issues.chromium.org/issues/40062056", "status": "Accepted", "severity": "S3-Low", "component": "Internals>GPU", "reporter": "he...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-12-06T07:01:07+00:00", "year": 2022, "attachment_count": 6, "local_path": "issues/40062056", "has_markdown": true }, { "id": "40062042", "title": "Security: UAF in HandleExpandedPaths", "url": "https://issues.chromium.org/issues/40062042", "status": "Assigned", "severity": "S3-Low", "component": "Enterprise, Enterprise>Connectors", "reporter": "le...@gmail.com", "cve_ids": [], "bounty_amount": 31000.0, "reward_amount_meta": 31000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-12-05T06:44:28+00:00", "year": 2022, "attachment_count": 4, "local_path": "issues/40062042", "has_markdown": true }, { "id": "40062027", "title": "Security: heap-use-after-free third_party/swiftshader/src/WSI/VkSwapchainKHR.cpp:43:13", "url": "https://issues.chromium.org/issues/40062027", "status": "Assigned", "severity": "S3-Low", "component": "Internals>GPU>Vulkan", "reporter": "rh...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-12-03T01:26:37+00:00", "year": 2022, "attachment_count": 1, "local_path": "issues/40062027", "has_markdown": true }, { "id": "40062021", "title": "Security:UAF in content::SyntheticPointerAction::ForwardTouchOrMouseInputEvents(browser process)", "url": "https://issues.chromium.org/issues/40062021", "status": "Fixed", "severity": "S3-Low", "component": "Blink>Input", "reporter": "0x...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-12-02T13:23:49+00:00", "year": 2022, "attachment_count": 6, "local_path": "issues/40062021", "has_markdown": true }, { "id": "40062019", "title": "Security: ChromeOS Guest User Can Force Persistent Rollback on Stable Channel", "url": "https://issues.chromium.org/issues/40062019", "status": "Accepted", "severity": "S3-Low", "component": "Enterprise", "reporter": "hi...@gmail.com", "cve_ids": [], "bounty_amount": 500.0, "reward_amount_meta": 500.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-12-02T11:02:24+00:00", "year": 2022, "attachment_count": 2, "local_path": "issues/40062019", "has_markdown": true }, { "id": "40061975", "title": "Security:UAF in content::SyntheticMouseDriver::DispatchEvent(browser process)", "url": "https://issues.chromium.org/issues/40061975", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Input, Internals>Core", "reporter": "0x...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-11-30T14:26:31+00:00", "year": 2022, "attachment_count": 5, "local_path": "issues/40061975", "has_markdown": true }, { "id": "40061973", "title": "UAF in OnSyncMessageEventReady", "url": "https://issues.chromium.org/issues/40061973", "status": "Assigned", "severity": "S3-Low", "component": "Internals>Mojo>Bindings", "reporter": "ro...@gmail.com", "cve_ids": [], "bounty_amount": 6000.0, "reward_amount_meta": 6000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-11-30T10:43:59+00:00", "year": 2022, "attachment_count": 1, "local_path": "issues/40061973", "has_markdown": true }, { "id": "40061953", "title": "Security: Permission Prompts can be made totally hidden and user can Accept and interact with sensitive data without being aware Similar to (1358647)", "url": "https://issues.chromium.org/issues/40061953", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>Permissions>Prompts", "reporter": "el...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-11-29T14:13:34+00:00", "year": 2022, "attachment_count": 2, "local_path": "issues/40061953", "has_markdown": true }, { "id": "40061952", "title": "Security: Debug check failed: enum_length == map->NumberOfEnumerableProperties()", "url": "https://issues.chromium.org/issues/40061952", "status": "Assigned", "severity": "S4-Minimal", "component": "Blink>JavaScript>Runtime", "reporter": "ki...@gmail.com", "cve_ids": [], "bounty_amount": 11000.0, "reward_amount_meta": 11000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-11-29T14:02:19+00:00", "year": 2022, "attachment_count": 1, "local_path": "issues/40061952", "has_markdown": true }, { "id": "40061948", "title": "Malicious PowerShell module file can be downloaded without any warning and can be bypassed the Chrome security", "url": "https://issues.chromium.org/issues/40061948", "status": "Assigned", "severity": "S3-Low", "component": "Unknown", "reporter": "sm...@gmail.com", "cve_ids": [], "bounty_amount": 500.0, "reward_amount_meta": 500.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-11-29T07:45:56+00:00", "year": 2022, "attachment_count": 1, "local_path": "issues/40061948", "has_markdown": true }, { "id": "40061945", "title": "Security: stack-use-after-scope in dawn::native::CommandEncoder::BeginRenderPass", "url": "https://issues.chromium.org/issues/40061945", "status": "Fixed", "severity": "S3-Low", "component": "Internals>GPU>Dawn, Internals>Skia", "reporter": "0x...@gmail.com", "cve_ids": [], "bounty_amount": 10000.0, "reward_amount_meta": 10000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-11-29T01:07:29+00:00", "year": 2022, "attachment_count": 1, "local_path": "issues/40061945", "has_markdown": true }, { "id": "40061930", "title": "Turbofan-Optimization Bug: \"Check failed: IsBigInt()\"", "url": "https://issues.chromium.org/issues/40061930", "status": "Assigned", "severity": "S4-Minimal", "component": "Blink>JavaScript>Compiler", "reporter": "kw...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-11-28T01:57:50+00:00", "year": 2022, "attachment_count": 0, "local_path": "issues/40061930", "has_markdown": true }, { "id": "40061921", "title": "Security: Download notification can hide \"Press and hold Esc to exit full screen\" ", "url": "https://issues.chromium.org/issues/40061921", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>Bubbles>Download, UI>Browser>Downloads", "reporter": "ha...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-11-26T04:22:15+00:00", "year": 2022, "attachment_count": 2, "local_path": "issues/40061921", "has_markdown": true }, { "id": "40061920", "title": "Security: stack-use-after-scope in dawn::native::d3d12::ShaderModule::Compile", "url": "https://issues.chromium.org/issues/40061920", "status": "Assigned", "severity": "S3-Low", "component": "Dawn", "reporter": "0x...@gmail.com", "cve_ids": [], "bounty_amount": 10000.0, "reward_amount_meta": 10000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-11-26T01:59:22+00:00", "year": 2022, "attachment_count": 0, "local_path": "issues/40061920", "has_markdown": true }, { "id": "40061915", "title": "Security: UAF in content::NavigationRequest::SetViewTransitionState in browser process", "url": "https://issues.chromium.org/issues/40061915", "status": "Fixed", "severity": "S3-Low", "component": "Blink>ViewTransitions", "reporter": "0x...@gmail.com", "cve_ids": [], "bounty_amount": 20000.0, "reward_amount_meta": 20000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-11-25T11:26:18+00:00", "year": 2022, "attachment_count": 1, "local_path": "issues/40061915", "has_markdown": true }, { "id": "40061894", "title": "Security: dcheck failed in object.InSharedHeap ", "url": "https://issues.chromium.org/issues/40061894", "status": "Fixed", "severity": "S4-Minimal", "component": "Blink>JavaScript>Runtime", "reporter": "wh...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-11-24T02:52:35+00:00", "year": 2022, "attachment_count": 0, "local_path": "issues/40061894", "has_markdown": true }, { "id": "40061881", "title": "Optimization bug in TurboShaft::MachineOptimizationReducer::ReduceSignedDiv", "url": "https://issues.chromium.org/issues/40061881", "status": "Accepted", "severity": "S3-Low", "component": "Blink>JavaScript>Compiler", "reporter": "kw...@gmail.com", "cve_ids": [], "bounty_amount": 10000.0, "reward_amount_meta": 10000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-11-23T07:45:42+00:00", "year": 2022, "attachment_count": 0, "local_path": "issues/40061881", "has_markdown": true }, { "id": "40061872", "title": "Security: heap-use-after-free on chromeOS using PhoneHub + Screensharing", "url": "https://issues.chromium.org/issues/40061872", "status": "Assigned", "severity": "S3-Low", "component": "UI>Shell", "reporter": "vi...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-11-22T14:10:07+00:00", "year": 2022, "attachment_count": 5, "local_path": "issues/40061872", "has_markdown": true }, { "id": "40061867", "title": "Security: heap-use-after-free drop_target_event.cc:28 in ui::DropTargetEvent::DropTargetEvent", "url": "https://issues.chromium.org/issues/40061867", "status": "Assigned", "severity": "S3-Low", "component": "UI>Aura", "reporter": "m....@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-11-22T10:19:46+00:00", "year": 2022, "attachment_count": 3, "local_path": "issues/40061867", "has_markdown": true }, { "id": "40061865", "title": "Security: Security DCHECK failed: IsA(from) blink::CSSPrimitiveValue::ConvertToLength", "url": "https://issues.chromium.org/issues/40061865", "status": "Fixed", "severity": "S4-Minimal", "component": "Blink>Animation, Blink>CSS", "reporter": "m....@gmail.com", "cve_ids": [], "bounty_amount": 8000.0, "reward_amount_meta": 8000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-11-22T03:29:56+00:00", "year": 2022, "attachment_count": 2, "local_path": "issues/40061865", "has_markdown": true }, { "id": "40061849", "title": "Security: Debug check failed: IsPrimitiveMap()", "url": "https://issues.chromium.org/issues/40061849", "status": "Fixed", "severity": "S3-Low", "component": "Blink>JavaScript>Compiler>Maglev", "reporter": "p4...@gmail.com", "cve_ids": [], "bounty_amount": 10000.0, "reward_amount_meta": 10000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-11-21T11:07:21+00:00", "year": 2022, "attachment_count": 1, "local_path": "issues/40061849", "has_markdown": true }, { "id": "40061815", "title": "Security: Unretained() can be used for objects on the Oilpan heap", "url": "https://issues.chromium.org/issues/40061815", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Workers", "reporter": "vm...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-11-18T21:46:13+00:00", "year": 2022, "attachment_count": 0, "local_path": "issues/40061815", "has_markdown": true }, { "id": "40061803", "title": "UAF in MerchantViewerDataManager", "url": "https://issues.chromium.org/issues/40061803", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>Shopping>Cart", "reporter": "ha...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-11-18T06:56:04+00:00", "year": 2022, "attachment_count": 0, "local_path": "issues/40061803", "has_markdown": true }, { "id": "40061801", "title": "Security: Escape the page sandbox to the Chromium debugger via Chrome headless snapshots", "url": "https://issues.chromium.org/issues/40061801", "status": "Accepted", "severity": "S3-Low", "component": "Internals>Headless, Platform>DevTools", "reporter": "zs...@canva.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-11-18T04:08:51+00:00", "year": 2022, "attachment_count": 3, "local_path": "issues/40061801", "has_markdown": true }, { "id": "40061793", "title": "UAF in CartService", "url": "https://issues.chromium.org/issues/40061793", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>Shopping>Cart", "reporter": "ha...@gmail.com", "cve_ids": [], "bounty_amount": 2500.0, "reward_amount_meta": 2500.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-11-17T17:59:37+00:00", "year": 2022, "attachment_count": 4, "local_path": "issues/40061793", "has_markdown": true }, { "id": "40061784", "title": "Security: Debug check failed: slot < sentinel_ in UpdateUntypedOldToSharedPointers", "url": "https://issues.chromium.org/issues/40061784", "status": "Fixed", "severity": "S3-Low", "component": "Blink>JavaScript>GarbageCollection", "reporter": "ki...@gmail.com", "cve_ids": [], "bounty_amount": 8000.0, "reward_amount_meta": 8000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-11-17T12:03:07+00:00", "year": 2022, "attachment_count": 2, "local_path": "issues/40061784", "has_markdown": true }, { "id": "40061783", "title": "Security: Permissions Prompt UI spoof through a custom CSS cursor", "url": "https://issues.chromium.org/issues/40061783", "status": "Accepted", "severity": "S3-Low", "component": "UI>Browser, UI>Browser>Permissions>Prompts", "reporter": "re...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-11-17T11:54:27+00:00", "year": 2022, "attachment_count": 6, "local_path": "issues/40061783", "has_markdown": true }, { "id": "40061782", "title": "UAF in CartHandler", "url": "https://issues.chromium.org/issues/40061782", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>Shopping>Cart", "reporter": "ha...@gmail.com", "cve_ids": [], "bounty_amount": 2500.0, "reward_amount_meta": 2500.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-11-17T11:27:16+00:00", "year": 2022, "attachment_count": 7, "local_path": "issues/40061782", "has_markdown": true }, { "id": "40061781", "title": "Security: global-buffer-overflow css_property.cc:27 in blink::CSSProperty::Get", "url": "https://issues.chromium.org/issues/40061781", "status": "Assigned", "severity": "S3-Low", "component": "Blink>CSS", "reporter": "m....@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-11-17T10:41:03+00:00", "year": 2022, "attachment_count": 3, "local_path": "issues/40061781", "has_markdown": true }, { "id": "40061773", "title": "Security: Debug check failed: s->IsFlat().", "url": "https://issues.chromium.org/issues/40061773", "status": "Accepted", "severity": "S4-Minimal", "component": "Blink>JavaScript, Blink>JavaScript>Internationalization, Blink>JavaScript>Runtime", "reporter": "re...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-11-16T12:16:49+00:00", "year": 2022, "attachment_count": 1, "local_path": "issues/40061773", "has_markdown": true }, { "id": "40061772", "title": "Security: Extension with permission can read arbitrary local files although (Allow access to file URLs) is disabled", "url": "https://issues.chromium.org/issues/40061772", "status": "Assigned", "severity": "S3-Low", "component": "Platform>Extensions>API", "reporter": "el...@gmail.com", "cve_ids": [], "bounty_amount": 10000.0, "reward_amount_meta": 10000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-11-16T11:10:26+00:00", "year": 2022, "attachment_count": 8, "local_path": "issues/40061772", "has_markdown": true }, { "id": "40061735", "title": "blink::MediaInspectorContextImpl::CullPlayers", "url": "https://issues.chromium.org/issues/40061735", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Media>WebCodecs, Blink>Scheduling", "reporter": "em...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-11-14T17:28:22+00:00", "year": 2022, "attachment_count": 4, "local_path": "issues/40061735", "has_markdown": true }, { "id": "40061718", "title": "Security: UAF in lens::LensStaticPageController::LoadChromeLens", "url": "https://issues.chromium.org/issues/40061718", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser", "reporter": "zh...@gmail.com", "cve_ids": [], "bounty_amount": 4000.0, "reward_amount_meta": 4000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-11-13T08:08:06+00:00", "year": 2022, "attachment_count": 2, "local_path": "issues/40061718", "has_markdown": true }, { "id": "40061705", "title": "Security: UAF IN video_capture::VideoSourceImpl::OnClientDisconnected() services/video_capture/video_source_impl.cc:88:14", "url": "https://issues.chromium.org/issues/40061705", "status": "Assigned", "severity": "S3-Low", "component": "Internals>Media>CameraCapture", "reporter": "m....@gmail.com", "cve_ids": [], "bounty_amount": 16000.0, "reward_amount_meta": 16000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-11-11T10:04:52+00:00", "year": 2022, "attachment_count": 1, "local_path": "issues/40061705", "has_markdown": true }, { "id": "40061704", "title": "Security: Heap-buffer-overflow in CommerceHintAgent::DidFinishLoadCallback ", "url": "https://issues.chromium.org/issues/40061704", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>Shopping", "reporter": "me...@gmail.com", "cve_ids": [], "bounty_amount": 2500.0, "reward_amount_meta": 2500.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-11-11T08:05:26+00:00", "year": 2022, "attachment_count": 6, "local_path": "issues/40061704", "has_markdown": true }, { "id": "40061682", "title": "Security: UAF in content::RenderFrameDevToolsAgentHost::RenderProcessExited", "url": "https://issues.chromium.org/issues/40061682", "status": "Assigned", "severity": "S3-Low", "component": "Internals>Headless", "reporter": "et...@gmail.com", "cve_ids": [], "bounty_amount": 31000.0, "reward_amount_meta": 31000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-11-10T03:16:19+00:00", "year": 2022, "attachment_count": 4, "local_path": "issues/40061682", "has_markdown": true }, { "id": "40061678", "title": "Security: heap-use-after-free in observer_list.h triggered via Notes/Annotation feature", "url": "https://issues.chromium.org/issues/40061678", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>TopChrome>SidePanel", "reporter": "al...@alesandroortiz.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-11-10T01:05:10+00:00", "year": 2022, "attachment_count": 3, "local_path": "issues/40061678", "has_markdown": true }, { "id": "40061670", "title": "UAF in search::(anonymous namespace)::NewTabURLDetails::ForProfile(Profile*)", "url": "https://issues.chromium.org/issues/40061670", "status": "Assigned", "severity": "S3-Low", "component": "Internals>Core, Internals>Sandbox>SiteIsolation, UI>Browser>Profiles", "reporter": "em...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-11-09T12:49:12+00:00", "year": 2022, "attachment_count": 4, "local_path": "issues/40061670", "has_markdown": true }, { "id": "40061666", "title": "UAF in ScreenAIServiceRouter", "url": "https://issues.chromium.org/issues/40061666", "status": "Assigned", "severity": "S4-Minimal", "component": "UI>Accessibility", "reporter": "ha...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-11-09T07:48:04+00:00", "year": 2022, "attachment_count": 10, "local_path": "issues/40061666", "has_markdown": true }, { "id": "40061660", "title": "Security: UAF in validation_message_overlay_delegate", "url": "https://issues.chromium.org/issues/40061660", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Forms", "reporter": "sp...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-11-08T22:39:42+00:00", "year": 2022, "attachment_count": 2, "local_path": "issues/40061660", "has_markdown": true }, { "id": "40061657", "title": "Security: Chrome on Android Keyboard Able to Overlap Fullscreen Notification Toast", "url": "https://issues.chromium.org/issues/40061657", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Fullscreen, UI>Browser>FullScreen", "reporter": "su...@gmail.com", "cve_ids": [], "bounty_amount": 7500.0, "reward_amount_meta": 7500.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-11-08T18:18:25+00:00", "year": 2022, "attachment_count": 9, "local_path": "issues/40061657", "has_markdown": true }, { "id": "40061649", "title": "UAF in ScreenAIService", "url": "https://issues.chromium.org/issues/40061649", "status": "Assigned", "severity": "S4-Minimal", "component": "UI>Accessibility", "reporter": "ha...@gmail.com", "cve_ids": [], "bounty_amount": 2500.0, "reward_amount_meta": 2500.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-11-08T11:57:26+00:00", "year": 2022, "attachment_count": 10, "local_path": "issues/40061649", "has_markdown": true }, { "id": "40061636", "title": "Security: heap-buffer-overflow in network::ThrottlingNetworkInterceptor::UpdateThrottledRecords", "url": "https://issues.chromium.org/issues/40061636", "status": "Assigned", "severity": "S3-Low", "component": "Internals>Services>Network, Platform>DevTools>Network", "reporter": "0x...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-11-07T14:41:15+00:00", "year": 2022, "attachment_count": 2, "local_path": "issues/40061636", "has_markdown": true }, { "id": "40061620", "title": "UAF in blink::WidgetBase::BeginMainFrame(base::TimeTicks)", "url": "https://issues.chromium.org/issues/40061620", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Internals>Frames, Platform>DevTools, UI>Browser>Navigation", "reporter": "em...@gmail.com", "cve_ids": [], "bounty_amount": 1500.0, "reward_amount_meta": 1500.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-11-06T17:02:02+00:00", "year": 2022, "attachment_count": 3, "local_path": "issues/40061620", "has_markdown": true }, { "id": "40061617", "title": "Security: ChromiumOS CRAS Server D-Bus SetGlobalOutputChannelRemix heap-over-flow", "url": "https://issues.chromium.org/issues/40061617", "status": "New", "severity": "S4-Minimal", "component": "Internals>Media>Audio", "reporter": "hi...@gmail.com", "cve_ids": [], "bounty_amount": 13000.0, "reward_amount_meta": 13000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-11-06T12:50:08+00:00", "year": 2022, "attachment_count": 1, "local_path": "issues/40061617", "has_markdown": true }, { "id": "40061616", "title": "Memory corruption in PresentationRequest", "url": "https://issues.chromium.org/issues/40061616", "status": "Assigned", "severity": "S3-Low", "component": "Blink>PresentationAPI", "reporter": "ha...@gmail.com", "cve_ids": [], "bounty_amount": 8500.0, "reward_amount_meta": 8500.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-11-06T07:32:47+00:00", "year": 2022, "attachment_count": 6, "local_path": "issues/40061616", "has_markdown": true }, { "id": "40061594", "title": "Use-after-free in the filepicker", "url": "https://issues.chromium.org/issues/40061594", "status": "Assigned", "severity": "S3-Low", "component": "Internals>Views", "reporter": "so...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-11-04T11:46:38+00:00", "year": 2022, "attachment_count": 7, "local_path": "issues/40061594", "has_markdown": true }, { "id": "40061592", "title": "Security: UAF in VideoCaptureDeviceWin", "url": "https://issues.chromium.org/issues/40061592", "status": "Assigned", "severity": "S3-Low", "component": "Internals>Media>CameraCapture", "reporter": "le...@gmail.com", "cve_ids": [], "bounty_amount": 11000.0, "reward_amount_meta": 11000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-11-04T08:43:02+00:00", "year": 2022, "attachment_count": 2, "local_path": "issues/40061592", "has_markdown": true }, { "id": "40061591", "title": "Security: UAF in device_del", "url": "https://issues.chromium.org/issues/40061591", "status": "Assigned", "severity": "S3-Low", "component": "Unknown", "reporter": "ha...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-11-04T05:17:45+00:00", "year": 2022, "attachment_count": 0, "local_path": "issues/40061591", "has_markdown": true }, { "id": "40061589", "title": "Security: Debug check failed: kCanBeWeak || (!IsSmi() == HAS_STRONG_HEAP_OBJECT_TAG(ptr_)).", "url": "https://issues.chromium.org/issues/40061589", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript>Compiler>Maglev", "reporter": "p4...@gmail.com", "cve_ids": [], "bounty_amount": 11000.0, "reward_amount_meta": 11000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-11-04T03:07:45+00:00", "year": 2022, "attachment_count": 1, "local_path": "issues/40061589", "has_markdown": true }, { "id": "40061586", "title": "Security: Bypass 1342722, sourceMappingURL directive allows use of UNC paths on Windows", "url": "https://issues.chromium.org/issues/40061586", "status": "Assigned", "severity": "S3-Low", "component": "Unknown", "reporter": "ha...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-11-03T19:39:34+00:00", "year": 2022, "attachment_count": 5, "local_path": "issues/40061586", "has_markdown": true }, { "id": "40061558", "title": "Security: Use After Free in PasswordsPrivateDelegateImpl::OsReauthTimeoutCall,", "url": "https://issues.chromium.org/issues/40061558", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>Passwords, UI>Settings", "reporter": "yq...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-11-02T03:34:29+00:00", "year": 2022, "attachment_count": 0, "local_path": "issues/40061558", "has_markdown": true }, { "id": "40061557", "title": "Security: heap-use-after-free ui/views/view.cc:1921:7 in views::View::HandleAccessibleAction", "url": "https://issues.chromium.org/issues/40061557", "status": "Assigned", "severity": "S4-Minimal", "component": "UI>Accessibility", "reporter": "rh...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-11-02T00:04:03+00:00", "year": 2022, "attachment_count": 2, "local_path": "issues/40061557", "has_markdown": true }, { "id": "40061543", "title": "Use-after-poison in blink::CSSSelector::SelectorListOrParent", "url": "https://issues.chromium.org/issues/40061543", "status": "Assigned", "severity": "S4-Minimal", "component": "Blink>CSS", "reporter": "m....@gmail.com", "cve_ids": [], "bounty_amount": 12000.0, "reward_amount_meta": 12000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-11-01T08:39:59+00:00", "year": 2022, "attachment_count": 1, "local_path": "issues/40061543", "has_markdown": true }, { "id": "40061519", "title": "Security: heap-use-after-free browser\\renderer_host\\render_process_host_impl.cc:2068 in content::RenderProcessHostImpl::CreateNotificationService", "url": "https://issues.chromium.org/issues/40061519", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>Navigation>BFCache, UI>Notifications", "reporter": "m....@gmail.com", "cve_ids": [], "bounty_amount": 8000.0, "reward_amount_meta": 8000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-10-29T14:56:24+00:00", "year": 2022, "attachment_count": 4, "local_path": "issues/40061519", "has_markdown": true }, { "id": "40061509", "title": "Incorrect handle of url scheme lead to rce+sbx escape", "url": "https://issues.chromium.org/issues/40061509", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>Permissions>Prompts", "reporter": "su...@gmail.com", "cve_ids": [ "CVE-2021-1810", "CVE-2021-30657", "CVE-2022-22616", "CVE-2022-32910" ], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-10-28T14:27:21+00:00", "year": 2022, "attachment_count": 5, "local_path": "issues/40061509", "has_markdown": true }, { "id": "40061505", "title": "UAF in ExtensionInstalledWaiter", "url": "https://issues.chromium.org/issues/40061505", "status": "Assigned", "severity": "S3-Low", "component": "Platform>Extensions", "reporter": "ha...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-10-28T08:36:50+00:00", "year": 2022, "attachment_count": 1, "local_path": "issues/40061505", "has_markdown": true }, { "id": "40061504", "title": "Security: Stack-buffer-overflow in WebGL vulkan backend", "url": "https://issues.chromium.org/issues/40061504", "status": "Assigned", "severity": "S3-Low", "component": "Internals>GPU>ANGLE", "reporter": "et...@gmail.com", "cve_ids": [], "bounty_amount": 11000.0, "reward_amount_meta": 11000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-10-28T03:02:57+00:00", "year": 2022, "attachment_count": 7, "local_path": "issues/40061504", "has_markdown": true }, { "id": "40061500", "title": "Security: Promise.any.call leak hole, leading to RCE", "url": "https://issues.chromium.org/issues/40061500", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript>Runtime", "reporter": "ki...@gmail.com", "cve_ids": [], "bounty_amount": 15000.0, "reward_amount_meta": 15000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-10-27T16:08:43+00:00", "year": 2022, "attachment_count": 2, "local_path": "issues/40061500", "has_markdown": true }, { "id": "40061499", "title": "Security: FileChooserImpl still traverse symlink in symlink to directory", "url": "https://issues.chromium.org/issues/40061499", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Forms>File>Directory", "reporter": "ha...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-10-27T14:34:14+00:00", "year": 2022, "attachment_count": 2, "local_path": "issues/40061499", "has_markdown": true }, { "id": "40061482", "title": "Security: UAF in MultiplexEncoderFactory", "url": "https://issues.chromium.org/issues/40061482", "status": "Assigned", "severity": "S3-Low", "component": "Blink>WebRTC", "reporter": "le...@gmail.com", "cve_ids": [], "bounty_amount": 11000.0, "reward_amount_meta": 11000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-10-26T12:23:48+00:00", "year": 2022, "attachment_count": 2, "local_path": "issues/40061482", "has_markdown": true }, { "id": "40061481", "title": "Use-after-free in Mojo ChannelMac::SendMessageLocked", "url": "https://issues.chromium.org/issues/40061481", "status": "Assigned", "severity": "S3-Low", "component": "Internals>Mojo", "reporter": "he...@gmail.com", "cve_ids": [], "bounty_amount": 30000.0, "reward_amount_meta": 30000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-10-26T12:02:41+00:00", "year": 2022, "attachment_count": 6, "local_path": "issues/40061481", "has_markdown": true }, { "id": "40061477", "title": "Security: FSA API's directory methods allows traversing symlinks in folders on Windows (even to restricted directories)", "url": "https://issues.chromium.org/issues/40061477", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Storage>FileSystem", "reporter": "ha...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-10-26T08:19:58+00:00", "year": 2022, "attachment_count": 1, "local_path": "issues/40061477", "has_markdown": true }, { "id": "40061476", "title": "Out of bound write in GPU", "url": "https://issues.chromium.org/issues/40061476", "status": "Assigned", "severity": "S3-Low", "component": "Internals>GPU>ANGLE, Internals>GPU>SwiftShader, Internals>GPU>Testing", "reporter": "ha...@gmail.com", "cve_ids": [], "bounty_amount": 15000.0, "reward_amount_meta": 15000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-10-26T07:27:28+00:00", "year": 2022, "attachment_count": 4, "local_path": "issues/40061476", "has_markdown": true }, { "id": "40061475", "title": "Security: UAF in PasswordAutofillManager::OnBiometricReauthCompleted", "url": "https://issues.chromium.org/issues/40061475", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>Autofill", "reporter": "jt...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-10-26T04:09:05+00:00", "year": 2022, "attachment_count": 4, "local_path": "issues/40061475", "has_markdown": true }, { "id": "40061467", "title": "Security: Heap-use-after-free in InstallablePaymentAppCrawler::OnPaymentMethodManifestParsed", "url": "https://issues.chromium.org/issues/40061467", "status": "New", "severity": "S3-Low", "component": "Blink>Payments", "reporter": "me...@gmail.com", "cve_ids": [], "bounty_amount": 39000.0, "reward_amount_meta": 39000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-10-25T16:00:34+00:00", "year": 2022, "attachment_count": 8, "local_path": "issues/40061467", "has_markdown": true }, { "id": "40061453", "title": "Security: WebAssembly UAF in catch block with stale memory start pointer", "url": "https://issues.chromium.org/issues/40061453", "status": "Assigned", "severity": "S4-Minimal", "component": "Blink>JavaScript>Runtime", "reporter": "gz...@gmail.com", "cve_ids": [], "bounty_amount": 21000.0, "reward_amount_meta": 21000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-10-24T14:40:47+00:00", "year": 2022, "attachment_count": 4, "local_path": "issues/40061453", "has_markdown": true }, { "id": "40061426", "title": "Reading local files through an extension that only has the \"downloads\" permission", "url": "https://issues.chromium.org/issues/40061426", "status": "Assigned", "severity": "S3-Low", "component": "Platform>Extensions>API, UI>Browser>Downloads", "reporter": "he...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-10-21T01:01:23+00:00", "year": 2022, "attachment_count": 3, "local_path": "issues/40061426", "has_markdown": true }, { "id": "40061424", "title": "uaf in FederatedAuthRequestimpl", "url": "https://issues.chromium.org/issues/40061424", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Identity>FedCM", "reporter": "ha...@gmail.com", "cve_ids": [], "bounty_amount": 10000.0, "reward_amount_meta": 10000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-10-20T16:41:20+00:00", "year": 2022, "attachment_count": 5, "local_path": "issues/40061424", "has_markdown": true }, { "id": "40061408", "title": "UAF in network::WebTransport::TearDown", "url": "https://issues.chromium.org/issues/40061408", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Network>WebTransport", "reporter": "em...@gmail.com", "cve_ids": [], "bounty_amount": 16000.0, "reward_amount_meta": 16000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-10-19T05:50:16+00:00", "year": 2022, "attachment_count": 3, "local_path": "issues/40061408", "has_markdown": true }, { "id": "40061374", "title": "Security: Device chooser dialogs do not show origin if initiator origin is opaque", "url": "https://issues.chromium.org/issues/40061374", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Bluetooth, Blink>HID, Blink>Serial, Blink>USB, UI>Browser>Permissions>Prompts", "reporter": "al...@alesandroortiz.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-10-16T23:59:15+00:00", "year": 2022, "attachment_count": 10, "local_path": "issues/40061374", "has_markdown": true }, { "id": "40061373", "title": "Security: Android: Bluetooth and USB chooser dialogs do not use top-level origin with permission delegation", "url": "https://issues.chromium.org/issues/40061373", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Bluetooth, Blink>USB, UI>Browser>Permissions>Prompts", "reporter": "al...@alesandroortiz.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-10-16T23:56:53+00:00", "year": 2022, "attachment_count": 7, "local_path": "issues/40061373", "has_markdown": true }, { "id": "40061370", "title": "Security: UAF in webgpu\\gpu.cc in blink::`anonymous namespace'::CreateContextProviderOnMainThread", "url": "https://issues.chromium.org/issues/40061370", "status": "Assigned", "severity": "S3-Low", "component": "Dawn", "reporter": "m....@gmail.com", "cve_ids": [], "bounty_amount": 8000.0, "reward_amount_meta": 8000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-10-16T08:04:40+00:00", "year": 2022, "attachment_count": 4, "local_path": "issues/40061370", "has_markdown": true }, { "id": "40061367", "title": "Multiple checks fail, cross process crash, maybe race condition & use-after-free in video_encoder.cc", "url": "https://issues.chromium.org/issues/40061367", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Media>WebCodecs", "reporter": "so...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-10-15T21:32:15+00:00", "year": 2022, "attachment_count": 7, "local_path": "issues/40061367", "has_markdown": true }, { "id": "40061363", "title": "uaf in FederatedAuthRequestImpl", "url": "https://issues.chromium.org/issues/40061363", "status": "Accepted", "severity": "S3-Low", "component": "Blink>Identity>FedCM", "reporter": "ha...@gmail.com", "cve_ids": [], "bounty_amount": 10000.0, "reward_amount_meta": 10000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-10-15T06:29:10+00:00", "year": 2022, "attachment_count": 7, "local_path": "issues/40061363", "has_markdown": true }, { "id": "40061335", "title": "Security: access-violation src\\v8\\src\\api\\api.cc:5809 in v8::String::WriteOneByte", "url": "https://issues.chromium.org/issues/40061335", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Bindings, Blink>ImageCapture, Blink>JavaScript>API", "reporter": "m....@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-10-13T14:23:50+00:00", "year": 2022, "attachment_count": 9, "local_path": "issues/40061335", "has_markdown": true }, { "id": "40061321", "title": "Security: heap-use-after-free in ProfileDestroyer::DestroyProfileNow", "url": "https://issues.chromium.org/issues/40061321", "status": "Assigned", "severity": "S3-Low", "component": "Unknown", "reporter": "ne...@nesk.kr", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-10-12T16:47:27+00:00", "year": 2022, "attachment_count": 1, "local_path": "issues/40061321", "has_markdown": true }, { "id": "40061297", "title": "iOS Chrome Modal Dialog Spoof resulting to URL Spoof", "url": "https://issues.chromium.org/issues/40061297", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>Navigation", "reporter": "pr...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-10-10T11:11:34+00:00", "year": 2022, "attachment_count": 1, "local_path": "issues/40061297", "has_markdown": true }, { "id": "40061294", "title": "Security: Heap-use-after-free in SpeechRecognitionRecognizerImpl::ChangeLanguage", "url": "https://issues.chromium.org/issues/40061294", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Speech", "reporter": "tt...@gmail.com", "cve_ids": [], "bounty_amount": 10000.0, "reward_amount_meta": 10000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-10-10T08:57:11+00:00", "year": 2022, "attachment_count": 3, "local_path": "issues/40061294", "has_markdown": true }, { "id": "40061289", "title": "The PWA's installation dialog isn't being dismissed after redirects, which allows an attacker to show it on cross-origin pages", "url": "https://issues.chromium.org/issues/40061289", "status": "Fixed", "severity": "S3-Low", "component": "UI>Browser>WebAppInstalls", "reporter": "he...@gmail.com", "cve_ids": [], "bounty_amount": 4000.0, "reward_amount_meta": 4000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-10-09T18:37:18+00:00", "year": 2022, "attachment_count": 5, "local_path": "issues/40061289", "has_markdown": true }, { "id": "40061287", "title": "The name attribute length on a PWA's manifest doesn't have a limit, which allows an attacker to spoof its message and origin", "url": "https://issues.chromium.org/issues/40061287", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>WebAppInstalls", "reporter": "he...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-10-09T17:05:08+00:00", "year": 2022, "attachment_count": 8, "local_path": "issues/40061287", "has_markdown": true }, { "id": "40061280", "title": "use after poison in HeapObjectHeader::LoadEncoded()", "url": "https://issues.chromium.org/issues/40061280", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript>GarbageCollection", "reporter": "em...@gmail.com", "cve_ids": [], "bounty_amount": 10000.0, "reward_amount_meta": 10000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-10-08T19:21:04+00:00", "year": 2022, "attachment_count": 5, "local_path": "issues/40061280", "has_markdown": true }, { "id": "40061279", "title": "Security: Heap-use-after-free in ash::OverviewItem::ShowWindowInOverview", "url": "https://issues.chromium.org/issues/40061279", "status": "Assigned", "severity": "S3-Low", "component": "Internals>Views>Desktop", "reporter": "ch...@gmail.com", "cve_ids": [], "bounty_amount": 1500.0, "reward_amount_meta": 1500.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-10-08T14:58:34+00:00", "year": 2022, "attachment_count": 1, "local_path": "issues/40061279", "has_markdown": true }, { "id": "40061277", "title": "Security: Heap-use-after-free in ash::ScopedOverviewHideWindows::~ScopedOverviewHideWindows", "url": "https://issues.chromium.org/issues/40061277", "status": "Accepted", "severity": "S3-Low", "component": "Internals>Views>Desktop", "reporter": "ch...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-10-08T13:28:14+00:00", "year": 2022, "attachment_count": 3, "local_path": "issues/40061277", "has_markdown": true }, { "id": "40061275", "title": "Security: heap-use-after-free third_party\\blink\\renderer\\core\\workers\\worker_thread.cc:905 in blink::WorkerThread::PauseOrFreezeOnWorkerThread", "url": "https://issues.chromium.org/issues/40061275", "status": "Assigned", "severity": "S3-Low", "component": "Blink>GarbageCollection, Blink>WebAudio, Blink>Workers", "reporter": "m....@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-10-08T07:10:48+00:00", "year": 2022, "attachment_count": 4, "local_path": "issues/40061275", "has_markdown": true }, { "id": "40061250", "title": "Security: UAF in mojo::SimpleWatcher::Context in MojoIpcz feature (browser process)", "url": "https://issues.chromium.org/issues/40061250", "status": "Fixed", "severity": "S3-Low", "component": "Internals>Mojo", "reporter": "0x...@gmail.com", "cve_ids": [], "bounty_amount": 20000.0, "reward_amount_meta": 20000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-10-06T12:27:12+00:00", "year": 2022, "attachment_count": 13, "local_path": "issues/40061250", "has_markdown": true }, { "id": "40061249", "title": "stack-use-after-return in gpu::gles2::ProgramInfoManager::Program::UpdateES2", "url": "https://issues.chromium.org/issues/40061249", "status": "Assigned", "severity": "S3-Low", "component": "Internals>GPU>Internals", "reporter": "em...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-10-06T12:26:40+00:00", "year": 2022, "attachment_count": 4, "local_path": "issues/40061249", "has_markdown": true }, { "id": "40061248", "title": "Security: UAF in PluginVmInstaller::DetectImageType", "url": "https://issues.chromium.org/issues/40061248", "status": "Assigned", "severity": "S3-Low", "component": "Unknown", "reporter": "ya...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-10-06T11:39:07+00:00", "year": 2022, "attachment_count": 0, "local_path": "issues/40061248", "has_markdown": true }, { "id": "40061230", "title": "Security: Forced user interaction for permission prompts by freezing the browser", "url": "https://issues.chromium.org/issues/40061230", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>Permissions>Prompts", "reporter": "re...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-10-04T20:38:03+00:00", "year": 2022, "attachment_count": 5, "local_path": "issues/40061230", "has_markdown": true }, { "id": "40061219", "title": "Security: Files saved through showSaveFilePicker have unexpected read access", "url": "https://issues.chromium.org/issues/40061219", "status": "Verified", "severity": "S3-Low", "component": "Blink>Storage>FileSystem", "reporter": "re...@gmail.com", "cve_ids": [], "bounty_amount": 500.0, "reward_amount_meta": 500.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-10-03T19:03:54+00:00", "year": 2022, "attachment_count": 3, "local_path": "issues/40061219", "has_markdown": true }, { "id": "40061217", "title": "Arbitrary URI Origin Spoof on Chrome Android Incognito mode", "url": "https://issues.chromium.org/issues/40061217", "status": "Accepted", "severity": "S3-Low", "component": "UI>Browser>Navigation", "reporter": "pr...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-10-03T17:25:39+00:00", "year": 2022, "attachment_count": 0, "local_path": "issues/40061217", "has_markdown": true }, { "id": "40061216", "title": "uaf in ui::PropertyHandler::GetPropertyInternal(with )", "url": "https://issues.chromium.org/issues/40061216", "status": "Assigned", "severity": "S4-Minimal", "component": "Internals>Accessibility, UI>Accessibility", "reporter": "em...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-10-03T16:06:09+00:00", "year": 2022, "attachment_count": 4, "local_path": "issues/40061216", "has_markdown": true }, { "id": "40061212", "title": "UAF in SelectFileDialogLinuxKde::CallKDialogOutput", "url": "https://issues.chromium.org/issues/40061212", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser", "reporter": "ro...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-10-03T01:54:00+00:00", "year": 2022, "attachment_count": 3, "local_path": "issues/40061212", "has_markdown": true }, { "id": "40061190", "title": "Security: Chrome on Android the Fullscreen Notification Toast Not shown when fullscreen (screen lock mode landscape)", "url": "https://issues.chromium.org/issues/40061190", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Fullscreen", "reporter": "sa...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-09-30T15:05:35+00:00", "year": 2022, "attachment_count": 2, "local_path": "issues/40061190", "has_markdown": true }, { "id": "40061186", "title": "Security: use-after-poison interface_endpoint_client.cc:900 in mojo::InterfaceEndpointClient::HandleValidatedMessage", "url": "https://issues.chromium.org/issues/40061186", "status": "Assigned", "severity": "S3-Low", "component": "Blink>WebRTC>PeerConnection", "reporter": "m....@gmail.com", "cve_ids": [], "bounty_amount": 10000.0, "reward_amount_meta": 10000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-09-30T08:00:12+00:00", "year": 2022, "attachment_count": 7, "local_path": "issues/40061186", "has_markdown": true }, { "id": "40061184", "title": "Security: Race condition in JSCreateLowering, leading to RCE", "url": "https://issues.chromium.org/issues/40061184", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript>Compiler", "reporter": "ss...@gmail.com", "cve_ids": [], "bounty_amount": 20000.0, "reward_amount_meta": 20000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-09-30T07:11:08+00:00", "year": 2022, "attachment_count": 5, "local_path": "issues/40061184", "has_markdown": true }, { "id": "40061164", "title": "Security: FencedFrame - Two way communication between embedder and frame", "url": "https://issues.chromium.org/issues/40061164", "status": "Assigned", "severity": "S3-Low", "component": "Blink>FencedFrames", "reporter": "so...@gmail.com", "cve_ids": [], "bounty_amount": 6000.0, "reward_amount_meta": 6000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-09-27T19:15:00+00:00", "year": 2022, "attachment_count": 12, "local_path": "issues/40061164", "has_markdown": true }, { "id": "40061152", "title": "Security: SameSite cookie bypass on Android by redirecting to to intent-picker", "url": "https://issues.chromium.org/issues/40061152", "status": "Assigned", "severity": "S3-Low", "component": "Internals>Network>Cookies, Mobile>Intents", "reporter": "ha...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-09-26T18:23:22+00:00", "year": 2022, "attachment_count": 6, "local_path": "issues/40061152", "has_markdown": true }, { "id": "40061151", "title": "Security: Report 2 Vulnerabilities in WebSQL", "url": "https://issues.chromium.org/issues/40061151", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Storage>WebSQL", "reporter": "13...@gmail.com", "cve_ids": [], "bounty_amount": 13000.0, "reward_amount_meta": 13000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-09-26T12:47:19+00:00", "year": 2022, "attachment_count": 2, "local_path": "issues/40061151", "has_markdown": true }, { "id": "40061150", "title": "Security: Type confusion in V8", "url": "https://issues.chromium.org/issues/40061150", "status": "Fixed", "severity": "S4-Minimal", "component": "Blink>JavaScript>Compiler>Maglev", "reporter": "p4...@gmail.com", "cve_ids": [], "bounty_amount": 10000.0, "reward_amount_meta": 10000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-09-26T11:06:14+00:00", "year": 2022, "attachment_count": 1, "local_path": "issues/40061150", "has_markdown": true }, { "id": "40061129", "title": "Security: Extension sanitization bypass by using %% ", "url": "https://issues.chromium.org/issues/40061129", "status": "Accepted", "severity": "S3-Low", "component": "UI>Browser>Downloads", "reporter": "ha...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-09-24T13:19:29+00:00", "year": 2022, "attachment_count": 3, "local_path": "issues/40061129", "has_markdown": true }, { "id": "40061108", "title": "Security: [webkit] heap-use-after-free in WebCore::DOMWrapperWorld::~DOMWrapperWorld()+0x25b", "url": "https://issues.chromium.org/issues/40061108", "status": "Assigned", "severity": "S3-Low", "component": "Mobile>iOSWeb", "reporter": "m....@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-09-23T03:24:46+00:00", "year": 2022, "attachment_count": 2, "local_path": "issues/40061108", "has_markdown": true }, { "id": "40061104", "title": "Security: Web Share dialog URL is incorrectly elided in Android (ineffective fix for issue 1329541)", "url": "https://issues.chromium.org/issues/40061104", "status": "Assigned", "severity": "S3-Low", "component": "Blink>WebShare, UI>Security (Use Subcomponent)>UrlFormatting", "reporter": "al...@alesandroortiz.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-09-23T00:41:41+00:00", "year": 2022, "attachment_count": 13, "local_path": "issues/40061104", "has_markdown": true }, { "id": "40061099", "title": "uaf in v8_inspector::InjectedScript::addPromiseCallback", "url": "https://issues.chromium.org/issues/40061099", "status": "Assigned", "severity": "S3-Low", "component": "Unknown", "reporter": "em...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-09-22T15:03:51+00:00", "year": 2022, "attachment_count": 3, "local_path": "issues/40061099", "has_markdown": true }, { "id": "40061097", "title": "Security: custom_element_registry use-after-poison", "url": "https://issues.chromium.org/issues/40061097", "status": "Assigned", "severity": "S3-Low", "component": "Blink>HTML>CustomElements", "reporter": "sp...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-09-22T13:34:49+00:00", "year": 2022, "attachment_count": 2, "local_path": "issues/40061097", "has_markdown": true }, { "id": "40061096", "title": "Security: UAF in content::DevToolsSession::DispatchProtocolResponse (browser process)", "url": "https://issues.chromium.org/issues/40061096", "status": "Assigned", "severity": "S3-Low", "component": "Platform>DevTools>Extensions", "reporter": "0x...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-09-22T13:31:52+00:00", "year": 2022, "attachment_count": 3, "local_path": "issues/40061096", "has_markdown": true }, { "id": "40061095", "title": "Security: Heap-use-after-free in InstallablePaymentAppCrawler::OnPaymentMethodManifestParsed", "url": "https://issues.chromium.org/issues/40061095", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Payments", "reporter": "me...@gmail.com", "cve_ids": [], "bounty_amount": 38000.0, "reward_amount_meta": 38000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-09-22T13:15:03+00:00", "year": 2022, "attachment_count": 5, "local_path": "issues/40061095", "has_markdown": true }, { "id": "40061060", "title": "Security: UAF in ash::network_diagnostics::DnsResolutionRoutine::CreateHostResolver() (browser process)", "url": "https://issues.chromium.org/issues/40061060", "status": "Assigned", "severity": "S3-Low", "component": "Platform>Apps>Diagnostics>Connectivity", "reporter": "0x...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-09-20T13:41:32+00:00", "year": 2022, "attachment_count": 3, "local_path": "issues/40061060", "has_markdown": true }, { "id": "40061046", "title": "Security: [maglev] VisitSwitchOnGeneratorState function JumpTableTargetOffsets can be 0 ", "url": "https://issues.chromium.org/issues/40061046", "status": "Fixed", "severity": "S3-Low", "component": "Blink>JavaScript", "reporter": "vi...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-09-19T13:35:29+00:00", "year": 2022, "attachment_count": 1, "local_path": "issues/40061046", "has_markdown": true }, { "id": "40061026", "title": "Security: Extension can obscure active window with an unfocused window, allows interaction with permission API prompt dialog without awareness", "url": "https://issues.chromium.org/issues/40061026", "status": "Accepted", "severity": "S3-Low", "component": "Platform>Extensions>API", "reporter": "vi...@gmail.com", "cve_ids": [ "CVE-2022-2616" ], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-09-18T08:28:50+00:00", "year": 2022, "attachment_count": 15, "local_path": "issues/40061026", "has_markdown": true }, { "id": "40061025", "title": "Security: Bypass iframe sandbox on Android via intent:// URLs (possibly due to intent:// url popups not inheriting sandbox)", "url": "https://issues.chromium.org/issues/40061025", "status": "Assigned", "severity": "S3-Low", "component": "Blink>SecurityFeature>IFrameSandbox, Mobile>Intents", "reporter": "ha...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-09-18T08:04:45+00:00", "year": 2022, "attachment_count": 5, "local_path": "issues/40061025", "has_markdown": true }, { "id": "40061023", "title": "Lack of security measure for origin of downloaded files: iOS and non-iOS", "url": "https://issues.chromium.org/issues/40061023", "status": "Accepted", "severity": "S3-Low", "component": "Mobile>iOSWeb, UI>Browser>Downloads", "reporter": "pr...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-09-18T02:35:36+00:00", "year": 2022, "attachment_count": 3, "local_path": "issues/40061023", "has_markdown": true }, { "id": "40061003", "title": "Security: UAF in in safe_browsing::IncidentReportingService::AddIncident(browser process)", "url": "https://issues.chromium.org/issues/40061003", "status": "Assigned", "severity": "S3-Low", "component": "Unknown", "reporter": "0x...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-09-16T17:48:48+00:00", "year": 2022, "attachment_count": 3, "local_path": "issues/40061003", "has_markdown": true }, { "id": "40061001", "title": "Security: heap-use-after-free in GrClientMappedBufferManager::owningDirectContext", "url": "https://issues.chromium.org/issues/40061001", "status": "Assigned", "severity": "S3-Low", "component": "Blink>WebGL, Internals>GPU, Internals>Skia", "reporter": "et...@gmail.com", "cve_ids": [ "CVE-2022-3445" ], "bounty_amount": 15000.0, "reward_amount_meta": 15000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-09-16T14:04:07+00:00", "year": 2022, "attachment_count": 3, "local_path": "issues/40061001", "has_markdown": true }, { "id": "40060996", "title": "Security: Heap-use-after-free in UnusedSitePermissionsService::UpdateUnusedPermissionsAsync", "url": "https://issues.chromium.org/issues/40060996", "status": "Assigned", "severity": "S3-Low", "component": "Internals>Permissions", "reporter": "me...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-09-16T08:14:32+00:00", "year": 2022, "attachment_count": 3, "local_path": "issues/40060996", "has_markdown": true }, { "id": "40060987", "title": "Security: UAF in device_is_authenticating", "url": "https://issues.chromium.org/issues/40060987", "status": "Assigned", "severity": "S3-Low", "component": "IO>Bluetooth", "reporter": "yq...@gmail.com", "cve_ids": [], "bounty_amount": 500.0, "reward_amount_meta": 500.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-09-15T15:08:21+00:00", "year": 2022, "attachment_count": 0, "local_path": "issues/40060987", "has_markdown": true }, { "id": "40060984", "title": "Security: UAF in TransportClientSocket", "url": "https://issues.chromium.org/issues/40060984", "status": "Assigned", "severity": "S3-Low", "component": "Internals>Network", "reporter": "le...@gmail.com", "cve_ids": [], "bounty_amount": 11000.0, "reward_amount_meta": 11000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-09-15T09:22:45+00:00", "year": 2022, "attachment_count": 2, "local_path": "issues/40060984", "has_markdown": true }, { "id": "40060968", "title": "Security: Heap-use-after-free in UserNoteService::OnNoteCreationDone", "url": "https://issues.chromium.org/issues/40060968", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>Creation", "reporter": "me...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-09-14T12:15:08+00:00", "year": 2022, "attachment_count": 4, "local_path": "issues/40060968", "has_markdown": true }, { "id": "40060951", "title": "uaf in PermissionStatus::OnPermissionStatusChange", "url": "https://issues.chromium.org/issues/40060951", "status": "Assigned", "severity": "S3-Low", "component": "Blink>PermissionsAPI", "reporter": "wx...@gmail.com", "cve_ids": [], "bounty_amount": 2500.0, "reward_amount_meta": 2500.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-09-13T07:08:21+00:00", "year": 2022, "attachment_count": 8, "local_path": "issues/40060951", "has_markdown": true }, { "id": "40060925", "title": "Generic CORS bypass that enables Cross-Site-Tracing (XST)", "url": "https://issues.chromium.org/issues/40060925", "status": "Assigned", "severity": "S3-Low", "component": "Blink>SecurityFeature>CORS", "reporter": "ma...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-09-11T20:06:31+00:00", "year": 2022, "attachment_count": 0, "local_path": "issues/40060925", "has_markdown": true }, { "id": "40060875", "title": "Security: heap-buffer-overflow components/ui_devtools/ui_element.cc:112:5", "url": "https://issues.chromium.org/issues/40060875", "status": "Accepted", "severity": "S3-Low", "component": "Internals>Views>UIDevtools", "reporter": "rh...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-09-08T05:30:36+00:00", "year": 2022, "attachment_count": 4, "local_path": "issues/40060875", "has_markdown": true }, { "id": "40060864", "title": "Security: Lockscreen - phone options available", "url": "https://issues.chromium.org/issues/40060864", "status": "Accepted", "severity": "S3-Low", "component": "UI>Browser>Sharing", "reporter": "he...@googlemail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-09-07T21:28:44+00:00", "year": 2022, "attachment_count": 0, "local_path": "issues/40060864", "has_markdown": true }, { "id": "40060852", "title": "Security: heap-use-after-free in the Metal features in the GPU process", "url": "https://issues.chromium.org/issues/40060852", "status": "Fixed", "severity": "S3-Low", "component": "Internals>Skia", "reporter": "0x...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-09-07T07:54:00+00:00", "year": 2022, "attachment_count": 2, "local_path": "issues/40060852", "has_markdown": true }, { "id": "40060848", "title": "Security: Custom cursor can overlay parts of the permission prompt.", "url": "https://issues.chromium.org/issues/40060848", "status": "Accepted", "severity": "S3-Low", "component": "Blink>Input", "reporter": "ha...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-09-07T05:53:38+00:00", "year": 2022, "attachment_count": 2, "local_path": "issues/40060848", "has_markdown": true }, { "id": "40060755", "title": "Security: SOP bypass leaks navigation history of iframe from other subdomain if location changed to about:blank", "url": "https://issues.chromium.org/issues/40060755", "status": "Assigned", "severity": "S3-Low", "component": "Internals>Sandbox>SiteIsolation, UI>Browser>Navigation", "reporter": "jo...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-09-01T22:05:59+00:00", "year": 2022, "attachment_count": 9, "local_path": "issues/40060755", "has_markdown": true }, { "id": "40060747", "title": "Heap-use-after-free in blink::StyleVariables::operator==", "url": "https://issues.chromium.org/issues/40060747", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Animation, Blink>CSS", "reporter": "m....@gmail.com", "cve_ids": [], "bounty_amount": 9000.0, "reward_amount_meta": 9000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-09-01T12:56:10+00:00", "year": 2022, "attachment_count": 1, "local_path": "issues/40060747", "has_markdown": true }, { "id": "40060744", "title": "Security: UAF in CompoundTabContainer", "url": "https://issues.chromium.org/issues/40060744", "status": "Accepted", "severity": "S3-Low", "component": "UI>Browser>TopChrome>TabStrip", "reporter": "le...@gmail.com", "cve_ids": [], "bounty_amount": 8000.0, "reward_amount_meta": 8000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-09-01T10:42:58+00:00", "year": 2022, "attachment_count": 4, "local_path": "issues/40060744", "has_markdown": true }, { "id": "40060742", "title": "Security: Bypass the Protection of input fields cache (Autofill) 1108181", "url": "https://issues.chromium.org/issues/40060742", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>Autofill", "reporter": "el...@gmail.com", "cve_ids": [ "CVE-2022-44688" ], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-08-31T19:16:56+00:00", "year": 2022, "attachment_count": 11, "local_path": "issues/40060742", "has_markdown": true }, { "id": "40060740", "title": "heap-use-after-free html_element.cc:1850 in blink::HTMLElement::offsetTopForBinding", "url": "https://issues.chromium.org/issues/40060740", "status": "Assigned", "severity": "S4-Minimal", "component": "Blink>DOM", "reporter": "m....@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-08-31T17:59:13+00:00", "year": 2022, "attachment_count": 9, "local_path": "issues/40060740", "has_markdown": true }, { "id": "40060728", "title": "Security: OOB Write in sqlite3FindInIndex", "url": "https://issues.chromium.org/issues/40060728", "status": "Assigned", "severity": "S3-Low", "component": "Internals>Storage", "reporter": "se...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-08-31T03:03:33+00:00", "year": 2022, "attachment_count": 4, "local_path": "issues/40060728", "has_markdown": true }, { "id": "40060720", "title": "Security: heap-use-after-free in CPDF_FormField::ResetField()", "url": "https://issues.chromium.org/issues/40060720", "status": "Assigned", "severity": "S3-Low", "component": "Internals>Plugins>PDF", "reporter": "tr...@gmail.com", "cve_ids": [], "bounty_amount": 10000.0, "reward_amount_meta": 10000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-08-30T14:16:19+00:00", "year": 2022, "attachment_count": 2, "local_path": "issues/40060720", "has_markdown": true }, { "id": "40060719", "title": "Security: heap-use-after-free in SearchNameNodeByNameInternal", "url": "https://issues.chromium.org/issues/40060719", "status": "Assigned", "severity": "S3-Low", "component": "Internals>Plugins>PDF", "reporter": "tr...@gmail.com", "cve_ids": [], "bounty_amount": 10000.0, "reward_amount_meta": 10000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-08-30T13:23:11+00:00", "year": 2022, "attachment_count": 2, "local_path": "issues/40060719", "has_markdown": true }, { "id": "40060715", "title": "Security: Heap-use-after-free in FrameUserNoteChanges", "url": "https://issues.chromium.org/issues/40060715", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>Creation", "reporter": "me...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-08-30T10:28:25+00:00", "year": 2022, "attachment_count": 5, "local_path": "issues/40060715", "has_markdown": true }, { "id": "40060702", "title": "Security: Draw Mouse Cursor to hide omni box", "url": "https://issues.chromium.org/issues/40060702", "status": "Accepted", "severity": "S3-Low", "component": "Blink>Input, UI>HighDPI", "reporter": "sa...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-08-29T02:44:28+00:00", "year": 2022, "attachment_count": 2, "local_path": "issues/40060702", "has_markdown": true }, { "id": "40060701", "title": "uaf in webrtc::VideoStreamEncoder::RequestRefreshFrame", "url": "https://issues.chromium.org/issues/40060701", "status": "Assigned", "severity": "S4-Minimal", "component": "Blink>WebRTC", "reporter": "em...@gmail.com", "cve_ids": [], "bounty_amount": 7500.0, "reward_amount_meta": 7500.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-08-28T19:47:56+00:00", "year": 2022, "attachment_count": 4, "local_path": "issues/40060701", "has_markdown": true }, { "id": "40060700", "title": "Security: UAF in ash::PrintServersProviderImpl::NotifyObservers", "url": "https://issues.chromium.org/issues/40060700", "status": "Assigned", "severity": "S3-Low", "component": "Internals>Printing", "reporter": "zh...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-08-28T16:00:07+00:00", "year": 2022, "attachment_count": 5, "local_path": "issues/40060700", "has_markdown": true }, { "id": "40060695", "title": "Sandbox bypass \"allow-downloads\"", "url": "https://issues.chromium.org/issues/40060695", "status": "Assigned", "severity": "S3-Low", "component": "Blink>SecurityFeature>IFrameSandbox", "reporter": "nd...@protonmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-08-28T03:03:49+00:00", "year": 2022, "attachment_count": 0, "local_path": "issues/40060695", "has_markdown": true }, { "id": "40060691", "title": "Security: PDFium OOB Write in OpenJPEG due to a missed patch", "url": "https://issues.chromium.org/issues/40060691", "status": "Assigned", "severity": "S4-Minimal", "component": "Internals>Plugins>PDF", "reporter": "0x...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-08-27T10:49:07+00:00", "year": 2022, "attachment_count": 2, "local_path": "issues/40060691", "has_markdown": true }, { "id": "40060685", "title": "Security: External notifications from external apps (such as Telegram) can block Android fullscreen notification. (Testes on latest Chrome stable)", "url": "https://issues.chromium.org/issues/40060685", "status": "Accepted", "severity": "S3-Low", "component": "Blink>Fullscreen, UI>Browser>FullScreen", "reporter": "ha...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-08-26T13:13:03+00:00", "year": 2022, "attachment_count": 3, "local_path": "issues/40060685", "has_markdown": true }, { "id": "40060669", "title": "Security: XML object's heap memory difference leaking or potential ASLR bypass in libXML", "url": "https://issues.chromium.org/issues/40060669", "status": "Fixed", "severity": "S3-Low", "component": "Blink>XML", "reporter": "aq...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-08-24T14:36:40+00:00", "year": 2022, "attachment_count": 2, "local_path": "issues/40060669", "has_markdown": true }, { "id": "40060660", "title": "Security: UAF in content::CrOSSystemTracingSession::StartTracingCallbackProxy (browser process)", "url": "https://issues.chromium.org/issues/40060660", "status": "Assigned", "severity": "S3-Low", "component": "Speed>Tracing", "reporter": "0x...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-08-23T17:10:57+00:00", "year": 2022, "attachment_count": 4, "local_path": "issues/40060660", "has_markdown": true }, { "id": "40060649", "title": "Security: PDFium OOB Access in CXFA_ViewLayoutProcessor::GetNextAvailContentHeight", "url": "https://issues.chromium.org/issues/40060649", "status": "Assigned", "severity": "S3-Low", "component": "Internals>Plugins>PDF", "reporter": "0x...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-08-23T02:39:49+00:00", "year": 2022, "attachment_count": 1, "local_path": "issues/40060649", "has_markdown": true }, { "id": "40060647", "title": "heap-use-after-free ui/views/view.cc:1898:7 in views::View::HandleAccessibleAction", "url": "https://issues.chromium.org/issues/40060647", "status": "Assigned", "severity": "S4-Minimal", "component": "UI>Accessibility, UI>Accessibility>Compatibility", "reporter": "rh...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-08-22T19:54:17+00:00", "year": 2022, "attachment_count": 4, "local_path": "issues/40060647", "has_markdown": true }, { "id": "40060644", "title": "use-after-free in BrowserCrashEventRouter", "url": "https://issues.chromium.org/issues/40060644", "status": "Assigned", "severity": "S3-Low", "component": "Internals>CrashReporting", "reporter": "ha...@gmail.com", "cve_ids": [], "bounty_amount": 6000.0, "reward_amount_meta": 6000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-08-22T12:42:00+00:00", "year": 2022, "attachment_count": 6, "local_path": "issues/40060644", "has_markdown": true }, { "id": "40060643", "title": "use-after-poison local_frame_view.cc:816 in blink::LocalFrameView::PerformLayout", "url": "https://issues.chromium.org/issues/40060643", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Internals>Frames", "reporter": "m....@gmail.com", "cve_ids": [], "bounty_amount": 9000.0, "reward_amount_meta": 9000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-08-22T12:13:12+00:00", "year": 2022, "attachment_count": 2, "local_path": "issues/40060643", "has_markdown": true }, { "id": "40060641", "title": "Security: potential buffer overflow in zlib - CVE-2022-37434", "url": "https://issues.chromium.org/issues/40060641", "status": "Assigned", "severity": "S4-Minimal", "component": "Unknown", "reporter": "ri...@sap.com", "cve_ids": [ "CVE-2022-37434" ], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-08-21T21:16:36+00:00", "year": 2022, "attachment_count": 2, "local_path": "issues/40060641", "has_markdown": true }, { "id": "40060617", "title": "Security: .url files can be saved via getFileHandle and redirect showSaveFilePicker to arbitrary file", "url": "https://issues.chromium.org/issues/40060617", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Storage>FileSystem", "reporter": "ha...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-08-19T10:18:10+00:00", "year": 2022, "attachment_count": 5, "local_path": "issues/40060617", "has_markdown": true }, { "id": "40060615", "title": "Security: Hide real extension of file by many white spaces via suggestedName parameter - showSaveFilePicker", "url": "https://issues.chromium.org/issues/40060615", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Storage>FileSystem", "reporter": "ha...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-08-19T09:47:13+00:00", "year": 2022, "attachment_count": 3, "local_path": "issues/40060615", "has_markdown": true }, { "id": "40060610", "title": "Security: [ANGLE] Heap-buffer-overflow caused by writing exceeding the querypool size", "url": "https://issues.chromium.org/issues/40060610", "status": "Assigned", "severity": "S3-Low", "component": "Internals>GPU>Vulkan", "reporter": "gg...@gmail.com", "cve_ids": [], "bounty_amount": 17000.0, "reward_amount_meta": 17000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-08-18T18:44:26+00:00", "year": 2022, "attachment_count": 1, "local_path": "issues/40060610", "has_markdown": true }, { "id": "40060580", "title": "Security: Use After Free of Device object in GPU process.", "url": "https://issues.chromium.org/issues/40060580", "status": "Assigned", "severity": "S3-Low", "component": "Dawn", "reporter": "lo...@gmail.com", "cve_ids": [], "bounty_amount": 17000.0, "reward_amount_meta": 17000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-08-14T09:58:55+00:00", "year": 2022, "attachment_count": 2, "local_path": "issues/40060580", "has_markdown": true }, { "id": "40060572", "title": "Security: Download notification can hide 'Press Esc to exit fullscreen' warning", "url": "https://issues.chromium.org/issues/40060572", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>Bubbles>Download, UI>Browser>Downloads", "reporter": "ch...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-08-12T07:41:08+00:00", "year": 2022, "attachment_count": 3, "local_path": "issues/40060572", "has_markdown": true }, { "id": "40060559", "title": "Security: Heap-use-after-free in ManagePasswordsUIController::SavePassword", "url": "https://issues.chromium.org/issues/40060559", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>Passwords", "reporter": "me...@gmail.com", "cve_ids": [], "bounty_amount": 4000.0, "reward_amount_meta": 4000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-08-11T02:23:24+00:00", "year": 2022, "attachment_count": 4, "local_path": "issues/40060559", "has_markdown": true }, { "id": "40060531", "title": "Security: Potential UAF in WebstoreInstallWithPrompt", "url": "https://issues.chromium.org/issues/40060531", "status": "Assigned", "severity": "S3-Low", "component": "Platform>Extensions", "reporter": "om...@talon-sec.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-08-08T21:15:24+00:00", "year": 2022, "attachment_count": 5, "local_path": "issues/40060531", "has_markdown": true }, { "id": "40060530", "title": "Security: [ANGLE] Heap use-after-free caused by changing the framebuffer cache to sharing in context", "url": "https://issues.chromium.org/issues/40060530", "status": "Assigned", "severity": "S3-Low", "component": "Internals>GPU>ANGLE", "reporter": "gg...@gmail.com", "cve_ids": [], "bounty_amount": 16000.0, "reward_amount_meta": 16000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-08-08T20:58:13+00:00", "year": 2022, "attachment_count": 1, "local_path": "issues/40060530", "has_markdown": true }, { "id": "40060520", "title": "Security: access-violation on unknown address 0x12dfa490bbaa in dawn::native::TextureBase::TextureBase(browser process) ", "url": "https://issues.chromium.org/issues/40060520", "status": "Accepted", "severity": "S3-Low", "component": "Internals>GPU>Dawn, Internals>Skia>Compositing", "reporter": "0x...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-08-06T12:24:35+00:00", "year": 2022, "attachment_count": 0, "local_path": "issues/40060520", "has_markdown": true }, { "id": "40060513", "title": "Security: heap-use-after-free ui/events/event_processor.cc:77:26 in ui::EventProcessor::OnEventFromSource(ui::Event*)", "url": "https://issues.chromium.org/issues/40060513", "status": "Accepted", "severity": "S3-Low", "component": "Internals>Aura, OS>Inputs", "reporter": "rh...@gmail.com", "cve_ids": [], "bounty_amount": 4000.0, "reward_amount_meta": 4000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-08-05T19:16:46+00:00", "year": 2022, "attachment_count": 3, "local_path": "issues/40060513", "has_markdown": true }, { "id": "40060508", "title": "Security: UAF in BackForwardCache", "url": "https://issues.chromium.org/issues/40060508", "status": "Assigned", "severity": "S3-Low", "component": "Internals>Sandbox>SiteIsolation, UI>Browser>Navigation>BFCache", "reporter": "le...@gmail.com", "cve_ids": [], "bounty_amount": 30000.0, "reward_amount_meta": 30000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-08-05T12:21:10+00:00", "year": 2022, "attachment_count": 5, "local_path": "issues/40060508", "has_markdown": true }, { "id": "40060492", "title": "Security: compromised renderer is able to send extension message to another tab", "url": "https://issues.chromium.org/issues/40060492", "status": "Accepted", "severity": "S3-Low", "component": "Internals>Sandbox>SiteIsolation, Platform>Extensions", "reporter": "ym...@ym.kim", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-08-04T13:24:18+00:00", "year": 2022, "attachment_count": 4, "local_path": "issues/40060492", "has_markdown": true }, { "id": "40060490", "title": "Security: UI spoofing for external protocol dialogues via iframe srcdoc on the malicious site", "url": "https://issues.chromium.org/issues/40060490", "status": "Accepted", "severity": "S3-Low", "component": "UI>Browser>Navigation", "reporter": "ha...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-08-04T06:30:20+00:00", "year": 2022, "attachment_count": 3, "local_path": "issues/40060490", "has_markdown": true }, { "id": "40060480", "title": "Security: Heap-use-after-free in WebContentsImpl::OpenURL", "url": "https://issues.chromium.org/issues/40060480", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>Pogo, UI>Browser>TopChrome>SidePanel", "reporter": "me...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-08-03T07:33:59+00:00", "year": 2022, "attachment_count": 2, "local_path": "issues/40060480", "has_markdown": true }, { "id": "40060475", "title": "Security: console.log still allows loading images via %c formatter", "url": "https://issues.chromium.org/issues/40060475", "status": "Accepted", "severity": "S3-Low", "component": "Blink>SecurityFeature>ContentSecurityPolicy, Platform>DevTools", "reporter": "ma...@gmail.com", "cve_ids": [], "bounty_amount": 500.0, "reward_amount_meta": 500.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-08-02T20:04:04+00:00", "year": 2022, "attachment_count": 0, "local_path": "issues/40060475", "has_markdown": true }, { "id": "40060465", "title": "Security: Source maps support for file:// URLs gives devtools_page extensions local file access", "url": "https://issues.chromium.org/issues/40060465", "status": "Assigned", "severity": "S3-Low", "component": "Platform>Extensions", "reporter": "ma...@fingerprint.com", "cve_ids": [ "CVE-2022-4955" ], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-08-01T21:24:27+00:00", "year": 2022, "attachment_count": 4, "local_path": "issues/40060465", "has_markdown": true }, { "id": "40060446", "title": "Security DCHECK failed: !NeedsLayout() || ChildLayoutBlockedByDisplayLock()", "url": "https://issues.chromium.org/issues/40060446", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Layout>MultiCol", "reporter": "m....@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-07-30T03:28:43+00:00", "year": 2022, "attachment_count": 4, "local_path": "issues/40060446", "has_markdown": true }, { "id": "40060437", "title": "UAP style_invalidator.cc:192 in blink::StyleInvalidator::PushInvalidationSetsForContainerNode", "url": "https://issues.chromium.org/issues/40060437", "status": "Assigned", "severity": "S3-Low", "component": "Blink>CSS", "reporter": "m....@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-07-29T07:59:10+00:00", "year": 2022, "attachment_count": 13, "local_path": "issues/40060437", "has_markdown": true }, { "id": "40060436", "title": "Security: container-overflow in HistoryClustersHandler::OpenVisitUrlsInTabGroup", "url": "https://issues.chromium.org/issues/40060436", "status": "Accepted", "severity": "S3-Low", "component": "UI>Browser>Journeys", "reporter": "me...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-07-29T07:10:15+00:00", "year": 2022, "attachment_count": 2, "local_path": "issues/40060436", "has_markdown": true }, { "id": "40060426", "title": "Security: heap-buffer-overflow in TableView", "url": "https://issues.chromium.org/issues/40060426", "status": "Assigned", "severity": "S4-Minimal", "component": "UI>TaskManager", "reporter": "yo...@snu.ac.kr", "cve_ids": [], "bounty_amount": 4000.0, "reward_amount_meta": 4000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-07-28T05:08:34+00:00", "year": 2022, "attachment_count": 2, "local_path": "issues/40060426", "has_markdown": true }, { "id": "40060417", "title": "Security: UAF in UserNoteService", "url": "https://issues.chromium.org/issues/40060417", "status": "Accepted", "severity": "S3-Low", "component": "UI>Browser>Creation", "reporter": "le...@gmail.com", "cve_ids": [], "bounty_amount": 30000.0, "reward_amount_meta": 30000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-07-27T06:41:16+00:00", "year": 2022, "attachment_count": 3, "local_path": "issues/40060417", "has_markdown": true }, { "id": "40060395", "title": "Security: UAF in HidService::GetDevices", "url": "https://issues.chromium.org/issues/40060395", "status": "Accepted", "severity": "S3-Low", "component": "Blink>HID", "reporter": "et...@gmail.com", "cve_ids": [], "bounty_amount": 6000.0, "reward_amount_meta": 6000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-07-25T10:06:41+00:00", "year": 2022, "attachment_count": 8, "local_path": "issues/40060395", "has_markdown": true }, { "id": "40060394", "title": "TypeConfuse in blink::NGLayoutInputNode::IsEmptyTableSection ng_layout_input_node.cc:87", "url": "https://issues.chromium.org/issues/40060394", "status": "Assigned", "severity": "S3-Low", "component": "Blink>CSS", "reporter": "m....@gmail.com", "cve_ids": [], "bounty_amount": 7500.0, "reward_amount_meta": 7500.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-07-25T07:02:08+00:00", "year": 2022, "attachment_count": 3, "local_path": "issues/40060394", "has_markdown": true }, { "id": "40060392", "title": "Security: ResourceTiming entries are not generated for responses with 204, 205 status codes when loaded in a iframe", "url": "https://issues.chromium.org/issues/40060392", "status": "Accepted", "severity": "S3-Low", "component": "Blink>PerformanceAPIs>ResourceTiming", "reporter": "da...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-07-24T15:27:56+00:00", "year": 2022, "attachment_count": 2, "local_path": "issues/40060392", "has_markdown": true }, { "id": "40060367", "title": "Security: UTF chartorune heap-buffer-overflow crash", "url": "https://issues.chromium.org/issues/40060367", "status": "Accepted", "severity": "S3-Low", "component": "Internals>OptimizationGuide", "reporter": "mi...@gmail.com", "cve_ids": [], "bounty_amount": 8000.0, "reward_amount_meta": 8000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-07-22T17:14:11+00:00", "year": 2022, "attachment_count": 2, "local_path": "issues/40060367", "has_markdown": true }, { "id": "40060358", "title": "SameSite strict cookies bypass/cross-origin download via `e.dataTransfer.setData('DownloadURL', ...`", "url": "https://issues.chromium.org/issues/40060358", "status": "Assigned", "severity": "S3-Low", "component": "Blink>DataTransfer, UI>Browser>Downloads", "reporter": "nd...@protonmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-07-21T22:58:45+00:00", "year": 2022, "attachment_count": 2, "local_path": "issues/40060358", "has_markdown": true }, { "id": "40060350", "title": "Security: UAF in AppWindowContentsImpl::~AppWindowContentsImpl", "url": "https://issues.chromium.org/issues/40060350", "status": "Assigned", "severity": "S3-Low", "component": "Platform>Apps, Platform>Apps>BrowserTag", "reporter": "jt...@gmail.com", "cve_ids": [], "bounty_amount": 10000.0, "reward_amount_meta": 10000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-07-21T11:02:08+00:00", "year": 2022, "attachment_count": 7, "local_path": "issues/40060350", "has_markdown": true }, { "id": "40060348", "title": "Security: Code Injection in WebUI page leading to sandbox escape", "url": "https://issues.chromium.org/issues/40060348", "status": "Assigned", "severity": "S3-Low", "component": "Platform>DevTools, Platform>Extensions", "reporter": "jt...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-07-21T10:07:36+00:00", "year": 2022, "attachment_count": 4, "local_path": "issues/40060348", "has_markdown": true }, { "id": "40060340", "title": "heap-use-after-free in WebDragSourceAura::CancelDrag", "url": "https://issues.chromium.org/issues/40060340", "status": "Accepted", "severity": "S3-Low", "component": "Blink>Portals", "reporter": "xp...@gmail.com", "cve_ids": [], "bounty_amount": 10000.0, "reward_amount_meta": 10000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-07-20T20:13:53+00:00", "year": 2022, "attachment_count": 3, "local_path": "issues/40060340", "has_markdown": true }, { "id": "40060336", "title": "Security: Another UAF in WebSQL sqlite3Select", "url": "https://issues.chromium.org/issues/40060336", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Storage>WebSQL, Internals>Storage", "reporter": "et...@gmail.com", "cve_ids": [], "bounty_amount": 7500.0, "reward_amount_meta": 7500.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-07-20T15:12:19+00:00", "year": 2022, "attachment_count": 4, "local_path": "issues/40060336", "has_markdown": true }, { "id": "40060334", "title": "UAF in AccessCodeCastSinkService", "url": "https://issues.chromium.org/issues/40060334", "status": "Assigned", "severity": "S4-Minimal", "component": "Internals>Cast", "reporter": "ha...@gmail.com", "cve_ids": [], "bounty_amount": 9500.0, "reward_amount_meta": 9500.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-07-20T12:58:02+00:00", "year": 2022, "attachment_count": 5, "local_path": "issues/40060334", "has_markdown": true }, { "id": "40060332", "title": "TypeConfuse in blink::LayoutTable::AddChild layout_table.cc:194", "url": "https://issues.chromium.org/issues/40060332", "status": "Assigned", "severity": "S3-Low", "component": "Blink>CSS", "reporter": "m....@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-07-20T11:22:06+00:00", "year": 2022, "attachment_count": 3, "local_path": "issues/40060332", "has_markdown": true }, { "id": "40060325", "title": "Security: Use-After-Free in WebUIBubbleDialogView::ClearContentsWrapper", "url": "https://issues.chromium.org/issues/40060325", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>Bubbles", "reporter": "yo...@snu.ac.kr", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-07-19T06:06:03+00:00", "year": 2022, "attachment_count": 1, "local_path": "issues/40060325", "has_markdown": true }, { "id": "40060322", "title": "Security: Symbolic Link Following + Upload Warning Bypass", "url": "https://issues.chromium.org/issues/40060322", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Forms>File, Blink>Storage>FileSystem", "reporter": "ro...@imperva.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-07-18T16:33:23+00:00", "year": 2022, "attachment_count": 1, "local_path": "issues/40060322", "has_markdown": true }, { "id": "40060321", "title": "Security: heap-buffer-overflow on components/exo/shell_surface_util.cc:230:40 (Lacros)", "url": "https://issues.chromium.org/issues/40060321", "status": "Assigned", "severity": "S3-Low", "component": "UI>Shell>UIFoundations", "reporter": "rh...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-07-18T14:12:11+00:00", "year": 2022, "attachment_count": 1, "local_path": "issues/40060321", "has_markdown": true }, { "id": "40060319", "title": "Security: = prepended in document.cookie allows to bypass __Secure and __Host prefixes", "url": "https://issues.chromium.org/issues/40060319", "status": "Assigned", "severity": "S3-Low", "component": "Internals>Network>Cookies", "reporter": "ha...@gmail.com", "cve_ids": [ "CVE-2022-40958" ], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-07-18T09:42:42+00:00", "year": 2022, "attachment_count": 0, "local_path": "issues/40060319", "has_markdown": true }, { "id": "40060314", "title": "Security: type confusion in chrome", "url": "https://issues.chromium.org/issues/40060314", "status": "Assigned", "severity": "S4-Minimal", "component": "UI>Accessibility", "reporter": "wx...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-07-17T10:06:54+00:00", "year": 2022, "attachment_count": 1, "local_path": "issues/40060314", "has_markdown": true }, { "id": "40060310", "title": "CSP Bypass (Old Issue)", "url": "https://issues.chromium.org/issues/40060310", "status": "Assigned", "severity": "S3-Low", "component": "Mobile>iOSWeb>Security", "reporter": "ia...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-07-16T12:20:43+00:00", "year": 2022, "attachment_count": 1, "local_path": "issues/40060310", "has_markdown": true }, { "id": "40060309", "title": "wild read in DrawCall::run", "url": "https://issues.chromium.org/issues/40060309", "status": "Assigned", "severity": "S3-Low", "component": "Blink>WebGL, Internals>GPU>ANGLE, Internals>GPU>SwiftShader", "reporter": "em...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-07-16T09:42:35+00:00", "year": 2022, "attachment_count": 4, "local_path": "issues/40060309", "has_markdown": true }, { "id": "40060298", "title": "use-after-free in Serial", "url": "https://issues.chromium.org/issues/40060298", "status": "Accepted", "severity": "S3-Low", "component": "Blink>Serial, Platform>Apps>API>Serial", "reporter": "he...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-07-15T16:19:29+00:00", "year": 2022, "attachment_count": 2, "local_path": "issues/40060298", "has_markdown": true }, { "id": "40060292", "title": "Security: Heap-use-after-free in user_notes::FrameUserNoteChanges::Apply (Annotation - deleting a note that was just created in another tab causes crash)", "url": "https://issues.chromium.org/issues/40060292", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>Creation", "reporter": "me...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-07-15T11:27:51+00:00", "year": 2022, "attachment_count": 3, "local_path": "issues/40060292", "has_markdown": true }, { "id": "40060288", "title": "Security: Heap-use-after-free in ReadAnythingCoordinator::CreateAndRegisterEntry", "url": "https://issues.chromium.org/issues/40060288", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>TopChrome>SidePanel", "reporter": "me...@gmail.com", "cve_ids": [], "bounty_amount": 4000.0, "reward_amount_meta": 4000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-07-15T07:46:18+00:00", "year": 2022, "attachment_count": 3, "local_path": "issues/40060288", "has_markdown": true }, { "id": "40060283", "title": "chrome.debugger API bypasses the runtime_blocked_hosts cookie protection", "url": "https://issues.chromium.org/issues/40060283", "status": "Assigned", "severity": "S3-Low", "component": "Platform>Extensions>API", "reporter": "nd...@protonmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-07-14T21:50:59+00:00", "year": 2022, "attachment_count": 3, "local_path": "issues/40060283", "has_markdown": true }, { "id": "40060279", "title": "Heap-use-after-free on CaptionBubble::BackToTabButtonPressed", "url": "https://issues.chromium.org/issues/40060279", "status": "Assigned", "severity": "S3-Low", "component": "Internals>Media>LiveCaption", "reporter": "sa...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-07-14T14:54:18+00:00", "year": 2022, "attachment_count": 1, "local_path": "issues/40060279", "has_markdown": true }, { "id": "40060238", "title": "Security: UAF in WebSQL sqlite3Select, Potential RCE in Chrome", "url": "https://issues.chromium.org/issues/40060238", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Storage>WebSQL, Internals>Storage", "reporter": "et...@gmail.com", "cve_ids": [], "bounty_amount": 10000.0, "reward_amount_meta": 10000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-07-11T12:21:01+00:00", "year": 2022, "attachment_count": 5, "local_path": "issues/40060238", "has_markdown": true }, { "id": "40060235", "title": "Insufficient policy enforcement in Safe Browsing", "url": "https://issues.chromium.org/issues/40060235", "status": "Accepted", "severity": "S3-Low", "component": "Unknown", "reporter": "no...@ssd-disclosure.com", "cve_ids": [ "CVE-2020-6402", "CVE-2022-1874" ], "bounty_amount": 500.0, "reward_amount_meta": 500.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-07-11T09:51:36+00:00", "year": 2022, "attachment_count": 6, "local_path": "issues/40060235", "has_markdown": true }, { "id": "40060220", "title": "Security: UAF in OnAccessTokenRefreshFailed", "url": "https://issues.chromium.org/issues/40060220", "status": "Assigned", "severity": "S3-Low", "component": "Unknown", "reporter": "ya...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-07-09T07:08:57+00:00", "year": 2022, "attachment_count": 0, "local_path": "issues/40060220", "has_markdown": true }, { "id": "40060213", "title": "Security: UAF in PermissionAuditingService multiple functions", "url": "https://issues.chromium.org/issues/40060213", "status": "Accepted", "severity": "S3-Low", "component": "Internals>Permissions", "reporter": "et...@gmail.com", "cve_ids": [], "bounty_amount": 4000.0, "reward_amount_meta": 4000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-07-08T10:03:05+00:00", "year": 2022, "attachment_count": 9, "local_path": "issues/40060213", "has_markdown": true }, { "id": "40060207", "title": "sourceMappingURL directive allows use of UNC paths on Windows", "url": "https://issues.chromium.org/issues/40060207", "status": "Accepted", "severity": "S3-Low", "component": "Blink>JavaScript", "reporter": "zi...@gmail.com", "cve_ids": [], "bounty_amount": 7500.0, "reward_amount_meta": 7500.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-07-07T19:58:49+00:00", "year": 2022, "attachment_count": 2, "local_path": "issues/40060207", "has_markdown": true }, { "id": "40060202", "title": "Security: `chrome.downloads.onDeterminingFilename` can be used to bypass the fix for issue 1310461 and steal environment variables", "url": "https://issues.chromium.org/issues/40060202", "status": "Assigned", "severity": "S3-Low", "component": "Platform>Extensions>API", "reporter": "la...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-07-07T12:50:43+00:00", "year": 2022, "attachment_count": 5, "local_path": "issues/40060202", "has_markdown": true }, { "id": "40060180", "title": "Security: Heap-use-after-free in UserNoteUICoordinator::Invalidate", "url": "https://issues.chromium.org/issues/40060180", "status": "Accepted", "severity": "S3-Low", "component": "UI>Browser>TopChrome>SidePanel", "reporter": "me...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-07-06T10:29:27+00:00", "year": 2022, "attachment_count": 3, "local_path": "issues/40060180", "has_markdown": true }, { "id": "40060179", "title": "Security: Use After Free of GPUExternalTexture object in renderer process.", "url": "https://issues.chromium.org/issues/40060179", "status": "Assigned", "severity": "S3-Low", "component": "Blink>WebGPU", "reporter": "lo...@gmail.com", "cve_ids": [], "bounty_amount": 7500.0, "reward_amount_meta": 7500.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-07-06T09:39:20+00:00", "year": 2022, "attachment_count": 1, "local_path": "issues/40060179", "has_markdown": true }, { "id": "40060174", "title": "Security: V8 Typer hardening bypass via ReduceArrayPrototypeAt", "url": "https://issues.chromium.org/issues/40060174", "status": "Accepted", "severity": "S3-Low", "component": "Blink>JavaScript>Compiler", "reporter": "ji...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-07-06T03:53:03+00:00", "year": 2022, "attachment_count": 1, "local_path": "issues/40060174", "has_markdown": true }, { "id": "40060173", "title": "chrome.debugger 'Page.navigate' can navigate iframes to file:// when not enabled.", "url": "https://issues.chromium.org/issues/40060173", "status": "Assigned", "severity": "S3-Low", "component": "Platform>DevTools>Privacy and Security", "reporter": "nd...@protonmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-07-06T01:35:17+00:00", "year": 2022, "attachment_count": 3, "local_path": "issues/40060173", "has_markdown": true }, { "id": "40060172", "title": "Security: Pdfium heap bof in CFDE_TextOut::RetrievePieces()", "url": "https://issues.chromium.org/issues/40060172", "status": "Accepted", "severity": "S3-Low", "component": "Internals>Plugins>PDF", "reporter": "ch...@gmail.com", "cve_ids": [], "bounty_amount": 7500.0, "reward_amount_meta": 7500.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-07-05T20:48:52+00:00", "year": 2022, "attachment_count": 1, "local_path": "issues/40060172", "has_markdown": true }, { "id": "40060166", "title": "Security: use after free in DiceWebSigninInterceptor", "url": "https://issues.chromium.org/issues/40060166", "status": "Assigned", "severity": "S3-Low", "component": "Unknown", "reporter": "wx...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-07-05T07:02:17+00:00", "year": 2022, "attachment_count": 2, "local_path": "issues/40060166", "has_markdown": true }, { "id": "40060165", "title": "Security: use after free in AccountReconcilor", "url": "https://issues.chromium.org/issues/40060165", "status": "Assigned", "severity": "S3-Low", "component": "Unknown", "reporter": "wx...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-07-05T06:26:07+00:00", "year": 2022, "attachment_count": 3, "local_path": "issues/40060165", "has_markdown": true }, { "id": "40060162", "title": "Security: use after free in IPH DemoMode NeverAvailabilityModel", "url": "https://issues.chromium.org/issues/40060162", "status": "Assigned", "severity": "S3-Low", "component": "Internals>FeatureEngagement", "reporter": "wx...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-07-05T03:42:30+00:00", "year": 2022, "attachment_count": 3, "local_path": "issues/40060162", "has_markdown": true }, { "id": "40060157", "title": "Typeconfuse in blink::LayoutTableRow::AddChild layout_table_row.cc:193", "url": "https://issues.chromium.org/issues/40060157", "status": "Assigned", "severity": "S3-Low", "component": "Blink>CSS", "reporter": "m....@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-07-04T07:26:29+00:00", "year": 2022, "attachment_count": 3, "local_path": "issues/40060157", "has_markdown": true }, { "id": "40060156", "title": "Security: UAF in CloseBubbleOnTabActivationHelper::~CloseBubbleOnTabActivationHelper", "url": "https://issues.chromium.org/issues/40060156", "status": "Assigned", "severity": "S3-Low", "component": "Internals>Views, UI>Browser>WebUI", "reporter": "yo...@snu.ac.kr", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-07-04T05:34:43+00:00", "year": 2022, "attachment_count": 0, "local_path": "issues/40060156", "has_markdown": true }, { "id": "40060151", "title": "Security: Bypass(1301873)Chrome for Android Hide Custom Fullscreen Toast View with Repeated delayed Enter Fullscreen Request ", "url": "https://issues.chromium.org/issues/40060151", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>FullScreen", "reporter": "el...@gmail.com", "cve_ids": [], "bounty_amount": 4000.0, "reward_amount_meta": 4000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-07-03T12:46:10+00:00", "year": 2022, "attachment_count": 22, "local_path": "issues/40060151", "has_markdown": true }, { "id": "40060150", "title": "heap-overflow in blink::TableLayoutAlgorithmAuto::InsertSpanCell table_layout_algorithm_auto.cc", "url": "https://issues.chromium.org/issues/40060150", "status": "Assigned", "severity": "S3-Low", "component": "Blink>GarbageCollection", "reporter": "m....@gmail.com", "cve_ids": [], "bounty_amount": 9000.0, "reward_amount_meta": 9000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-07-03T10:13:05+00:00", "year": 2022, "attachment_count": 3, "local_path": "issues/40060150", "has_markdown": true }, { "id": "40060134", "title": "Security: Page can obtain autofill data with two consecutive taps with minimal user awareness, bypasses issue 1240472 and issue 1279268 fixes", "url": "https://issues.chromium.org/issues/40060134", "status": "Assigned", "severity": "S3-Low", "component": "Privacy", "reporter": "al...@alesandroortiz.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-07-02T01:05:02+00:00", "year": 2022, "attachment_count": 2, "local_path": "issues/40060134", "has_markdown": true }, { "id": "40060125", "title": "Security: Heap-use-after-free in SidePanelCoordinator::PopulateSidePanel", "url": "https://issues.chromium.org/issues/40060125", "status": "Accepted", "severity": "S3-Low", "component": "UI>Browser>TopChrome>SidePanel", "reporter": "me...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-07-01T04:24:10+00:00", "year": 2022, "attachment_count": 3, "local_path": "issues/40060125", "has_markdown": true }, { "id": "40060115", "title": "Security: Custom Tab HTTP Header Injection", "url": "https://issues.chromium.org/issues/40060115", "status": "Assigned", "severity": "S3-Low", "component": "Blink>SecurityFeature>CORS", "reporter": "ph...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-06-30T09:49:33+00:00", "year": 2022, "attachment_count": 0, "local_path": "issues/40060115", "has_markdown": true }, { "id": "40060084", "title": "Security: container-overflow in chrome_pdf::PDFiumEngine::SelectFindResult", "url": "https://issues.chromium.org/issues/40060084", "status": "Assigned", "severity": "S3-Low", "component": "Internals>Plugins>PDF", "reporter": "sk...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-06-27T08:21:42+00:00", "year": 2022, "attachment_count": 4, "local_path": "issues/40060084", "has_markdown": true }, { "id": "40060083", "title": "Security: type confusion in chrome", "url": "https://issues.chromium.org/issues/40060083", "status": "Fixed", "severity": "S3-Low", "component": "Blink>Storage>SharedStorage", "reporter": "wx...@gmail.com", "cve_ids": [], "bounty_amount": 8500.0, "reward_amount_meta": 8500.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-06-27T07:53:49+00:00", "year": 2022, "attachment_count": 5, "local_path": "issues/40060083", "has_markdown": true }, { "id": "40060077", "title": "Security: v8: corrupt typed array from bad deserializer input", "url": "https://issues.chromium.org/issues/40060077", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript, Blink>JavaScript>Runtime", "reporter": "in...@bnoordhuis.nl", "cve_ids": [], "bounty_amount": 15000.0, "reward_amount_meta": 15000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-06-26T05:36:46+00:00", "year": 2022, "attachment_count": 0, "local_path": "issues/40060077", "has_markdown": true }, { "id": "40060076", "title": "Prevent server redirect to non web accessible resource", "url": "https://issues.chromium.org/issues/40060076", "status": "Assigned", "severity": "S3-Low", "component": "Platform>Extensions, UI>Browser>Omnibox", "reporter": "nd...@protonmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-06-26T02:20:47+00:00", "year": 2022, "attachment_count": 1, "local_path": "issues/40060076", "has_markdown": true }, { "id": "40060062", "title": "Security: container-overflow in TabStripModel::AddToNewGroupImpl", "url": "https://issues.chromium.org/issues/40060062", "status": "Accepted", "severity": "S3-Low", "component": "UI>Browser>Journeys", "reporter": "me...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-06-24T04:27:39+00:00", "year": 2022, "attachment_count": 2, "local_path": "issues/40060062", "has_markdown": true }, { "id": "40060046", "title": "Security: UAF in WebContentsFrameTracker", "url": "https://issues.chromium.org/issues/40060046", "status": "Accepted", "severity": "S3-Low", "component": "Internals>Media>SurfaceCapture", "reporter": "le...@gmail.com", "cve_ids": [], "bounty_amount": 20000.0, "reward_amount_meta": 20000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-06-22T16:06:35+00:00", "year": 2022, "attachment_count": 4, "local_path": "issues/40060046", "has_markdown": true }, { "id": "40060044", "title": "Incorrect use of weakptr lead to UAF in NearbyShare", "url": "https://issues.chromium.org/issues/40060044", "status": "Assigned", "severity": "S3-Low", "component": "Unknown", "reporter": "ro...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-06-22T14:18:44+00:00", "year": 2022, "attachment_count": 0, "local_path": "issues/40060044", "has_markdown": true }, { "id": "40060043", "title": "Incorrect use of weakptr lead to uaf", "url": "https://issues.chromium.org/issues/40060043", "status": "Assigned", "severity": "S3-Low", "component": "Unknown", "reporter": "ro...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-06-22T14:00:49+00:00", "year": 2022, "attachment_count": 4, "local_path": "issues/40060043", "has_markdown": true }, { "id": "40060042", "title": "Security: Invalid function pointer in ~ExternalImageDXGI() in D3D backend", "url": "https://issues.chromium.org/issues/40060042", "status": "Assigned", "severity": "S3-Low", "component": "Dawn", "reporter": "lo...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-06-22T10:47:38+00:00", "year": 2022, "attachment_count": 1, "local_path": "issues/40060042", "has_markdown": true }, { "id": "40060039", "title": "Security: UAF in chromeos::multidevice::MultidevicePhoneHubHandler", "url": "https://issues.chromium.org/issues/40060039", "status": "Assigned", "severity": "S3-Low", "component": "UI>Shell", "reporter": "et...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-06-22T07:45:04+00:00", "year": 2022, "attachment_count": 3, "local_path": "issues/40060039", "has_markdown": true }, { "id": "40060030", "title": "AddressSanitizer: heap-use-after-free html_element.cc:1802 in blink::HTMLElement::offsetTopForBindin", "url": "https://issues.chromium.org/issues/40060030", "status": "Assigned", "severity": "S3-Low", "component": "Blink>DOM", "reporter": "m....@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-06-21T11:29:09+00:00", "year": 2022, "attachment_count": 2, "local_path": "issues/40060030", "has_markdown": true }, { "id": "40060025", "title": " heap-use-after-free in RenderViewContextMenu::ExecuteCommand", "url": "https://issues.chromium.org/issues/40060025", "status": "Accepted", "severity": "S3-Low", "component": "Internals>Views, UI>Browser>QuickCommands", "reporter": "xp...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-06-21T05:01:24+00:00", "year": 2022, "attachment_count": 3, "local_path": "issues/40060025", "has_markdown": true }, { "id": "40060019", "title": "Security: potential use after free in OfflinePageModelTaskified::Unpublish", "url": "https://issues.chromium.org/issues/40060019", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>Offline", "reporter": "wx...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-06-20T15:03:13+00:00", "year": 2022, "attachment_count": 0, "local_path": "issues/40060019", "has_markdown": true }, { "id": "40060009", "title": "Security: use after free in DiceWebSigninInterceptor::OnAccountLevelManagedAccountsSigninRestrictionReceived", "url": "https://issues.chromium.org/issues/40060009", "status": "Accepted", "severity": "S3-Low", "component": "Unknown", "reporter": "wx...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-06-20T02:50:47+00:00", "year": 2022, "attachment_count": 3, "local_path": "issues/40060009", "has_markdown": true }, { "id": "40060000", "title": "Security: use after free in GraphicsPipeline::containsImageWrite", "url": "https://issues.chromium.org/issues/40060000", "status": "Assigned", "severity": "S3-Low", "component": "Internals>GPU>SwiftShader", "reporter": "em...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-06-18T11:13:51+00:00", "year": 2022, "attachment_count": 4, "local_path": "issues/40060000", "has_markdown": true }, { "id": "40059994", "title": "Security: heap-use-after-free chrome/browser/profiles/profile_destroyer.cc:137:16 (chromeOS)", "url": "https://issues.chromium.org/issues/40059994", "status": "Assigned", "severity": "S3-Low", "component": "Unknown", "reporter": "rh...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-06-17T18:35:18+00:00", "year": 2022, "attachment_count": 4, "local_path": "issues/40059994", "has_markdown": true }, { "id": "40059988", "title": "Security: HeapOverflow in PluralStringHandler::HandleGetPluralString ", "url": "https://issues.chromium.org/issues/40059988", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>WebUI", "reporter": "ya...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-06-17T01:04:29+00:00", "year": 2022, "attachment_count": 0, "local_path": "issues/40059988", "has_markdown": true }, { "id": "40059985", "title": "Security: heap-use-after-free ash/drag_drop/drag_drop_tracker.cc:111:1 (chromeOS)", "url": "https://issues.chromium.org/issues/40059985", "status": "Assigned", "severity": "S3-Low", "component": "UI>Shell>UIFoundations", "reporter": "rh...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-06-16T16:09:31+00:00", "year": 2022, "attachment_count": 3, "local_path": "issues/40059985", "has_markdown": true }, { "id": "40059984", "title": "Security: heap-buffer-overflow ui/wm/core/transient_window_stacking_client.cc (chromeOS)", "url": "https://issues.chromium.org/issues/40059984", "status": "Assigned", "severity": "S3-Low", "component": "Internals>Aura", "reporter": "rh...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-06-16T14:35:30+00:00", "year": 2022, "attachment_count": 5, "local_path": "issues/40059984", "has_markdown": true }, { "id": "40059980", "title": "An iframe on a different domain can change the location to about:blank which enables you to access properties on the window. document.baseURI is leaked from the parent frame.", "url": "https://issues.chromium.org/issues/40059980", "status": "Assigned", "severity": "S3-Low", "component": "Blink>SecurityFeature>IFrameSandbox", "reporter": "ga...@portswigger.net", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-06-16T08:37:01+00:00", "year": 2022, "attachment_count": 3, "local_path": "issues/40059980", "has_markdown": true }, { "id": "40059979", "title": "Security: Misuse of CanCover", "url": "https://issues.chromium.org/issues/40059979", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript>Compiler", "reporter": "ss...@gmail.com", "cve_ids": [], "bounty_amount": 7500.0, "reward_amount_meta": 7500.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-06-16T04:09:59+00:00", "year": 2022, "attachment_count": 2, "local_path": "issues/40059979", "has_markdown": true }, { "id": "40059973", "title": "Security: UAF in CacheAliasSearchPrefetchURLLoader::StartPrefetchRequest", "url": "https://issues.chromium.org/issues/40059973", "status": "Assigned", "severity": "S3-Low", "component": "Internals>Preload", "reporter": "mi...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-06-15T13:16:23+00:00", "year": 2022, "attachment_count": 0, "local_path": "issues/40059973", "has_markdown": true }, { "id": "40059963", "title": "Security DCHECK failure: IsA(from) in casting.h", "url": "https://issues.chromium.org/issues/40059963", "status": "Assigned", "severity": "S4-Minimal", "component": "Blink>Layout", "reporter": "m....@gmail.com", "cve_ids": [], "bounty_amount": 6000.0, "reward_amount_meta": 6000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-06-14T18:49:33+00:00", "year": 2022, "attachment_count": 2, "local_path": "issues/40059963", "has_markdown": true }, { "id": "40059961", "title": "Security: Use After Free in JavaScriptDialogHelper::OnPermissionResponse", "url": "https://issues.chromium.org/issues/40059961", "status": "Assigned", "severity": "S3-Low", "component": "Platform>Apps>BrowserTag", "reporter": "ka...@gmail.com", "cve_ids": [], "bounty_amount": 16000.0, "reward_amount_meta": 16000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-06-14T14:22:42+00:00", "year": 2022, "attachment_count": 7, "local_path": "issues/40059961", "has_markdown": true }, { "id": "40059949", "title": "Security: chromeos Root priv escalation to write file", "url": "https://issues.chromium.org/issues/40059949", "status": "Accepted", "severity": "S3-Low", "component": "UI>Shell", "reporter": "wx...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-06-13T14:24:18+00:00", "year": 2022, "attachment_count": 0, "local_path": "issues/40059949", "has_markdown": true }, { "id": "40059947", "title": "Security: heap-use-after-free in SearchNameNodeByNameInternal", "url": "https://issues.chromium.org/issues/40059947", "status": "Assigned", "severity": "S3-Low", "component": "Internals>Plugins>PDF", "reporter": "tr...@gmail.com", "cve_ids": [], "bounty_amount": 7500.0, "reward_amount_meta": 7500.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-06-13T12:15:31+00:00", "year": 2022, "attachment_count": 2, "local_path": "issues/40059947", "has_markdown": true }, { "id": "40059929", "title": "WebGL glCompressedTexImage3D Heap-Based Buffer Overflow Vulnerability", "url": "https://issues.chromium.org/issues/40059929", "status": "Assigned", "severity": "S3-Low", "component": "Blink>WebGL, Internals>GPU>ANGLE", "reporter": "no...@ssd-disclosure.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-06-12T07:01:41+00:00", "year": 2022, "attachment_count": 2, "local_path": "issues/40059929", "has_markdown": true }, { "id": "40059921", "title": "chrome://image allows arbitrary images to be navigated to as a trusted chrome page", "url": "https://issues.chromium.org/issues/40059921", "status": "Accepted", "severity": "S3-Low", "component": "Enterprise, Internals>Sandbox>SiteIsolation, UI>Browser>Navigation, UI>Browser>WebUI", "reporter": "nd...@protonmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-06-10T22:38:49+00:00", "year": 2022, "attachment_count": 0, "local_path": "issues/40059921", "has_markdown": true }, { "id": "40059914", "title": "Security: Use-After-Free in safe_browsing::ExtensionTelemetryPersister::InitHelper", "url": "https://issues.chromium.org/issues/40059914", "status": "Assigned", "severity": "S3-Low", "component": "Unknown", "reporter": "et...@gmail.com", "cve_ids": [], "bounty_amount": 10000.0, "reward_amount_meta": 10000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-06-10T07:47:59+00:00", "year": 2022, "attachment_count": 6, "local_path": "issues/40059914", "has_markdown": true }, { "id": "40059888", "title": "Security: Custom tab cookie handling", "url": "https://issues.chromium.org/issues/40059888", "status": "Accepted", "severity": "Unknown", "component": "UI>Browser>Mobile>CustomTabs", "reporter": "ph...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-06-07T16:47:32+00:00", "year": 2022, "attachment_count": 0, "local_path": "issues/40059888", "has_markdown": true }, { "id": "40059882", "title": "Security: heap-use-after-free on IsLacrosWindow ash/drag_drop/tab_drag_drop_delegate.cc (Lacros)", "url": "https://issues.chromium.org/issues/40059882", "status": "Assigned", "severity": "S3-Low", "component": "OS>LaCrOS>Tablet, UI>Browser>TopChrome>TabStrip>ThumbnailTabStrip", "reporter": "rh...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-06-07T01:44:58+00:00", "year": 2022, "attachment_count": 2, "local_path": "issues/40059882", "has_markdown": true }, { "id": "40059875", "title": "Safebrowsing does not trigger a malware warning for malware loaded through an embed", "url": "https://issues.chromium.org/issues/40059875", "status": "Accepted", "severity": "S3-Low", "component": "Unknown", "reporter": "xp...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-06-06T20:23:32+00:00", "year": 2022, "attachment_count": 1, "local_path": "issues/40059875", "has_markdown": true }, { "id": "40059871", "title": "Security: heap-buffer-overflow in chrome_pdf::PDFiumEngine::GetNamedDestination", "url": "https://issues.chromium.org/issues/40059871", "status": "Assigned", "severity": "S4-Minimal", "component": "Internals>Plugins>PDF", "reporter": "tr...@gmail.com", "cve_ids": [], "bounty_amount": 7500.0, "reward_amount_meta": 7500.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-06-06T05:55:26+00:00", "year": 2022, "attachment_count": 3, "local_path": "issues/40059871", "has_markdown": true }, { "id": "40059870", "title": "Use-after-poison in content::InspectorMediaEventHandler::SendQueuedMediaEvents", "url": "https://issues.chromium.org/issues/40059870", "status": "Assigned", "severity": "S4-Minimal", "component": "Internals>Media", "reporter": "m....@gmail.com", "cve_ids": [], "bounty_amount": 6000.0, "reward_amount_meta": 6000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-06-05T22:13:23+00:00", "year": 2022, "attachment_count": 0, "local_path": "issues/40059870", "has_markdown": true }, { "id": "40059860", "title": "Security: XSS in Chrome UI (password settings) with malicious extension name", "url": "https://issues.chromium.org/issues/40059860", "status": "Assigned", "severity": "S3-Low", "component": "Platform>Extensions, UI>Settings", "reporter": "ol...@oliverdunk.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-06-03T22:23:02+00:00", "year": 2022, "attachment_count": 9, "local_path": "issues/40059860", "has_markdown": true }, { "id": "40059843", "title": "Diagcab file extension is not blocklisted to prevent users from downloading harmful files", "url": "https://issues.chromium.org/issues/40059843", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>Downloads", "reporter": "j0...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-06-03T02:33:10+00:00", "year": 2022, "attachment_count": 3, "local_path": "issues/40059843", "has_markdown": true }, { "id": "40059808", "title": "Security: UAF in ManagedConfigurationAPI::GetConfigurationOnBackend", "url": "https://issues.chromium.org/issues/40059808", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Managed, Enterprise", "reporter": "et...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-05-31T08:52:53+00:00", "year": 2022, "attachment_count": 4, "local_path": "issues/40059808", "has_markdown": true }, { "id": "40059796", "title": "Security: Heap use-after-free when bind/unbind TransformFeedback after deleting buffer", "url": "https://issues.chromium.org/issues/40059796", "status": "Assigned", "severity": "S3-Low", "component": "Internals>GPU>ANGLE", "reporter": "gg...@gmail.com", "cve_ids": [], "bounty_amount": 12000.0, "reward_amount_meta": 12000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-05-30T17:35:34+00:00", "year": 2022, "attachment_count": 1, "local_path": "issues/40059796", "has_markdown": true }, { "id": "40059795", "title": "Security: heap-use-after-free in views::DialogDelegate::CancelDialog", "url": "https://issues.chromium.org/issues/40059795", "status": "Assigned", "severity": "S3-Low", "component": "Platform>WebAppProvider", "reporter": "ha...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-05-30T12:18:17+00:00", "year": 2022, "attachment_count": 2, "local_path": "issues/40059795", "has_markdown": true }, { "id": "40059790", "title": "Security: heap-after-free on components/exo/extended_drag_source.cc (Lacros)", "url": "https://issues.chromium.org/issues/40059790", "status": "Assigned", "severity": "S3-Low", "component": "UI>Shell>UIFoundations", "reporter": "rh...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-05-29T03:21:18+00:00", "year": 2022, "attachment_count": 3, "local_path": "issues/40059790", "has_markdown": true }, { "id": "40059787", "title": "Security: Heap-use-after-free in ash::OverviewItem::DestroyPhantomsForDragging", "url": "https://issues.chromium.org/issues/40059787", "status": "Assigned", "severity": "S3-Low", "component": "UI>Shell", "reporter": "ch...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-05-28T02:54:35+00:00", "year": 2022, "attachment_count": 1, "local_path": "issues/40059787", "has_markdown": true }, { "id": "40059784", "title": "Security: Heap-use-after-free in ash::TabletModeBrowserWindowDragSessionWindowsHider::~TabletModeBrowserWindowDragSessionWindowsHider", "url": "https://issues.chromium.org/issues/40059784", "status": "Assigned", "severity": "S3-Low", "component": "UI>Shell", "reporter": "ch...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-05-28T02:25:34+00:00", "year": 2022, "attachment_count": 7, "local_path": "issues/40059784", "has_markdown": true }, { "id": "40059777", "title": "AddressSanitizer: heap-buffer-overflow in content::BucketManagerHost::DidGetBucket content/browser/b", "url": "https://issues.chromium.org/issues/40059777", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Storage>Buckets", "reporter": "m....@gmail.com", "cve_ids": [], "bounty_amount": 21000.0, "reward_amount_meta": 21000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-05-27T16:23:10+00:00", "year": 2022, "attachment_count": 2, "local_path": "issues/40059777", "has_markdown": true }, { "id": "40059774", "title": "Security: UAF in PermissionPromptBubbleView", "url": "https://issues.chromium.org/issues/40059774", "status": "New", "severity": "S3-Low", "component": "Internals>Views, UI>Browser>Permissions>Prompts", "reporter": "le...@gmail.com", "cve_ids": [], "bounty_amount": 20000.0, "reward_amount_meta": 20000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-05-27T13:02:18+00:00", "year": 2022, "attachment_count": 3, "local_path": "issues/40059774", "has_markdown": true }, { "id": "40059765", "title": "Security: Web Share dialog URL is not elided correctly on Android", "url": "https://issues.chromium.org/issues/40059765", "status": "Assigned", "severity": "S3-Low", "component": "Blink>WebShare, UI>Security (Use Subcomponent)>UrlFormatting", "reporter": "st...@gmail.com", "cve_ids": [], "bounty_amount": 500.0, "reward_amount_meta": 500.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-05-26T16:50:35+00:00", "year": 2022, "attachment_count": 3, "local_path": "issues/40059765", "has_markdown": true }, { "id": "40059762", "title": "'unsafe-inline' is not ignored even though 'strict-dynamic' is specified in dafault-src.", "url": "https://issues.chromium.org/issues/40059762", "status": "Accepted", "severity": "S3-Low", "component": "Blink>SecurityFeature>ContentSecurityPolicy", "reporter": "tj...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-05-26T10:20:36+00:00", "year": 2022, "attachment_count": 0, "local_path": "issues/40059762", "has_markdown": true }, { "id": "40059754", "title": "Security: PageSpeed Insights: DDOS via Blind XSS", "url": "https://issues.chromium.org/issues/40059754", "status": "Accepted", "severity": "S3-Low", "component": "Internals>Headless", "reporter": "[Deleted User]", "cve_ids": [], "bounty_amount": 500.0, "reward_amount_meta": 500.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-05-25T21:26:06+00:00", "year": 2022, "attachment_count": 0, "local_path": "issues/40059754", "has_markdown": true }, { "id": "40059725", "title": "AddressSanitizer: heap-use-after-free in content::ScreenlockMonitor::RemoveObserver content/browser/", "url": "https://issues.chromium.org/issues/40059725", "status": "Assigned", "severity": "S3-Low", "component": "Blink>GetUserMedia", "reporter": "m....@gmail.com", "cve_ids": [], "bounty_amount": 11000.0, "reward_amount_meta": 11000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-05-23T09:54:27+00:00", "year": 2022, "attachment_count": 1, "local_path": "issues/40059725", "has_markdown": true }, { "id": "40059717", "title": "AddressSanitizer: heap-use-after-free storage::QuotaDatabase::CreateBucketInternal quota_database.cc", "url": "https://issues.chromium.org/issues/40059717", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Storage>Quota", "reporter": "m....@gmail.com", "cve_ids": [], "bounty_amount": 16000.0, "reward_amount_meta": 16000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-05-22T08:24:23+00:00", "year": 2022, "attachment_count": 2, "local_path": "issues/40059717", "has_markdown": true }, { "id": "40059710", "title": "Security: Chrome on Android Tablet Mode Select Dropdown Spinner able to Overlap Fullscreen Notification Toast", "url": "https://issues.chromium.org/issues/40059710", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>FullScreen", "reporter": "su...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-05-20T02:01:14+00:00", "year": 2022, "attachment_count": 3, "local_path": "issues/40059710", "has_markdown": true }, { "id": "40059705", "title": "Security: UAF in InterestGroupPermissionsChecker::OnRequestComplete", "url": "https://issues.chromium.org/issues/40059705", "status": "Assigned", "severity": "S3-Low", "component": "Blink>InterestGroups", "reporter": "et...@gmail.com", "cve_ids": [], "bounty_amount": 20000.0, "reward_amount_meta": 20000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-05-19T16:30:57+00:00", "year": 2022, "attachment_count": 8, "local_path": "issues/40059705", "has_markdown": true }, { "id": "40059699", "title": "Security: Heap-use-after-free in ash::SavedDeskDialogController::CreateDialogWidget", "url": "https://issues.chromium.org/issues/40059699", "status": "Assigned", "severity": "S3-Low", "component": "UI>Shell", "reporter": "ch...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-05-18T23:34:49+00:00", "year": 2022, "attachment_count": 2, "local_path": "issues/40059699", "has_markdown": true }, { "id": "40059686", "title": "Security: Lackluster \"File System Access API\" block-list provides full disk read/write access", "url": "https://issues.chromium.org/issues/40059686", "status": "Accepted", "severity": "S3-Low", "component": "Blink>Storage>FileSystem", "reporter": "ha...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-05-18T06:22:19+00:00", "year": 2022, "attachment_count": 1, "local_path": "issues/40059686", "has_markdown": true }, { "id": "40059681", "title": "Security: Use-after-free in WebGPU", "url": "https://issues.chromium.org/issues/40059681", "status": "Assigned", "severity": "S3-Low", "component": "Blink>WebGPU", "reporter": "da...@davidmanouchehri.com", "cve_ids": [ "CVE-2017-15399" ], "bounty_amount": 10000.0, "reward_amount_meta": 10000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-05-16T18:42:05+00:00", "year": 2022, "attachment_count": 1, "local_path": "issues/40059681", "has_markdown": true }, { "id": "40059675", "title": "AddressSanitizer: heap-use-after-free location_bar\\permission_request_chip.cc:127 in PermissionReque", "url": "https://issues.chromium.org/issues/40059675", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>Omnibox, UI>Browser>Permissions>Prompts", "reporter": "m....@gmail.com", "cve_ids": [], "bounty_amount": 15000.0, "reward_amount_meta": 15000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-05-16T03:20:43+00:00", "year": 2022, "attachment_count": 8, "local_path": "issues/40059675", "has_markdown": true }, { "id": "40059668", "title": "Security: heap-after-free on iOS 15.4 simulator + Chromium Dev Asan", "url": "https://issues.chromium.org/issues/40059668", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>Mobile>AppMenu", "reporter": "rh...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-05-14T22:36:19+00:00", "year": 2022, "attachment_count": 0, "local_path": "issues/40059668", "has_markdown": true }, { "id": "40059663", "title": "Security: UAF in WebAuthnIconView", "url": "https://issues.chromium.org/issues/40059663", "status": "Assigned", "severity": "S3-Low", "component": "Blink>WebAuthentication", "reporter": "le...@gmail.com", "cve_ids": [], "bounty_amount": 10000.0, "reward_amount_meta": 10000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-05-13T15:50:08+00:00", "year": 2022, "attachment_count": 6, "local_path": "issues/40059663", "has_markdown": true }, { "id": "40059660", "title": "AddressSanitizer: use-after-poison blink\\renderer\\bindings\\core\\v8\\script_promise_resolver.h:164 in ", "url": "https://issues.chromium.org/issues/40059660", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Bindings", "reporter": "m....@gmail.com", "cve_ids": [], "bounty_amount": 6000.0, "reward_amount_meta": 6000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-05-13T09:39:47+00:00", "year": 2022, "attachment_count": 2, "local_path": "issues/40059660", "has_markdown": true }, { "id": "40059659", "title": "UAF in GestureRecognizerImpl.", "url": "https://issues.chromium.org/issues/40059659", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Input, UI>Input", "reporter": "pt...@vewd.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-05-13T09:23:53+00:00", "year": 2022, "attachment_count": 0, "local_path": "issues/40059659", "has_markdown": true }, { "id": "40059657", "title": "Security: heap-after-free on ash/wm/splitview/split_view_controller.cc (chromeOS)", "url": "https://issues.chromium.org/issues/40059657", "status": "Accepted", "severity": "Unknown", "component": "UI>Shell", "reporter": "rh...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-05-12T17:25:54+00:00", "year": 2022, "attachment_count": 3, "local_path": "issues/40059657", "has_markdown": true }, { "id": "40059651", "title": "AddressSanitizer: heap-use-after-free __memory/unique_ptr.h:312:28 in mojo::Connector::HandleError(b", "url": "https://issues.chromium.org/issues/40059651", "status": "New", "severity": "S3-Low", "component": "Blink>Storage>IndexedDB", "reporter": "m....@gmail.com", "cve_ids": [], "bounty_amount": 21000.0, "reward_amount_meta": 21000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-05-12T08:15:06+00:00", "year": 2022, "attachment_count": 3, "local_path": "issues/40059651", "has_markdown": true }, { "id": "40059630", "title": "Heap-use-after-free in blink::NGHighlightPainter::NGHighlightPainter", "url": "https://issues.chromium.org/issues/40059630", "status": "Assigned", "severity": "S4-Minimal", "component": "Blink>Paint", "reporter": "cl...@chromium.org", "cve_ids": [], "bounty_amount": 6000.0, "reward_amount_meta": 6000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-05-10T19:15:08+00:00", "year": 2022, "attachment_count": 0, "local_path": "issues/40059630", "has_markdown": true }, { "id": "40224936", "title": "Security: Chrome on Android requestFullscreen then back or forward navigation on BFcache page able to hide omnibox", "url": "https://issues.chromium.org/issues/40224936", "status": "Accepted", "severity": "S3-Low", "component": "UI>Browser>FullScreen, UI>Browser>Navigation>BFCache", "reporter": "su...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-05-10T13:18:25+00:00", "year": 2022, "attachment_count": 22, "local_path": "issues/40224936", "has_markdown": true }, { "id": "40059595", "title": "Security: Share hub dialog doesn't show the origin elided from the right", "url": "https://issues.chromium.org/issues/40059595", "status": "Accepted", "severity": "S3-Low", "component": "UI>Browser>Sharing", "reporter": "ch...@gmail.com", "cve_ids": [], "bounty_amount": 500.0, "reward_amount_meta": 500.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-05-09T00:24:28+00:00", "year": 2022, "attachment_count": 1, "local_path": "issues/40059595", "has_markdown": true }, { "id": "40059591", "title": "memeory corruption in frame_queue_underlying_source.cc", "url": "https://issues.chromium.org/issues/40059591", "status": "Assigned", "severity": "S3-Low", "component": "Blink>MediaStream", "reporter": "em...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-05-07T17:03:05+00:00", "year": 2022, "attachment_count": 5, "local_path": "issues/40059591", "has_markdown": true }, { "id": "40059589", "title": "Security: Use-after-Free in InstallUpdateCallback", "url": "https://issues.chromium.org/issues/40059589", "status": "Assigned", "severity": "S3-Low", "component": "Platform>Extensions", "reporter": "hu...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-05-07T09:22:16+00:00", "year": 2022, "attachment_count": 0, "local_path": "issues/40059589", "has_markdown": true }, { "id": "40059582", "title": "Security: UAF in UserEducationInternalsPageHandlerImpl::GetFeaturePromos", "url": "https://issues.chromium.org/issues/40059582", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>UserEducation", "reporter": "et...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-05-06T12:53:08+00:00", "year": 2022, "attachment_count": 2, "local_path": "issues/40059582", "has_markdown": true }, { "id": "40059571", "title": "Security DCHECK(TypeConfuse) failed: IsA(from) in blink::VisualViewport::StartTrackingPinch", "url": "https://issues.chromium.org/issues/40059571", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Input", "reporter": "m....@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-05-05T09:25:52+00:00", "year": 2022, "attachment_count": 2, "local_path": "issues/40059571", "has_markdown": true }, { "id": "40059569", "title": "Security: UAF in DiscardsGraphDumpImpl", "url": "https://issues.chromium.org/issues/40059569", "status": "Assigned", "severity": "S3-Low", "component": "Internals>PerformanceManager", "reporter": "wg...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-05-05T03:35:04+00:00", "year": 2022, "attachment_count": 5, "local_path": "issues/40059569", "has_markdown": true }, { "id": "40059532", "title": "Security: Keystroke side-channel leakage ", "url": "https://issues.chromium.org/issues/40059532", "status": "Assigned", "severity": "S3-Low", "component": "IO>Keyboard", "reporter": "er...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-04-30T12:20:19+00:00", "year": 2022, "attachment_count": 5, "local_path": "issues/40059532", "has_markdown": true }, { "id": "40059525", "title": "Security: bypass CSP navigate-to feature with serviceWorker navigate function", "url": "https://issues.chromium.org/issues/40059525", "status": "Accepted", "severity": "S4-Minimal", "component": "Blink>SecurityFeature>ContentSecurityPolicy", "reporter": "0x...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-04-29T16:01:04+00:00", "year": 2022, "attachment_count": 3, "local_path": "issues/40059525", "has_markdown": true }, { "id": "40059520", "title": "Security: Debug check failed: marking_state_->IsBlackOrGrey(heap_object).", "url": "https://issues.chromium.org/issues/40059520", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript", "reporter": "p4...@gmail.com", "cve_ids": [], "bounty_amount": 7500.0, "reward_amount_meta": 7500.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-04-29T11:02:11+00:00", "year": 2022, "attachment_count": 2, "local_path": "issues/40059520", "has_markdown": true }, { "id": "40059505", "title": "Use-after-Free on BuildWebAppInternalsJson", "url": "https://issues.chromium.org/issues/40059505", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>WebAppInstalls", "reporter": "gr...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-04-28T07:27:16+00:00", "year": 2022, "attachment_count": 5, "local_path": "issues/40059505", "has_markdown": true }, { "id": "40059502", "title": "Security: Heap-use-after-free in sharing_hub::SharingHubBubbleController::OnBubbleClosed", "url": "https://issues.chromium.org/issues/40059502", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>Sharing", "reporter": "me...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-04-28T03:50:10+00:00", "year": 2022, "attachment_count": 2, "local_path": "issues/40059502", "has_markdown": true }, { "id": "40059501", "title": "Security: Chrome on Android Hide Fullscreen Notification Toast When Multiple Times Enter and Exit Fullscreen", "url": "https://issues.chromium.org/issues/40059501", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Fullscreen", "reporter": "su...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-04-27T23:33:11+00:00", "year": 2022, "attachment_count": 3, "local_path": "issues/40059501", "has_markdown": true }, { "id": "40059492", "title": "Security: Heap-use-after-free in ReadAnythingToolbarView ", "url": "https://issues.chromium.org/issues/40059492", "status": "Assigned", "severity": "S4-Minimal", "component": "UI>Accessibility", "reporter": "me...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-04-27T07:13:30+00:00", "year": 2022, "attachment_count": 2, "local_path": "issues/40059492", "has_markdown": true }, { "id": "40059489", "title": "UAF in ash::HatsDialog::Show", "url": "https://issues.chromium.org/issues/40059489", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>HaTS", "reporter": "et...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-04-27T04:28:55+00:00", "year": 2022, "attachment_count": 2, "local_path": "issues/40059489", "has_markdown": true }, { "id": "40059482", "title": "Security: [ANGLE] Heap use-after-free when deleting TransformFeedback", "url": "https://issues.chromium.org/issues/40059482", "status": "Assigned", "severity": "S3-Low", "component": "Internals>GPU>ANGLE", "reporter": "gg...@gmail.com", "cve_ids": [], "bounty_amount": 10000.0, "reward_amount_meta": 10000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-04-26T20:17:05+00:00", "year": 2022, "attachment_count": 1, "local_path": "issues/40059482", "has_markdown": true }, { "id": "40059476", "title": "Security: Type Confusion in Portal::ActivateImpl", "url": "https://issues.chromium.org/issues/40059476", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Portals", "reporter": "jt...@gmail.com", "cve_ids": [], "bounty_amount": 20000.0, "reward_amount_meta": 20000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-04-26T11:58:51+00:00", "year": 2022, "attachment_count": 5, "local_path": "issues/40059476", "has_markdown": true }, { "id": "40059473", "title": "AddressSanitizer: heap-use-after-free in PermissionRequestChip::CreateBubble", "url": "https://issues.chromium.org/issues/40059473", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>Omnibox, UI>Browser>Permissions>Prompts", "reporter": "m....@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-04-26T09:23:35+00:00", "year": 2022, "attachment_count": 1, "local_path": "issues/40059473", "has_markdown": true }, { "id": "40059457", "title": "heap-use-after-free on content::DevToolsAgentHostImpl::ForceDetachAllSessions", "url": "https://issues.chromium.org/issues/40059457", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Portals, Platform>DevTools", "reporter": "xp...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-04-25T04:02:54+00:00", "year": 2022, "attachment_count": 3, "local_path": "issues/40059457", "has_markdown": true }, { "id": "40059453", "title": "UAF in ash::HatsDialog", "url": "https://issues.chromium.org/issues/40059453", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>HaTS", "reporter": "et...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-04-24T14:06:01+00:00", "year": 2022, "attachment_count": 3, "local_path": "issues/40059453", "has_markdown": true }, { "id": "40059417", "title": "Security: Select dropdown able to overlap fullscreen notification toast", "url": "https://issues.chromium.org/issues/40059417", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>FullScreen", "reporter": "su...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-04-20T03:26:27+00:00", "year": 2022, "attachment_count": 4, "local_path": "issues/40059417", "has_markdown": true }, { "id": "40059416", "title": "Security: container-overflow in ui::Compositor::StopThroughtputTracker", "url": "https://issues.chromium.org/issues/40059416", "status": "Assigned", "severity": "S3-Low", "component": "Internals>Compositing", "reporter": "ch...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-04-19T19:42:03+00:00", "year": 2022, "attachment_count": 2, "local_path": "issues/40059416", "has_markdown": true }, { "id": "40059414", "title": "use after free in SendQueuedMediaEvents", "url": "https://issues.chromium.org/issues/40059414", "status": "Assigned", "severity": "S3-Low", "component": "Internals>Media", "reporter": "em...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-04-19T17:55:38+00:00", "year": 2022, "attachment_count": 2, "local_path": "issues/40059414", "has_markdown": true }, { "id": "40059411", "title": "Security: webgl2 CompileShader Heap Corruption", "url": "https://issues.chromium.org/issues/40059411", "status": "Assigned", "severity": "S3-Low", "component": "Blink>WebGL, Internals>GPU>ANGLE", "reporter": "kh...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-04-19T16:13:29+00:00", "year": 2022, "attachment_count": 5, "local_path": "issues/40059411", "has_markdown": true }, { "id": "40059410", "title": "Security: [ANGLE] Heap use-after-free caused by State::detachBuffer", "url": "https://issues.chromium.org/issues/40059410", "status": "Assigned", "severity": "S3-Low", "component": "Internals>GPU>ANGLE", "reporter": "gg...@gmail.com", "cve_ids": [], "bounty_amount": 10000.0, "reward_amount_meta": 10000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-04-19T14:34:36+00:00", "year": 2022, "attachment_count": 1, "local_path": "issues/40059410", "has_markdown": true }, { "id": "40059400", "title": "[v8] Integer overflow leading to OOB/CHECK in icu_71::FormattedStringBuilder::prepareForInsertHelper", "url": "https://issues.chromium.org/issues/40059400", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript>Internationalization", "reporter": "pw...@korea.ac.kr", "cve_ids": [ "CVE-2021-30535" ], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-04-17T16:15:22+00:00", "year": 2022, "attachment_count": 0, "local_path": "issues/40059400", "has_markdown": true }, { "id": "40059395", "title": "heap-use-after-free in DevToolsWindow::ActivateWindow", "url": "https://issues.chromium.org/issues/40059395", "status": "Assigned", "severity": "S3-Low", "component": "Platform>DevTools", "reporter": "xp...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-04-16T21:46:27+00:00", "year": 2022, "attachment_count": 3, "local_path": "issues/40059395", "has_markdown": true }, { "id": "40059392", "title": "Security: Heap-use-after-free in location::nearby::chrome::ScheduledExecutor::PendingTaskWithTimer", "url": "https://issues.chromium.org/issues/40059392", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>Sharing", "reporter": "ch...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-04-16T04:36:11+00:00", "year": 2022, "attachment_count": 1, "local_path": "issues/40059392", "has_markdown": true }, { "id": "40059390", "title": "Security: heap-use-after-free in views::View::GetEffectiveViewTargeter", "url": "https://issues.chromium.org/issues/40059390", "status": "Assigned", "severity": "S3-Low", "component": "Internals>Views", "reporter": "st...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-04-15T22:24:45+00:00", "year": 2022, "attachment_count": 2, "local_path": "issues/40059390", "has_markdown": true }, { "id": "40059381", "title": "Security: Heap Buffer Overflow in mojo Message", "url": "https://issues.chromium.org/issues/40059381", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript>API, Internals>Mojo>Bindings", "reporter": "ha...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-04-14T16:11:18+00:00", "year": 2022, "attachment_count": 4, "local_path": "issues/40059381", "has_markdown": true }, { "id": "40059378", "title": "DCHECK failure at blink::WebFrameWidgetImpl::DragTargetDragEnter", "url": "https://issues.chromium.org/issues/40059378", "status": "Assigned", "severity": "S3-Low", "component": "Blink>DataTransfer", "reporter": "rz...@gmail.com", "cve_ids": [], "bounty_amount": 1500.0, "reward_amount_meta": 1500.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-04-14T11:35:12+00:00", "year": 2022, "attachment_count": 4, "local_path": "issues/40059378", "has_markdown": true }, { "id": "40059367", "title": "Security: Heap-use-after-free in WebRTCInternals::EnableLocalEventLogRecordings", "url": "https://issues.chromium.org/issues/40059367", "status": "Accepted", "severity": "S3-Low", "component": "Blink>WebRTC", "reporter": "me...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-04-13T05:59:42+00:00", "year": 2022, "attachment_count": 1, "local_path": "issues/40059367", "has_markdown": true }, { "id": "40059358", "title": "Security: navigator.clipboard.read() can lead to mutation XSS", "url": "https://issues.chromium.org/issues/40059358", "status": "Assigned", "severity": "S3-Low", "component": "Blink>DataTransfer", "reporter": "mi...@bentkowski.info", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-04-12T12:55:37+00:00", "year": 2022, "attachment_count": 0, "local_path": "issues/40059358", "has_markdown": true }, { "id": "40059351", "title": "Security: oob read in AudioDelayDSPKernel::ProcessKRate", "url": "https://issues.chromium.org/issues/40059351", "status": "Assigned", "severity": "S3-Low", "component": "Blink>WebAudio", "reporter": "su...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-04-11T14:18:35+00:00", "year": 2022, "attachment_count": 0, "local_path": "issues/40059351", "has_markdown": true }, { "id": "40059349", "title": "Security: Segv on unknown address in views::internal::NativeWidgetPrivate::ReparentNativeView", "url": "https://issues.chromium.org/issues/40059349", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>TopChrome>TabStrip", "reporter": "ch...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-04-11T05:02:59+00:00", "year": 2022, "attachment_count": 3, "local_path": "issues/40059349", "has_markdown": true }, { "id": "40059347", "title": "Security: Drag and Drop XSS", "url": "https://issues.chromium.org/issues/40059347", "status": "Assigned", "severity": "S3-Low", "component": "Blink>DataTransfer, Blink>Editing, Blink>SVG", "reporter": "mi...@bentkowski.info", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-04-10T19:35:57+00:00", "year": 2022, "attachment_count": 1, "local_path": "issues/40059347", "has_markdown": true }, { "id": "40059339", "title": "Security: Heap-use-after-free in remote_cocoa::NativeWidgetNSWindowBridge::SetVisibilityState", "url": "https://issues.chromium.org/issues/40059339", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser", "reporter": "ch...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-04-09T05:18:00+00:00", "year": 2022, "attachment_count": 2, "local_path": "issues/40059339", "has_markdown": true }, { "id": "40059331", "title": "Security: UAF in SegmentationPlatformServiceImpl", "url": "https://issues.chromium.org/issues/40059331", "status": "Assigned", "severity": "S3-Low", "component": "Internals>SegmentationPlatform", "reporter": "le...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-04-08T10:43:25+00:00", "year": 2022, "attachment_count": 2, "local_path": "issues/40059331", "has_markdown": true }, { "id": "40059327", "title": "Security: heap-use-after-free in PDFium CPDFSDK_AppStream::Write", "url": "https://issues.chromium.org/issues/40059327", "status": "Assigned", "severity": "S4-Minimal", "component": "Internals>Plugins>PDF", "reporter": "mu...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-04-08T09:38:13+00:00", "year": 2022, "attachment_count": 1, "local_path": "issues/40059327", "has_markdown": true }, { "id": "40059323", "title": "Security: JS object corruption in WasmJS::InstallConditionFeatures (CVE-2021-30561 variant)", "url": "https://issues.chromium.org/issues/40059323", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript>WebAssembly", "reporter": "bt...@gmail.com", "cve_ids": [ "CVE-2021-30561" ], "bounty_amount": 7500.0, "reward_amount_meta": 7500.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-04-08T05:37:43+00:00", "year": 2022, "attachment_count": 0, "local_path": "issues/40059323", "has_markdown": true }, { "id": "40059319", "title": "bad free in gpu ~PackedEnumMap", "url": "https://issues.chromium.org/issues/40059319", "status": "Assigned", "severity": "S3-Low", "component": "Internals>GPU, Internals>GPU>ANGLE, Internals>GPU>SwiftShader, Internals>GPU>Vulkan", "reporter": "em...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-04-07T17:08:17+00:00", "year": 2022, "attachment_count": 2, "local_path": "issues/40059319", "has_markdown": true }, { "id": "40059315", "title": "Tab reliably crashing with STATUS_ACCESS_VIOLATION with reproduction steps", "url": "https://issues.chromium.org/issues/40059315", "status": "Assigned", "severity": "S3-Low", "component": "Platform>DevTools", "reporter": "mi...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-04-07T14:16:39+00:00", "year": 2022, "attachment_count": 2, "local_path": "issues/40059315", "has_markdown": true }, { "id": "40059305", "title": "Security: heap-buffer-overflow on ash/wm/window_animations.cc (chromeOS)", "url": "https://issues.chromium.org/issues/40059305", "status": "Assigned", "severity": "S3-Low", "component": "Internals>Cast", "reporter": "rh...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-04-06T16:51:25+00:00", "year": 2022, "attachment_count": 8, "local_path": "issues/40059305", "has_markdown": true }, { "id": "40059304", "title": "Security: [ANGLE] Heap use-after-free in ContextVk::onBeginTransformFeedback", "url": "https://issues.chromium.org/issues/40059304", "status": "Assigned", "severity": "S3-Low", "component": "Internals>GPU>Vulkan", "reporter": "gg...@gmail.com", "cve_ids": [], "bounty_amount": 10000.0, "reward_amount_meta": 10000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-04-06T12:54:31+00:00", "year": 2022, "attachment_count": 1, "local_path": "issues/40059304", "has_markdown": true }, { "id": "40059299", "title": "Security: heap-buffer-overflow on components/ui_devtools/views/devtools_server_util.cc", "url": "https://issues.chromium.org/issues/40059299", "status": "Accepted", "severity": "S3-Low", "component": "Platform>DevTools", "reporter": "rh...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-04-05T20:15:48+00:00", "year": 2022, "attachment_count": 5, "local_path": "issues/40059299", "has_markdown": true }, { "id": "40059289", "title": "Google Chrome WebGPU DoBufferDestroy kDirect allocation use-after-free vulnerability - TALOS-2022-1508", "url": "https://issues.chromium.org/issues/40059289", "status": "Assigned", "severity": "S3-Low", "component": "Blink>WebGPU", "reporter": "vu...@sourcefire.com", "cve_ids": [], "bounty_amount": 10000.0, "reward_amount_meta": 10000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-04-04T20:10:54+00:00", "year": 2022, "attachment_count": 1, "local_path": "issues/40059289", "has_markdown": true }, { "id": "40059281", "title": "AddressSanitizer: heap-use-after-free element.cc:3611 in blink::Element::RecalcOwnStyle", "url": "https://issues.chromium.org/issues/40059281", "status": "Assigned", "severity": "S3-Low", "component": "Blink>CSS", "reporter": "m....@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-04-02T07:08:28+00:00", "year": 2022, "attachment_count": 3, "local_path": "issues/40059281", "has_markdown": true }, { "id": "40059279", "title": "VideoTrackGenerator fails Security DCHECK(TypeConfuse) failure: IsA(from) in casting.h", "url": "https://issues.chromium.org/issues/40059279", "status": "Accepted", "severity": "S3-Low", "component": "Blink>GetUserMedia", "reporter": "m....@gmail.com", "cve_ids": [], "bounty_amount": 8000.0, "reward_amount_meta": 8000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-04-02T03:21:55+00:00", "year": 2022, "attachment_count": 2, "local_path": "issues/40059279", "has_markdown": true }, { "id": "40059272", "title": "Security: heap-use-after-free on components/global_media_controls/public/views/media_item_ui_list_view.cc", "url": "https://issues.chromium.org/issues/40059272", "status": "Assigned", "severity": "S3-Low", "component": "Internals>Media>UI", "reporter": "rh...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-04-01T14:43:32+00:00", "year": 2022, "attachment_count": 5, "local_path": "issues/40059272", "has_markdown": true }, { "id": "40059268", "title": "heap-buffer-overflow on ui_devtools::UIElement::ReorderChild", "url": "https://issues.chromium.org/issues/40059268", "status": "Accepted", "severity": "S3-Low", "component": "Platform>DevTools", "reporter": "xp...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-04-01T01:43:24+00:00", "year": 2022, "attachment_count": 2, "local_path": "issues/40059268", "has_markdown": true }, { "id": "40059265", "title": "Security: heap-use-after-free in content::WebContentsViewAura::StartDragging", "url": "https://issues.chromium.org/issues/40059265", "status": "Accepted", "severity": "S3-Low", "component": "Blink>Portals", "reporter": "st...@gmail.com", "cve_ids": [], "bounty_amount": 15000.0, "reward_amount_meta": 15000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-03-31T19:48:58+00:00", "year": 2022, "attachment_count": 2, "local_path": "issues/40059265", "has_markdown": true }, { "id": "40059254", "title": "Security: heap-use-after-free ash/host/ash_window_tree_host_unified.cc", "url": "https://issues.chromium.org/issues/40059254", "status": "Assigned", "severity": "S3-Low", "component": "UI>Shell", "reporter": "rh...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-03-31T02:46:51+00:00", "year": 2022, "attachment_count": 2, "local_path": "issues/40059254", "has_markdown": true }, { "id": "40059251", "title": "Security: Browser-side origin confusion for javascript/data URLs opened in a new window/tab by cross-origin iframe", "url": "https://issues.chromium.org/issues/40059251", "status": "Assigned", "severity": "S3-Low", "component": "Internals>Sandbox>SiteIsolation, UI>Browser>Navigation, UI>Browser>Permissions", "reporter": "al...@alesandroortiz.com", "cve_ids": [], "bounty_amount": 20000.0, "reward_amount_meta": 20000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-03-30T21:21:42+00:00", "year": 2022, "attachment_count": 28, "local_path": "issues/40059251", "has_markdown": true }, { "id": "40059248", "title": "Security: UAF in DumpDatabaseHandler", "url": "https://issues.chromium.org/issues/40059248", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Storage>FileSystem", "reporter": "le...@gmail.com", "cve_ids": [], "bounty_amount": 15000.0, "reward_amount_meta": 15000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-03-30T16:03:42+00:00", "year": 2022, "attachment_count": 3, "local_path": "issues/40059248", "has_markdown": true }, { "id": "40059247", "title": "Android Chrome FullScreen Notification Can be Overlapped by Pop-up Blocker Notification", "url": "https://issues.chromium.org/issues/40059247", "status": "Accepted", "severity": "S3-Low", "component": "UI>Browser>FullScreen, UI>Browser>Mobile>Messages", "reporter": "sh...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-03-30T15:21:07+00:00", "year": 2022, "attachment_count": 4, "local_path": "issues/40059247", "has_markdown": true }, { "id": "40059215", "title": "Use-after-Free on crostini::CrostiniExportImport::OpenFileDialog", "url": "https://issues.chromium.org/issues/40059215", "status": "Assigned", "severity": "S3-Low", "component": "UI>Shell", "reporter": "et...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-03-28T09:19:54+00:00", "year": 2022, "attachment_count": 2, "local_path": "issues/40059215", "has_markdown": true }, { "id": "40059207", "title": "Security: chrome.downloads.download could be abused to steal user's environment variables like secrets, tokens or keys on windows.", "url": "https://issues.chromium.org/issues/40059207", "status": "Accepted", "severity": "S3-Low", "component": "Platform>Extensions>API", "reporter": "zh...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-03-26T03:23:32+00:00", "year": 2022, "attachment_count": 4, "local_path": "issues/40059207", "has_markdown": true }, { "id": "40059172", "title": "AddressSanitizer: heap-use-after-free in isCubeCompatible third_party/swiftshader/src/Vulkan/VkImage.cpp:905:25", "url": "https://issues.chromium.org/issues/40059172", "status": "Assigned", "severity": "S3-Low", "component": "Internals>GPU>SwiftShader", "reporter": "m....@gmail.com", "cve_ids": [], "bounty_amount": 13000.0, "reward_amount_meta": 13000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-03-22T10:42:42+00:00", "year": 2022, "attachment_count": 1, "local_path": "issues/40059172", "has_markdown": true }, { "id": "40059165", "title": "Security: Abuse the user's system environment variables in download attribute may cause DLL Hijacking or Path Interception ", "url": "https://issues.chromium.org/issues/40059165", "status": "Assigned", "severity": "S3-Low", "component": "Internals>PlatformIntegration, UI>Browser>Downloads", "reporter": "0x...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-03-21T15:16:04+00:00", "year": 2022, "attachment_count": 3, "local_path": "issues/40059165", "has_markdown": true }, { "id": "40059164", "title": "Security: UAF in SyncConfirmation", "url": "https://issues.chromium.org/issues/40059164", "status": "Assigned", "severity": "S3-Low", "component": "Internals>Sandbox>SiteIsolation", "reporter": "le...@gmail.com", "cve_ids": [], "bounty_amount": 10000.0, "reward_amount_meta": 10000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-03-21T13:49:38+00:00", "year": 2022, "attachment_count": 2, "local_path": "issues/40059164", "has_markdown": true }, { "id": "40059152", "title": "Security: Chrome Apps: Possible to read environment variables using suggestedName in chrome.fileSystem.chooseEntry", "url": "https://issues.chromium.org/issues/40059152", "status": "Accepted", "severity": "S3-Low", "component": "Platform>Apps>API", "reporter": "st...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-03-20T17:44:19+00:00", "year": 2022, "attachment_count": 4, "local_path": "issues/40059152", "has_markdown": true }, { "id": "40059141", "title": "Security: .url files can redirect showSaveFilePicker into an arbitrary file", "url": "https://issues.chromium.org/issues/40059141", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Storage>FileSystem", "reporter": "ve...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-03-18T22:27:06+00:00", "year": 2022, "attachment_count": 1, "local_path": "issues/40059141", "has_markdown": true }, { "id": "40059136", "title": "Type confuse in blink::To layout_table.cc:175", "url": "https://issues.chromium.org/issues/40059136", "status": "Accepted", "severity": "S3-Low", "component": "Blink>Layout", "reporter": "m....@gmail.com", "cve_ids": [], "bounty_amount": 6000.0, "reward_amount_meta": 6000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-03-18T08:49:29+00:00", "year": 2022, "attachment_count": 2, "local_path": "issues/40059136", "has_markdown": true }, { "id": "40059133", "title": "Security: RegExp[@@replace] missing write barrier, leading to RCE", "url": "https://issues.chromium.org/issues/40059133", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript>Regexp", "reporter": "bt...@gmail.com", "cve_ids": [], "bounty_amount": 20000.0, "reward_amount_meta": 20000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-03-18T03:22:13+00:00", "year": 2022, "attachment_count": 9, "local_path": "issues/40059133", "has_markdown": true }, { "id": "40059112", "title": "Security: Incomplete patch for issue 1246631 (CVE-2021-37981) and inaccurate scaling in EyeDropperView", "url": "https://issues.chromium.org/issues/40059112", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Forms>Color", "reporter": "l4...@gmail.com", "cve_ids": [ "CVE-2021-37981" ], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-03-16T15:54:14+00:00", "year": 2022, "attachment_count": 4, "local_path": "issues/40059112", "has_markdown": true }, { "id": "40059105", "title": "AddressSanitizer: heap-use-after-free components/history/core/browser/history_backend.cc:2542:22 in history::HistoryBackend::KillHistoryDatabase()", "url": "https://issues.chromium.org/issues/40059105", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>History", "reporter": "m....@gmail.com", "cve_ids": [], "bounty_amount": 16000.0, "reward_amount_meta": 16000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-03-15T15:53:28+00:00", "year": 2022, "attachment_count": 1, "local_path": "issues/40059105", "has_markdown": true }, { "id": "40059102", "title": "Security: Sanitizer API bypass via prototype pollution", "url": "https://issues.chromium.org/issues/40059102", "status": "Fixed", "severity": "S3-Low", "component": "Blink>SecurityFeature>SanitizerAPI", "reporter": "mi...@bentkowski.info", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-03-15T12:23:28+00:00", "year": 2022, "attachment_count": 0, "local_path": "issues/40059102", "has_markdown": true }, { "id": "40059101", "title": "getThumbnail() CHECK leaks number of available PDF pages", "url": "https://issues.chromium.org/issues/40059101", "status": "Accepted", "severity": "S3-Low", "component": "Internals>Plugins>PDF", "reporter": "nd...@protonmail.com", "cve_ids": [], "bounty_amount": 500.0, "reward_amount_meta": 500.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-03-15T12:05:52+00:00", "year": 2022, "attachment_count": 0, "local_path": "issues/40059101", "has_markdown": true }, { "id": "40059077", "title": "AddressSanitizer: use-after-poison in blink::WebrtcVideoPerfReporter::InitializeOnTaskRunner webrtc_video_perf_reporter.cc:36", "url": "https://issues.chromium.org/issues/40059077", "status": "Assigned", "severity": "S3-Low", "component": "Blink>WebRTC>Perf", "reporter": "m....@gmail.com", "cve_ids": [], "bounty_amount": 6000.0, "reward_amount_meta": 6000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-03-13T03:35:02+00:00", "year": 2022, "attachment_count": 3, "local_path": "issues/40059077", "has_markdown": true }, { "id": "40059074", "title": "uaf in BookmarkBarView::OnTabGroupButtonPressed", "url": "https://issues.chromium.org/issues/40059074", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>TopChrome>TabStrip>TabGroups", "reporter": "wx...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-03-12T12:58:15+00:00", "year": 2022, "attachment_count": 3, "local_path": "issues/40059074", "has_markdown": true }, { "id": "40059071", "title": "File picker UI spoof", "url": "https://issues.chromium.org/issues/40059071", "status": "Accepted", "severity": "S3-Low", "component": "Blink>Forms>File, UI>Browser>Navigation", "reporter": "nd...@protonmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-03-11T22:15:30+00:00", "year": 2022, "attachment_count": 2, "local_path": "issues/40059071", "has_markdown": true }, { "id": "40059056", "title": "Leaking window.length without opener reference. ", "url": "https://issues.chromium.org/issues/40059056", "status": "Accepted", "severity": "S3-Low", "component": "Blink>SecurityFeature>COOP, Internals>Sandbox>SiteIsolation, UI>Browser>Navigation", "reporter": "nd...@protonmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-03-10T22:59:01+00:00", "year": 2022, "attachment_count": 0, "local_path": "issues/40059056", "has_markdown": true }, { "id": "40059047", "title": "[ANGLE] Vulkan Use After Free in onBeginTransformFeedback", "url": "https://issues.chromium.org/issues/40059047", "status": "Assigned", "severity": "S4-Minimal", "component": "Internals>GPU>ANGLE", "reporter": "sj...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-03-10T13:52:19+00:00", "year": 2022, "attachment_count": 3, "local_path": "issues/40059047", "has_markdown": true }, { "id": "40059038", "title": "Security: use after free in cups_printers_handler", "url": "https://issues.chromium.org/issues/40059038", "status": "Fixed", "severity": "S3-Low", "component": "Internals>Printing", "reporter": "ch...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-03-09T20:26:37+00:00", "year": 2022, "attachment_count": 0, "local_path": "issues/40059038", "has_markdown": true }, { "id": "40059026", "title": "Security: Debug check failed: type.representation() == MachineRepresentation::kFloat64 || type.representation() == MachineRepresentation::kTagged.", "url": "https://issues.chromium.org/issues/40059026", "status": "Assigned", "severity": "S4-Minimal", "component": "Blink>JavaScript>Compiler>Turbofan", "reporter": "p4...@gmail.com", "cve_ids": [], "bounty_amount": 8500.0, "reward_amount_meta": 8500.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-03-09T11:59:34+00:00", "year": 2022, "attachment_count": 2, "local_path": "issues/40059026", "has_markdown": true }, { "id": "40059019", "title": "Security: UAF in ui/ozone/platform/wayland/host/wayland_window.cc", "url": "https://issues.chromium.org/issues/40059019", "status": "Assigned", "severity": "S3-Low", "component": "Internals>Ozone", "reporter": "rz...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-03-08T20:20:55+00:00", "year": 2022, "attachment_count": 1, "local_path": "issues/40059019", "has_markdown": true }, { "id": "40059011", "title": "Security: UAF in ScanningHandler", "url": "https://issues.chromium.org/issues/40059011", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>WebUI", "reporter": "le...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-03-08T11:44:19+00:00", "year": 2022, "attachment_count": 1, "local_path": "issues/40059011", "has_markdown": true }, { "id": "40059009", "title": "uaf in FrameSinkVideoCaptureDevice::OnLog", "url": "https://issues.chromium.org/issues/40059009", "status": "Accepted", "severity": "S3-Low", "component": "Internals>Media", "reporter": "qi...@gmail.com", "cve_ids": [], "bounty_amount": 500.0, "reward_amount_meta": 500.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-03-08T07:57:48+00:00", "year": 2022, "attachment_count": 0, "local_path": "issues/40059009", "has_markdown": true }, { "id": "40059003", "title": "Security: HeapOverflow in CertificatesHandler", "url": "https://issues.chromium.org/issues/40059003", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>WebUI", "reporter": "le...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-03-07T15:31:03+00:00", "year": 2022, "attachment_count": 1, "local_path": "issues/40059003", "has_markdown": true }, { "id": "40059002", "title": "Security: HeapOverflow in Diagnostics", "url": "https://issues.chromium.org/issues/40059002", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>WebUI", "reporter": "le...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-03-07T15:30:58+00:00", "year": 2022, "attachment_count": 1, "local_path": "issues/40059002", "has_markdown": true }, { "id": "40059001", "title": "Security: HeapOverflow in ScanningHandler", "url": "https://issues.chromium.org/issues/40059001", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>WebUI", "reporter": "le...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-03-07T15:30:53+00:00", "year": 2022, "attachment_count": 1, "local_path": "issues/40059001", "has_markdown": true }, { "id": "40059000", "title": "Heap-use-after-free in blink::BoxPainterBase::PaintFillLayer", "url": "https://issues.chromium.org/issues/40059000", "status": "Assigned", "severity": "S4-Minimal", "component": "Blink>Canvas, Blink>JavaScript", "reporter": "m....@gmail.com", "cve_ids": [], "bounty_amount": 10000.0, "reward_amount_meta": 10000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-03-07T14:56:27+00:00", "year": 2022, "attachment_count": 6, "local_path": "issues/40059000", "has_markdown": true }, { "id": "40058995", "title": "[TurboFan]v8 crashed when compling optimization", "url": "https://issues.chromium.org/issues/40058995", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript>Compiler", "reporter": "vi...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-03-07T03:59:05+00:00", "year": 2022, "attachment_count": 2, "local_path": "issues/40058995", "has_markdown": true }, { "id": "40058989", "title": "Security: heap-use-after-free in ui::EventTarget::RemovePreTargetHandler", "url": "https://issues.chromium.org/issues/40058989", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Forms>Color, Blink>Portals", "reporter": "st...@gmail.com", "cve_ids": [], "bounty_amount": 15000.0, "reward_amount_meta": 15000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-03-05T23:01:20+00:00", "year": 2022, "attachment_count": 3, "local_path": "issues/40058989", "has_markdown": true }, { "id": "40058985", "title": "Security: Locked devices - VPN adding possible", "url": "https://issues.chromium.org/issues/40058985", "status": "Assigned", "severity": "S3-Low", "component": "Internals>Network>VPN", "reporter": "he...@googlemail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-03-05T18:41:59+00:00", "year": 2022, "attachment_count": 1, "local_path": "issues/40058985", "has_markdown": true }, { "id": "40058969", "title": "Security: Extension permission escalation", "url": "https://issues.chromium.org/issues/40058969", "status": "Assigned", "severity": "S3-Low", "component": "Platform>Extensions>API", "reporter": "to...@wavebox.io", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-03-04T12:19:23+00:00", "year": 2022, "attachment_count": 8, "local_path": "issues/40058969", "has_markdown": true }, { "id": "40058968", "title": "Security: Heap-use-after-free in send_tab_to_self::SendTabToSelfBubbleController::OnBubbleClosed", "url": "https://issues.chromium.org/issues/40058968", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>Sharing", "reporter": "me...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-03-04T11:41:36+00:00", "year": 2022, "attachment_count": 3, "local_path": "issues/40058968", "has_markdown": true }, { "id": "40058962", "title": "Heap-use-after-free in ImportDataHandler::~ImportDataHandler", "url": "https://issues.chromium.org/issues/40058962", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>Import", "reporter": "sa...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-03-03T22:56:14+00:00", "year": 2022, "attachment_count": 4, "local_path": "issues/40058962", "has_markdown": true }, { "id": "40058958", "title": "Security: Use After Free in ChromePasswordProtectionService::HandleUserActionOnModalWarning", "url": "https://issues.chromium.org/issues/40058958", "status": "Assigned", "severity": "S3-Low", "component": "Unknown", "reporter": "ka...@gmail.com", "cve_ids": [], "bounty_amount": 16000.0, "reward_amount_meta": 16000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-03-03T14:31:15+00:00", "year": 2022, "attachment_count": 5, "local_path": "issues/40058958", "has_markdown": true }, { "id": "40058935", "title": "Security: Extension can obscure active window with an inactive window, user can interact with sensitive UI using keyboard without being aware", "url": "https://issues.chromium.org/issues/40058935", "status": "Assigned", "severity": "S3-Low", "component": "Platform>Extensions>API", "reporter": "al...@alesandroortiz.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-03-02T02:03:33+00:00", "year": 2022, "attachment_count": 5, "local_path": "issues/40058935", "has_markdown": true }, { "id": "40058934", "title": "Security: Heap-use-after-free in ~ExtensionUninstallDialogViews", "url": "https://issues.chromium.org/issues/40058934", "status": "Assigned", "severity": "S3-Low", "component": "Unknown", "reporter": "me...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-03-02T01:58:53+00:00", "year": 2022, "attachment_count": 4, "local_path": "issues/40058934", "has_markdown": true }, { "id": "40058931", "title": "Security: Web Share API allows to write in UNC paths and/or in C:/Users//AppData/Local/Temp/ on Windows ", "url": "https://issues.chromium.org/issues/40058931", "status": "Assigned", "severity": "S3-Low", "component": "Blink>WebShare", "reporter": "ma...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-03-01T11:32:13+00:00", "year": 2022, "attachment_count": 2, "local_path": "issues/40058931", "has_markdown": true }, { "id": "40058929", "title": "Security: Chrome for Android Hide Custom Fullscreen Toast View with Repeated Exit Enter Fullscreen Request", "url": "https://issues.chromium.org/issues/40058929", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>FullScreen", "reporter": "su...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-03-01T04:48:25+00:00", "year": 2022, "attachment_count": 4, "local_path": "issues/40058929", "has_markdown": true }, { "id": "40058928", "title": "uaf in browser_switcher::`anonymous namespace'::OpenBrowserSwitchPage", "url": "https://issues.chromium.org/issues/40058928", "status": "Assigned", "severity": "S3-Low", "component": "Enterprise>BrowserSwitcher", "reporter": "wx...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-03-01T01:34:44+00:00", "year": 2022, "attachment_count": 6, "local_path": "issues/40058928", "has_markdown": true }, { "id": "40058920", "title": "Security: bypass resource requests whose URLs contained both removed whitespace (`\\n`, `\\r`, `\\t`) characters and less-than characters (`<`) in the fencedframe element", "url": "https://issues.chromium.org/issues/40058920", "status": "Assigned", "severity": "S3-Low", "component": "Blink>FencedFrames", "reporter": "0x...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-02-28T14:00:20+00:00", "year": 2022, "attachment_count": 1, "local_path": "issues/40058920", "has_markdown": true }, { "id": "40058916", "title": "Security: Extension can move window off screen, user can interact with sensitive UI using keyboard without being aware", "url": "https://issues.chromium.org/issues/40058916", "status": "Assigned", "severity": "S3-Low", "component": "Platform>Extensions>API", "reporter": "al...@alesandroortiz.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-02-27T22:18:45+00:00", "year": 2022, "attachment_count": 10, "local_path": "issues/40058916", "has_markdown": true }, { "id": "40058914", "title": "Security: Bypass Apk Warning In Andriod", "url": "https://issues.chromium.org/issues/40058914", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>Downloads", "reporter": "pu...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-02-27T19:59:34+00:00", "year": 2022, "attachment_count": 4, "local_path": "issues/40058914", "has_markdown": true }, { "id": "40058896", "title": "Security: Url Hijacking using intent:// when onload web page using bookmark (Google Chrome Android)", "url": "https://issues.chromium.org/issues/40058896", "status": "Accepted", "severity": "S3-Low", "component": "Internals>Sandbox>SiteIsolation, Mobile>Intents, UI>Browser>Bookmarks", "reporter": "sa...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-02-24T14:40:27+00:00", "year": 2022, "attachment_count": 1, "local_path": "issues/40058896", "has_markdown": true }, { "id": "40058878", "title": "Security: Chrome for Android Cancel Enter Fullscreen able to Hide Omnibox", "url": "https://issues.chromium.org/issues/40058878", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Fullscreen, UI>Browser>FullScreen, UI>Browser>Omnibox", "reporter": "su...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-02-23T19:22:56+00:00", "year": 2022, "attachment_count": 3, "local_path": "issues/40058878", "has_markdown": true }, { "id": "40058874", "title": "Security: Private Network Access (PNA) Bypass Allows Access to localhost on macOS & Linux using 0.0.0.0", "url": "https://issues.chromium.org/issues/40058874", "status": "Accepted", "severity": "S3-Low", "component": "Blink>SecurityFeature>CORS>PrivateNetworkAccess", "reporter": "sa...@gmail.com", "cve_ids": [ "CVE-2023-48022" ], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-02-23T01:02:07+00:00", "year": 2022, "attachment_count": 2, "local_path": "issues/40058874", "has_markdown": true }, { "id": "40058873", "title": "Security: Extension popup can render over permission prompts and screen share dialog", "url": "https://issues.chromium.org/issues/40058873", "status": "Accepted", "severity": "S3-Low", "component": "Platform>Extensions", "reporter": "al...@alesandroortiz.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-02-23T00:20:24+00:00", "year": 2022, "attachment_count": 26, "local_path": "issues/40058873", "has_markdown": true }, { "id": "40058856", "title": "Security: heap-use-after-free in FileSystemAccessRegularFileDelegate::DoFlush", "url": "https://issues.chromium.org/issues/40058856", "status": "Assigned", "severity": "S3-Low", "component": "Blink>GarbageCollection, Blink>Storage>FileSystem", "reporter": "m....@gmail.com", "cve_ids": [], "bounty_amount": 7500.0, "reward_amount_meta": 7500.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-02-22T11:51:56+00:00", "year": 2022, "attachment_count": 3, "local_path": "issues/40058856", "has_markdown": true }, { "id": "40041791", "title": "Video escapes content area", "url": "https://issues.chromium.org/issues/40041791", "status": "Assigned", "severity": "S3-Low", "component": "Internals>Compositing, Internals>GPU>Video", "reporter": "xp...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-02-20T20:57:51+00:00", "year": 2022, "attachment_count": 5, "local_path": "issues/40041791", "has_markdown": true }, { "id": "40058839", "title": "use after free in rx::FramebufferVk::startNewRenderPass", "url": "https://issues.chromium.org/issues/40058839", "status": "Assigned", "severity": "S3-Low", "component": "Internals>GPU>ANGLE", "reporter": "em...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-02-20T15:06:38+00:00", "year": 2022, "attachment_count": 1, "local_path": "issues/40058839", "has_markdown": true }, { "id": "40058837", "title": "Security: [ANGLE] Heap overflow read in vk::IndexBuffer::getIndexBuffers", "url": "https://issues.chromium.org/issues/40058837", "status": "Assigned", "severity": "S3-Low", "component": "Internals>GPU>ANGLE, Internals>GPU>SwiftShader", "reporter": "gg...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-02-20T14:03:03+00:00", "year": 2022, "attachment_count": 1, "local_path": "issues/40058837", "has_markdown": true }, { "id": "40058833", "title": "Security: Heap-use-after-free in QuickAnswersUiController::CloseQuickAnswersView", "url": "https://issues.chromium.org/issues/40058833", "status": "Assigned", "severity": "S3-Low", "component": "UI", "reporter": "ch...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-02-19T23:06:14+00:00", "year": 2022, "attachment_count": 4, "local_path": "issues/40058833", "has_markdown": true }, { "id": "40058831", "title": "Use After Free in TextureVk::releaseAndDeleteImageAndViews", "url": "https://issues.chromium.org/issues/40058831", "status": "Assigned", "severity": "S3-Low", "component": "Internals>GPU>ANGLE", "reporter": "sj...@gmail.com", "cve_ids": [], "bounty_amount": 10000.0, "reward_amount_meta": 10000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-02-19T18:19:40+00:00", "year": 2022, "attachment_count": 4, "local_path": "issues/40058831", "has_markdown": true }, { "id": "40058806", "title": "Heap-use-after-free in blink::WorkerOrWorkletGlobalScope::CountUse", "url": "https://issues.chromium.org/issues/40058806", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Workers", "reporter": "m....@gmail.com", "cve_ids": [], "bounty_amount": 6000.0, "reward_amount_meta": 6000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-02-17T12:29:03+00:00", "year": 2022, "attachment_count": 0, "local_path": "issues/40058806", "has_markdown": true }, { "id": "40058798", "title": "Security: TrustedTypes does not block assignment when modifying existing attribute value via nodeValue/textContent", "url": "https://issues.chromium.org/issues/40058798", "status": "Assigned", "severity": "S3-Low", "component": "Blink>SecurityFeature>TrustedTypes", "reporter": "ma...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-02-16T18:40:11+00:00", "year": 2022, "attachment_count": 2, "local_path": "issues/40058798", "has_markdown": true }, { "id": "40058794", "title": "Security: heap-use-after-free in base::SupportsUserData::GetUserData", "url": "https://issues.chromium.org/issues/40058794", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>Omnibox, UI>Browser>Sharing", "reporter": "yu...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-02-16T12:36:23+00:00", "year": 2022, "attachment_count": 4, "local_path": "issues/40058794", "has_markdown": true }, { "id": "40058786", "title": "Security: heap-use-after-free ash/drag_drop/drag_drop_tracker.cc:109", "url": "https://issues.chromium.org/issues/40058786", "status": "Accepted", "severity": "S3-Low", "component": "UI>Shell>UIFoundations", "reporter": "rh...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-02-15T18:12:02+00:00", "year": 2022, "attachment_count": 5, "local_path": "issues/40058786", "has_markdown": true }, { "id": "40058778", "title": "[WebUI] StartupPagesHandler does not adequately verify arguments from JS", "url": "https://issues.chromium.org/issues/40058778", "status": "Assigned", "severity": "S3-Low", "component": "UI>Settings", "reporter": "ha...@gmail.com", "cve_ids": [], "bounty_amount": 7500.0, "reward_amount_meta": 7500.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-02-15T05:15:55+00:00", "year": 2022, "attachment_count": 1, "local_path": "issues/40058778", "has_markdown": true }, { "id": "40058773", "title": "Security: Chrome Enterprise MSI installer Elevation of Privileges Vulnerability", "url": "https://issues.chromium.org/issues/40058773", "status": "Assigned", "severity": "S3-Low", "component": "Internals>Installer", "reporter": "ve...@gmail.com", "cve_ids": [], "bounty_amount": 20000.0, "reward_amount_meta": 20000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-02-14T20:42:50+00:00", "year": 2022, "attachment_count": 1, "local_path": "issues/40058773", "has_markdown": true }, { "id": "40058771", "title": "Security: memory bug on webui tab dragging", "url": "https://issues.chromium.org/issues/40058771", "status": "Assigned", "severity": "S3-Low", "component": "UI>Shell>UIFoundations", "reporter": "rh...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-02-14T18:05:25+00:00", "year": 2022, "attachment_count": 4, "local_path": "issues/40058771", "has_markdown": true }, { "id": "40058770", "title": "Security: leak user html content using Dangling Markup injection when http upgrade to https", "url": "https://issues.chromium.org/issues/40058770", "status": "Accepted", "severity": "S3-Low", "component": "Blink>HTML>Parser", "reporter": "oh...@gmail.com", "cve_ids": [], "bounty_amount": 500.0, "reward_amount_meta": 500.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-02-14T15:32:49+00:00", "year": 2022, "attachment_count": 1, "local_path": "issues/40058770", "has_markdown": true }, { "id": "40058766", "title": "Spoof omnibar", "url": "https://issues.chromium.org/issues/40058766", "status": "Accepted", "severity": "S3-Low", "component": "UI>Browser>Omnibox", "reporter": "li...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-02-13T17:43:52+00:00", "year": 2022, "attachment_count": 2, "local_path": "issues/40058766", "has_markdown": true }, { "id": "40058759", "title": "Security: heap-buffer-overflow in getImageActualFormat", "url": "https://issues.chromium.org/issues/40058759", "status": "Assigned", "severity": "S4-Minimal", "component": "Internals>GPU", "reporter": "[Deleted User]", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-02-12T21:31:30+00:00", "year": 2022, "attachment_count": 2, "local_path": "issues/40058759", "has_markdown": true }, { "id": "40058750", "title": "Security: [ANGLE] Heap use-after-free in BufferHelper::recordReadBarrier", "url": "https://issues.chromium.org/issues/40058750", "status": "Assigned", "severity": "S3-Low", "component": "Internals>GPU>Vulkan", "reporter": "gg...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-02-11T05:39:03+00:00", "year": 2022, "attachment_count": 1, "local_path": "issues/40058750", "has_markdown": true }, { "id": "40058732", "title": "uaf in blink::MediaInspectorContextImpl::CullPlayers(blink::WebString const&)", "url": "https://issues.chromium.org/issues/40058732", "status": "Assigned", "severity": "S3-Low", "component": "Internals>Media", "reporter": "em...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-02-09T18:32:10+00:00", "year": 2022, "attachment_count": 5, "local_path": "issues/40058732", "has_markdown": true }, { "id": "40058730", "title": "Residual UAF in token fetcher code", "url": "https://issues.chromium.org/issues/40058730", "status": "Assigned", "severity": "S3-Low", "component": "Internals>WebLayer", "reporter": "ha...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-02-09T14:11:57+00:00", "year": 2022, "attachment_count": 0, "local_path": "issues/40058730", "has_markdown": true }, { "id": "40058718", "title": "Security: [ANGLE] Heap use-after-free in CommandBufferHelperCommon::bufferWrite", "url": "https://issues.chromium.org/issues/40058718", "status": "Assigned", "severity": "S4-Minimal", "component": "Internals>GPU>ANGLE", "reporter": "gg...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-02-08T19:53:58+00:00", "year": 2022, "attachment_count": 1, "local_path": "issues/40058718", "has_markdown": true }, { "id": "40058679", "title": "Security: Heap-use-after-free in NearbyShareAction::HandleKeyboardEvent", "url": "https://issues.chromium.org/issues/40058679", "status": "Assigned", "severity": "S3-Low", "component": "Blink>WebShare", "reporter": "ch...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-02-04T03:31:47+00:00", "year": 2022, "attachment_count": 3, "local_path": "issues/40058679", "has_markdown": true }, { "id": "40058651", "title": "Security DCHECK failure: IsA(from) in casting.h", "url": "https://issues.chromium.org/issues/40058651", "status": "Assigned", "severity": "S3-Low", "component": "Blink>CSS", "reporter": "m....@gmail.com", "cve_ids": [], "bounty_amount": 6000.0, "reward_amount_meta": 6000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-02-01T08:27:11+00:00", "year": 2022, "attachment_count": 0, "local_path": "issues/40058651", "has_markdown": true }, { "id": "40058650", "title": "Security: UAF after adding undocked DevTools tab to a group", "url": "https://issues.chromium.org/issues/40058650", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>TopChrome>TabStrip>TabGroups", "reporter": "de...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-02-01T06:39:33+00:00", "year": 2022, "attachment_count": 4, "local_path": "issues/40058650", "has_markdown": true }, { "id": "40058643", "title": "Security: heap-use-after-free on third_party/abseil-cpp/absl/types/internal/optional.h:208:13 in optional_data (chromeOS)", "url": "https://issues.chromium.org/issues/40058643", "status": "Assigned", "severity": "S3-Low", "component": "Platform>Extensions>API, UI>Browser>TopChrome>TabStrip", "reporter": "rh...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-01-31T08:34:02+00:00", "year": 2022, "attachment_count": 5, "local_path": "issues/40058643", "has_markdown": true }, { "id": "40058635", "title": "Security: heap-use-after-free on ash/wm/desks/desks_controller.cc (chromeOS)", "url": "https://issues.chromium.org/issues/40058635", "status": "Assigned", "severity": "S3-Low", "component": "UI>Shell", "reporter": "rh...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-01-29T07:57:31+00:00", "year": 2022, "attachment_count": 1, "local_path": "issues/40058635", "has_markdown": true }, { "id": "40058633", "title": "Security: Heap-use-after-free in BrowserList::AddBrowser", "url": "https://issues.chromium.org/issues/40058633", "status": "Fixed", "severity": "S3-Low", "component": "Blink>Portals, Blink>WindowDialog", "reporter": "ch...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-01-29T05:15:35+00:00", "year": 2022, "attachment_count": 5, "local_path": "issues/40058633", "has_markdown": true }, { "id": "40058623", "title": "Uaf in qrcode_generator::QRCodeGeneratorBubbleController::OnBubbleClosed", "url": "https://issues.chromium.org/issues/40058623", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>Sharing", "reporter": "tt...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-01-28T08:28:57+00:00", "year": 2022, "attachment_count": 2, "local_path": "issues/40058623", "has_markdown": true }, { "id": "40058617", "title": "Security: heap-use-after-free in base::ObserverList::RemoveObserver", "url": "https://issues.chromium.org/issues/40058617", "status": "Assigned", "severity": "S3-Low", "component": "Internals>Cast", "reporter": "st...@gmail.com", "cve_ids": [], "bounty_amount": 10000.0, "reward_amount_meta": 10000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-01-27T22:51:35+00:00", "year": 2022, "attachment_count": 8, "local_path": "issues/40058617", "has_markdown": true }, { "id": "40818663", "title": "DCHECK failure in V8_EXTERNAL_CODE_SPACE_BOOL implies !IsCodeSpaceObject(object) in mark-compact.c", "url": "https://issues.chromium.org/issues/40818663", "status": "Assigned", "severity": "S4-Minimal", "component": "Blink>JavaScript", "reporter": "cl...@chromium.org", "cve_ids": [], "bounty_amount": 6000.0, "reward_amount_meta": 6000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-01-26T20:18:46+00:00", "year": 2022, "attachment_count": 0, "local_path": "issues/40818663", "has_markdown": true }, { "id": "40058593", "title": "CSP is bypassed for status code 100, 101, and 102 pages.", "url": "https://issues.chromium.org/issues/40058593", "status": "Accepted", "severity": "Unknown", "component": "Blink>SecurityFeature>ContentSecurityPolicy", "reporter": "tj...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-01-26T02:33:05+00:00", "year": 2022, "attachment_count": 0, "local_path": "issues/40058593", "has_markdown": true }, { "id": "40058585", "title": "Uaf in OmniboxPopup", "url": "https://issues.chromium.org/issues/40058585", "status": "Fixed", "severity": "S3-Low", "component": "UI>Browser>Omnibox", "reporter": "tt...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-01-25T07:54:20+00:00", "year": 2022, "attachment_count": 2, "local_path": "issues/40058585", "has_markdown": true }, { "id": "40058583", "title": "uaf in BrowserSwitchHandler::OnLaunchFinished", "url": "https://issues.chromium.org/issues/40058583", "status": "Assigned", "severity": "S3-Low", "component": "Enterprise>BrowserSwitcher", "reporter": "wx...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-01-25T06:40:35+00:00", "year": 2022, "attachment_count": 4, "local_path": "issues/40058583", "has_markdown": true }, { "id": "40058582", "title": "Security: Autofill prompt can be obscured by Picture-in-Picture overlay, allows stealthy autofill data theft", "url": "https://issues.chromium.org/issues/40058582", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>Autofill", "reporter": "al...@alesandroortiz.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-01-25T02:49:41+00:00", "year": 2022, "attachment_count": 3, "local_path": "issues/40058582", "has_markdown": true }, { "id": "40058575", "title": "Security: CDP Runtime.queryObjects leaks internal objects in JS heap, allowing CDP clients to compromise V8 process", "url": "https://issues.chromium.org/issues/40058575", "status": "Assigned", "severity": "S3-Low", "component": "Unknown", "reporter": "ku...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-01-24T07:26:43+00:00", "year": 2022, "attachment_count": 1, "local_path": "issues/40058575", "has_markdown": true }, { "id": "40058572", "title": "Security: redirect detection via Performance API", "url": "https://issues.chromium.org/issues/40058572", "status": "Accepted", "severity": "S3-Low", "component": "Blink>PerformanceAPIs>NavigationTiming, Blink>PerformanceAPIs>ServerTiming, Internals>Network", "reporter": "da...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-01-23T15:59:22+00:00", "year": 2022, "attachment_count": 4, "local_path": "issues/40058572", "has_markdown": true }, { "id": "40058555", "title": "Security: CSS keylogger extension using PageStateMatcher and chrome.action.openPopup()", "url": "https://issues.chromium.org/issues/40058555", "status": "Assigned", "severity": "S3-Low", "component": "Platform>Extensions", "reporter": "st...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-01-21T22:36:30+00:00", "year": 2022, "attachment_count": 5, "local_path": "issues/40058555", "has_markdown": true }, { "id": "40058550", "title": "Security: heap-use-after-free in ExtensionFunction::Shutdown", "url": "https://issues.chromium.org/issues/40058550", "status": "Assigned", "severity": "S3-Low", "component": "Platform>Extensions", "reporter": "st...@gmail.com", "cve_ids": [], "bounty_amount": 15000.0, "reward_amount_meta": 15000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-01-21T17:17:38+00:00", "year": 2022, "attachment_count": 5, "local_path": "issues/40058550", "has_markdown": true }, { "id": "40058541", "title": "Security: heap-use-after-free in TemplateURLFetcher::RequestDelegate::OnTemplateURLParsed ", "url": "https://issues.chromium.org/issues/40058541", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>Search", "reporter": "ha...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-01-21T06:06:47+00:00", "year": 2022, "attachment_count": 0, "local_path": "issues/40058541", "has_markdown": true }, { "id": "40058536", "title": "Security: [ANGLE] Heap-buffer-overflow in ImageHelper::SubresourceUpdate::isUpdateToLayers", "url": "https://issues.chromium.org/issues/40058536", "status": "Assigned", "severity": "S3-Low", "component": "Internals>GPU>ANGLE", "reporter": "gg...@gmail.com", "cve_ids": [], "bounty_amount": 10000.0, "reward_amount_meta": 10000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-01-20T21:43:36+00:00", "year": 2022, "attachment_count": 2, "local_path": "issues/40058536", "has_markdown": true }, { "id": "40058534", "title": "Security: UAF in BookmarkDragHelper", "url": "https://issues.chromium.org/issues/40058534", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>Bookmarks", "reporter": "jt...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-01-20T11:56:05+00:00", "year": 2022, "attachment_count": 9, "local_path": "issues/40058534", "has_markdown": true }, { "id": "40058517", "title": "AddressSanitizer: heap-use-after-free asan-linux-release-960248 content::StoragePartitionImpl::GetLockManager() content/browser/storage_partition_impl.cc:1493", "url": "https://issues.chromium.org/issues/40058517", "status": "New", "severity": "S3-Low", "component": "Internals>Core", "reporter": "m....@gmail.com", "cve_ids": [], "bounty_amount": 15000.0, "reward_amount_meta": 15000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-01-18T14:00:36+00:00", "year": 2022, "attachment_count": 5, "local_path": "issues/40058517", "has_markdown": true }, { "id": "40058513", "title": "heap buffer overflow in sw::Blitter::fastResolve", "url": "https://issues.chromium.org/issues/40058513", "status": "Assigned", "severity": "S3-Low", "component": "Internals>GPU>ANGLE, Internals>GPU>SwiftShader", "reporter": "em...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-01-17T14:45:57+00:00", "year": 2022, "attachment_count": 1, "local_path": "issues/40058513", "has_markdown": true }, { "id": "40058509", "title": "Security: [ANGLE] Heap-buffer-overflow in TextureVk::prepareForGenerateMipmap", "url": "https://issues.chromium.org/issues/40058509", "status": "Assigned", "severity": "S3-Low", "component": "Internals>GPU>ANGLE", "reporter": "gg...@gmail.com", "cve_ids": [], "bounty_amount": 12000.0, "reward_amount_meta": 12000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-01-17T10:24:11+00:00", "year": 2022, "attachment_count": 2, "local_path": "issues/40058509", "has_markdown": true }, { "id": "40058496", "title": "Page can use EyeDropper API to bypass mouse movement/keyboard input requirements for autofill (bypass of issue 1240472 fix)", "url": "https://issues.chromium.org/issues/40058496", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Forms>Color, UI>Browser>Autofill", "reporter": "al...@alesandroortiz.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-01-14T05:25:38+00:00", "year": 2022, "attachment_count": 3, "local_path": "issues/40058496", "has_markdown": true }, { "id": "40058486", "title": "Security: heap-use-after-free in ProfileImpl::IsSameOrParent", "url": "https://issues.chromium.org/issues/40058486", "status": "Assigned", "severity": "S3-Low", "component": "Platform>Extensions>API, Webstore", "reporter": "st...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-01-13T00:40:44+00:00", "year": 2022, "attachment_count": 9, "local_path": "issues/40058486", "has_markdown": true }, { "id": "40058468", "title": "Security: Potential UaF in TabStripModel (chromeOS)", "url": "https://issues.chromium.org/issues/40058468", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>TopChrome>TabStrip>ThumbnailTabStrip", "reporter": "rh...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-01-11T06:37:15+00:00", "year": 2022, "attachment_count": 22, "local_path": "issues/40058468", "has_markdown": true }, { "id": "40058461", "title": "Security: [ANGLE] Vulkan : Out-of-bounds memory can be accessed using bound offsets", "url": "https://issues.chromium.org/issues/40058461", "status": "Assigned", "severity": "S3-Low", "component": "Internals>GPU>ANGLE", "reporter": "ne...@nesk.kr", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-01-10T16:41:17+00:00", "year": 2022, "attachment_count": 2, "local_path": "issues/40058461", "has_markdown": true }, { "id": "40058448", "title": "Security: double-free in content::RenderFrameHostImpl::ResetNavigationRequests", "url": "https://issues.chromium.org/issues/40058448", "status": "Assigned", "severity": "S3-Low", "component": "Internals>Core, Internals>Sandbox>SiteIsolation, UI>Browser>Navigation, UI>Browser>TopChrome>TabStrip", "reporter": "yu...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-01-10T07:03:34+00:00", "year": 2022, "attachment_count": 2, "local_path": "issues/40058448", "has_markdown": true }, { "id": "40058435", "title": "Security: heap-use-after-use in DiscountURLLoader::NavigateToDiscountURL", "url": "https://issues.chromium.org/issues/40058435", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>Shopping>Cart", "reporter": "yu...@gmail.com", "cve_ids": [], "bounty_amount": 16000.0, "reward_amount_meta": 16000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-01-08T16:11:44+00:00", "year": 2022, "attachment_count": 0, "local_path": "issues/40058435", "has_markdown": true }, { "id": "40058426", "title": "AddressSanitizer: heap-use-after-free in blink::BlobBytesProvider::AppendData", "url": "https://issues.chromium.org/issues/40058426", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Storage", "reporter": "m....@gmail.com", "cve_ids": [], "bounty_amount": 6000.0, "reward_amount_meta": 6000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-01-07T10:06:52+00:00", "year": 2022, "attachment_count": 3, "local_path": "issues/40058426", "has_markdown": true }, { "id": "40058418", "title": "Security: heap-use-after-free in web_app::ShortcutInfoForExtensionAndProfile ", "url": "https://issues.chromium.org/issues/40058418", "status": "Assigned", "severity": "S4-Minimal", "component": "Platform>Extensions", "reporter": "st...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-01-06T23:46:06+00:00", "year": 2022, "attachment_count": 5, "local_path": "issues/40058418", "has_markdown": true }, { "id": "40058411", "title": "Security: UAF in DistilledPagePrefs::SetFontScaling", "url": "https://issues.chromium.org/issues/40058411", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>ReaderMode", "reporter": "jt...@gmail.com", "cve_ids": [], "bounty_amount": 20000.0, "reward_amount_meta": 20000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-01-06T11:00:48+00:00", "year": 2022, "attachment_count": 3, "local_path": "issues/40058411", "has_markdown": true }, { "id": "40058405", "title": "Security: UAF in safe_browsing::DownloadRequestMaker::Start", "url": "https://issues.chromium.org/issues/40058405", "status": "Assigned", "severity": "S3-Low", "component": "Unknown", "reporter": "dy...@gmail.com", "cve_ids": [], "bounty_amount": 20000.0, "reward_amount_meta": 20000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-01-05T12:08:17+00:00", "year": 2022, "attachment_count": 7, "local_path": "issues/40058405", "has_markdown": true }, { "id": "40058399", "title": "AddressSanitizer: heap-use-after-free in TryProcess ui/base/accelerators/accelerator_manager.cc:152:17", "url": "https://issues.chromium.org/issues/40058399", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>Accessibility", "reporter": "m....@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-01-04T16:28:11+00:00", "year": 2022, "attachment_count": 4, "local_path": "issues/40058399", "has_markdown": true }, { "id": "40058392", "title": "Container-overflow in TableView::UpdateVirtualAccessibilityChildrenBounds", "url": "https://issues.chromium.org/issues/40058392", "status": "Assigned", "severity": "S3-Low", "component": "UI>TaskManager", "reporter": "sa...@gmail.com", "cve_ids": [], "bounty_amount": null, "reward_amount_meta": 0.0, "public_issue": true, "inclusion_reason": "award_text", "award_text_found": true, "created_date": "2022-01-02T23:19:53+00:00", "year": 2022, "attachment_count": 3, "local_path": "issues/40058392", "has_markdown": true }, { "id": "40813839", "title": "Browser crash when pasting multiple lines with Text Cursor Indicator enabled (Windows)", "url": "https://issues.chromium.org/issues/40813839", "status": "Assigned", "severity": "Unknown", "component": "UI>Accessibility>Compatibility", "reporter": "fr...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-01-01T12:24:30+00:00", "year": 2022, "attachment_count": 22, "local_path": "issues/40813839", "has_markdown": true }, { "id": "40058387", "title": "Security: UAF in heap-use-after-free inin DevToolsWindow::Show(browser process)", "url": "https://issues.chromium.org/issues/40058387", "status": "Accepted", "severity": "S3-Low", "component": "Blink>Editing>Command, Platform>DevTools", "reporter": "0x...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2022-01-01T04:14:02+00:00", "year": 2022, "attachment_count": 1, "local_path": "issues/40058387", "has_markdown": true }, { "id": "40058379", "title": "Security: UAF in ProtocolHandlerThrottle using PlzDedicatedWorker", "url": "https://issues.chromium.org/issues/40058379", "status": "New", "severity": "S3-Low", "component": "Blink>Loader, Blink>Workers", "reporter": "jt...@gmail.com", "cve_ids": [], "bounty_amount": 20000.0, "reward_amount_meta": 20000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-12-31T03:26:49+00:00", "year": 2021, "attachment_count": 3, "local_path": "issues/40058379", "has_markdown": true }, { "id": "40058375", "title": "A GPU crash (or anything that causes loss of GPU support for Chrome) will create framebuffer ghosting with ImageBitmap", "url": "https://issues.chromium.org/issues/40058375", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Canvas, Blink>WebGPU", "reporter": "jo...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-12-30T16:27:26+00:00", "year": 2021, "attachment_count": 6, "local_path": "issues/40058375", "has_markdown": true }, { "id": "40058372", "title": "Heap-use-after-free in ChromePermissionsClient::OverrideCanonicalOrigin", "url": "https://issues.chromium.org/issues/40058372", "status": "Assigned", "severity": "S3-Low", "component": "Blink>MediaStream", "reporter": "sa...@gmail.com", "cve_ids": [], "bounty_amount": 15000.0, "reward_amount_meta": 15000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-12-30T12:04:03+00:00", "year": 2021, "attachment_count": 6, "local_path": "issues/40058372", "has_markdown": true }, { "id": "40058368", "title": "Security: UAF in ChromeContentBrowserClient::CreateURLLoaderThrottles", "url": "https://issues.chromium.org/issues/40058368", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Loader>WebPackaging, Internals>Network", "reporter": "jt...@gmail.com", "cve_ids": [], "bounty_amount": 15000.0, "reward_amount_meta": 15000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-12-30T09:28:13+00:00", "year": 2021, "attachment_count": 2, "local_path": "issues/40058368", "has_markdown": true }, { "id": "40058360", "title": "AddressSanitizer: use-after-poison cc\\layers\\texture_layer.cc:169 in cc::TextureLayer::Update", "url": "https://issues.chromium.org/issues/40058360", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Compositing", "reporter": "m....@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-12-29T03:04:55+00:00", "year": 2021, "attachment_count": 5, "local_path": "issues/40058360", "has_markdown": true }, { "id": "40058345", "title": "Type Confuse Security DCHECK failed: !node || IsTextControl(*node) text_control_element.h(268) ", "url": "https://issues.chromium.org/issues/40058345", "status": "Assigned", "severity": "S4-Minimal", "component": "Blink>Forms>Text, Blink>Layout", "reporter": "m....@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-12-26T16:16:55+00:00", "year": 2021, "attachment_count": 2, "local_path": "issues/40058345", "has_markdown": true }, { "id": "40058333", "title": "Security: AddressSanitizer: heap-use-after-free on drag_drop_controller.cc (chromeOS and Lacros)", "url": "https://issues.chromium.org/issues/40058333", "status": "Assigned", "severity": "S3-Low", "component": "Blink>DataTransfer", "reporter": "rh...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-12-23T17:14:14+00:00", "year": 2021, "attachment_count": 11, "local_path": "issues/40058333", "has_markdown": true }, { "id": "40058330", "title": "Security: UAF in FocusController::SetFocusedWindow", "url": "https://issues.chromium.org/issues/40058330", "status": "Assigned", "severity": "S4-Minimal", "component": "UI>Accessibility", "reporter": "le...@gmail.com", "cve_ids": [], "bounty_amount": 20000.0, "reward_amount_meta": 20000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-12-23T08:31:35+00:00", "year": 2021, "attachment_count": 3, "local_path": "issues/40058330", "has_markdown": true }, { "id": "40058326", "title": "Security: use-after-poison in blink::InspectorAccessibilityAgent::RefreshFrontendNodes ", "url": "https://issues.chromium.org/issues/40058326", "status": "Assigned", "severity": "S4-Minimal", "component": "Platform>DevTools>Accessibility", "reporter": "ha...@gmail.com", "cve_ids": [], "bounty_amount": 500.0, "reward_amount_meta": 500.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-12-23T01:48:14+00:00", "year": 2021, "attachment_count": 2, "local_path": "issues/40058326", "has_markdown": true }, { "id": "40058319", "title": "Security: UAF in BookmarkDragHelper::OnBookmarkIconLoaded", "url": "https://issues.chromium.org/issues/40058319", "status": "Assigned", "severity": "S3-Low", "component": "Internals>Views, UI>Browser>Bookmarks", "reporter": "jt...@gmail.com", "cve_ids": [], "bounty_amount": 10000.0, "reward_amount_meta": 10000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-12-22T09:21:08+00:00", "year": 2021, "attachment_count": 2, "local_path": "issues/40058319", "has_markdown": true }, { "id": "40058315", "title": "File Download Origin Spoof Using Long Subdomain", "url": "https://issues.chromium.org/issues/40058315", "status": "Accepted", "severity": "S3-Low", "component": "UI>Browser>Downloads", "reporter": "sh...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-12-21T19:48:28+00:00", "year": 2021, "attachment_count": 5, "local_path": "issues/40058315", "has_markdown": true }, { "id": "40058314", "title": "Heap-use-after-free in extensions::ChromeExtensionsBrowserClient::GetOriginalContext", "url": "https://issues.chromium.org/issues/40058314", "status": "Assigned", "severity": "S3-Low", "component": "Platform>Extensions, UI>Browser>Profiles", "reporter": "sa...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-12-21T17:43:10+00:00", "year": 2021, "attachment_count": 2, "local_path": "issues/40058314", "has_markdown": true }, { "id": "40058312", "title": "Heap-use-after-free in optimization_guide::OptimizationGuideStore::ClearFetchedHintsFromDatabase", "url": "https://issues.chromium.org/issues/40058312", "status": "Assigned", "severity": "S3-Low", "component": "Internals>OptimizationGuide", "reporter": "sa...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-12-21T13:48:28+00:00", "year": 2021, "attachment_count": 2, "local_path": "issues/40058312", "has_markdown": true }, { "id": "40058306", "title": "Security: UAF in AXVirtualViewWrapper", "url": "https://issues.chromium.org/issues/40058306", "status": "Fixed", "severity": "S3-Low", "component": "UI>Accessibility", "reporter": "le...@gmail.com", "cve_ids": [], "bounty_amount": 15000.0, "reward_amount_meta": 15000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-12-21T08:55:33+00:00", "year": 2021, "attachment_count": 4, "local_path": "issues/40058306", "has_markdown": true }, { "id": "40058303", "title": "Security: UAF in GoogleSearchDomainMixingMetricsEmitter", "url": "https://issues.chromium.org/issues/40058303", "status": "Fixed", "severity": "S3-Low", "component": "Internals", "reporter": "le...@gmail.com", "cve_ids": [], "bounty_amount": 10000.0, "reward_amount_meta": 10000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-12-21T03:42:46+00:00", "year": 2021, "attachment_count": 4, "local_path": "issues/40058303", "has_markdown": true }, { "id": "40058284", "title": "Security: heap-use-after-free in TabStripLayoutHelper::SlotIsCollapsedTab", "url": "https://issues.chromium.org/issues/40058284", "status": "Assigned", "severity": "Unknown", "component": "UI>Browser>TopChrome>TabStrip>TabGroups", "reporter": "st...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-12-18T14:30:23+00:00", "year": 2021, "attachment_count": 4, "local_path": "issues/40058284", "has_markdown": true }, { "id": "40058283", "title": "Security: heap-buffer-overflow in TabStripModel::MoveWebContentsAtImpl", "url": "https://issues.chromium.org/issues/40058283", "status": "Assigned", "severity": "S4-Minimal", "component": "UI>Browser>TopChrome>TabStrip>TabGroups", "reporter": "st...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-12-18T14:28:26+00:00", "year": 2021, "attachment_count": 4, "local_path": "issues/40058283", "has_markdown": true }, { "id": "40058259", "title": "Security: Stack-Buffer-Overflow in WebRtcPcm16b_Decode", "url": "https://issues.chromium.org/issues/40058259", "status": "Assigned", "severity": "S3-Low", "component": "Blink>WebRTC, Blink>WebRTC>Audio", "reporter": "vi...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-12-17T06:05:59+00:00", "year": 2021, "attachment_count": 3, "local_path": "issues/40058259", "has_markdown": true }, { "id": "40058243", "title": "Origin spoofing in WebUSB", "url": "https://issues.chromium.org/issues/40058243", "status": "Assigned", "severity": "S3-Low", "component": "Blink>HID, Blink>Serial, Blink>USB", "reporter": "bu...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-12-15T12:24:20+00:00", "year": 2021, "attachment_count": 3, "local_path": "issues/40058243", "has_markdown": true }, { "id": "40058241", "title": "Security: Heap-use-after-free in TabStrip::OnGroupCreated", "url": "https://issues.chromium.org/issues/40058241", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>TopChrome>TabStrip>TabGroups", "reporter": "me...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-12-15T10:53:55+00:00", "year": 2021, "attachment_count": 7, "local_path": "issues/40058241", "has_markdown": true }, { "id": "40058237", "title": "Security DCHECK failed: IsA(from) in ng_block_node.cc:1032 blink::NGBlockNode::FirstChild", "url": "https://issues.chromium.org/issues/40058237", "status": "Accepted", "severity": "S3-Low", "component": "Blink>Layout", "reporter": "m....@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-12-15T05:08:56+00:00", "year": 2021, "attachment_count": 2, "local_path": "issues/40058237", "has_markdown": true }, { "id": "40058225", "title": "Security DCHECK failed: IsA(from) in ng_layout_input_node.cc:96 blink::NGLayoutInputNode::TableCellColspan ", "url": "https://issues.chromium.org/issues/40058225", "status": "Accepted", "severity": "S3-Low", "component": "Blink>Layout", "reporter": "m....@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-12-14T03:04:39+00:00", "year": 2021, "attachment_count": 7, "local_path": "issues/40058225", "has_markdown": true }, { "id": "40058217", "title": "Security: Page can cause autofill prompt to render near cursor in order to bypass intentional mouse movement input requirements for autofill (Bypass of issue 1240472 fix)", "url": "https://issues.chromium.org/issues/40058217", "status": "Assigned", "severity": "S3-Low", "component": "Privacy", "reporter": "al...@alesandroortiz.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-12-13T00:58:46+00:00", "year": 2021, "attachment_count": 4, "local_path": "issues/40058217", "has_markdown": true }, { "id": "40058213", "title": "Security: Elevation of Privileges in chrome installer when removing scoped directory during updates", "url": "https://issues.chromium.org/issues/40058213", "status": "Assigned", "severity": "S3-Low", "component": "Internals>Installer", "reporter": "ve...@gmail.com", "cve_ids": [], "bounty_amount": 10000.0, "reward_amount_meta": 10000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-12-12T12:48:25+00:00", "year": 2021, "attachment_count": 1, "local_path": "issues/40058213", "has_markdown": true }, { "id": "40058210", "title": "crash in v8 heap(--js-flags=--experimental-wasm-gc)", "url": "https://issues.chromium.org/issues/40058210", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript, Blink>JavaScript>GarbageCollection", "reporter": "em...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-12-12T04:53:51+00:00", "year": 2021, "attachment_count": 0, "local_path": "issues/40058210", "has_markdown": true }, { "id": "40058204", "title": "Security: Heap-use-after-free in autofill::EditAddressProfileView::WindowClosing", "url": "https://issues.chromium.org/issues/40058204", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>Autofill", "reporter": "ch...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-12-10T23:41:14+00:00", "year": 2021, "attachment_count": 4, "local_path": "issues/40058204", "has_markdown": true }, { "id": "40058195", "title": "AddressSanitizer: heap-use-after-free in blink::NetworkStateNotifier::NotifyObserversOnTaskRunner", "url": "https://issues.chromium.org/issues/40058195", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Network", "reporter": "dm...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-12-10T11:08:34+00:00", "year": 2021, "attachment_count": 6, "local_path": "issues/40058195", "has_markdown": true }, { "id": "40058181", "title": "Security: stack-buffer-overflow in views::ScrollView::OnMouseWheel(ui::MouseWheelEvent const&) in the browser process", "url": "https://issues.chromium.org/issues/40058181", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>Mobile>TabStrip", "reporter": "0x...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-12-09T16:23:11+00:00", "year": 2021, "attachment_count": 3, "local_path": "issues/40058181", "has_markdown": true }, { "id": "40058177", "title": "Security: heap-use-after-free in TemplateURLRef::ParseHostAndSearchTermKey", "url": "https://issues.chromium.org/issues/40058177", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>Omnibox", "reporter": "ha...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-12-09T14:04:19+00:00", "year": 2021, "attachment_count": 1, "local_path": "issues/40058177", "has_markdown": true }, { "id": "40058171", "title": "Security: BackgroundFetch leaks URL of cross-origin redirects", "url": "https://issues.chromium.org/issues/40058171", "status": "Assigned", "severity": "S3-Low", "component": "Blink>BackgroundFetch", "reporter": "la...@gmail.com", "cve_ids": [], "bounty_amount": 8000.0, "reward_amount_meta": 8000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-12-09T09:13:02+00:00", "year": 2021, "attachment_count": 3, "local_path": "issues/40058171", "has_markdown": true }, { "id": "40058166", "title": "Security: Heap-use-after-free in ui::MenuModel::GetModelAndIndexForCommandId", "url": "https://issues.chromium.org/issues/40058166", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>Omnibox", "reporter": "me...@gmail.com", "cve_ids": [], "bounty_amount": 10000.0, "reward_amount_meta": 10000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-12-09T02:52:05+00:00", "year": 2021, "attachment_count": 2, "local_path": "issues/40058166", "has_markdown": true }, { "id": "40058147", "title": "Security: heap-use-after-free in ui::AXTree::NotifyNodeWillBeReparentedOrDeleted ", "url": "https://issues.chromium.org/issues/40058147", "status": "Assigned", "severity": "Unknown", "component": "Internals>Accessibility", "reporter": "ha...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-12-07T02:19:32+00:00", "year": 2021, "attachment_count": 0, "local_path": "issues/40058147", "has_markdown": true }, { "id": "40058146", "title": "Security: heap-use-after-free ui::AXEventRecorder::OnEvent", "url": "https://issues.chromium.org/issues/40058146", "status": "Assigned", "severity": "S4-Minimal", "component": "Internals>Accessibility", "reporter": "ha...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-12-07T02:16:33+00:00", "year": 2021, "attachment_count": 1, "local_path": "issues/40058146", "has_markdown": true }, { "id": "40058134", "title": "Security: Debug Check failed in HAS_WEAK_HEAP_OBJECT_TAG", "url": "https://issues.chromium.org/issues/40058134", "status": "Assigned", "severity": "S4-Minimal", "component": "Blink>JavaScript>Compiler>Turbofan", "reporter": "vu...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-12-06T10:51:45+00:00", "year": 2021, "attachment_count": 0, "local_path": "issues/40058134", "has_markdown": true }, { "id": "40058133", "title": "AddressSanitizer: use-after-poison ng_physical_fragment.h:316 in blink::NGPhysicalFragment::HasSelfPaintingLayer", "url": "https://issues.chromium.org/issues/40058133", "status": "Assigned", "severity": "S3-Low", "component": "Blink>CSS", "reporter": "m....@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-12-06T08:29:42+00:00", "year": 2021, "attachment_count": 3, "local_path": "issues/40058133", "has_markdown": true }, { "id": "40058131", "title": "UAF in AutofillPopupControllerImpl::HandleKeyPressEvent", "url": "https://issues.chromium.org/issues/40058131", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>Autofill", "reporter": "ro...@gmail.com", "cve_ids": [], "bounty_amount": 20000.0, "reward_amount_meta": 20000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-12-06T01:08:05+00:00", "year": 2021, "attachment_count": 3, "local_path": "issues/40058131", "has_markdown": true }, { "id": "40058102", "title": "Security: fencedframe element bypass the security policy restrictions of the devtools preview limit", "url": "https://issues.chromium.org/issues/40058102", "status": "Assigned", "severity": "S3-Low", "component": "Blink>FencedFrames, UI>Browser>Navigation>MPArch", "reporter": "0x...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-12-02T16:11:27+00:00", "year": 2021, "attachment_count": 5, "local_path": "issues/40058102", "has_markdown": true }, { "id": "40058099", "title": "Security: UAF in ScreenCaptureMachineAndroid::OnActivityResult", "url": "https://issues.chromium.org/issues/40058099", "status": "Assigned", "severity": "S3-Low", "component": "Blink>GetUserMedia, Internals>Media>ScreenCapture", "reporter": "jt...@gmail.com", "cve_ids": [], "bounty_amount": 15000.0, "reward_amount_meta": 15000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-12-02T08:33:05+00:00", "year": 2021, "attachment_count": 2, "local_path": "issues/40058099", "has_markdown": true }, { "id": "40058092", "title": "Security: UAF in ViewsAXTreeManager", "url": "https://issues.chromium.org/issues/40058092", "status": "New", "severity": "S4-Minimal", "component": "UI>Accessibility", "reporter": "le...@gmail.com", "cve_ids": [], "bounty_amount": 20000.0, "reward_amount_meta": 20000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-12-01T15:58:29+00:00", "year": 2021, "attachment_count": 3, "local_path": "issues/40058092", "has_markdown": true }, { "id": "40058085", "title": "Security: heap-use-after-free in network::server::HttpServer::FindConnection", "url": "https://issues.chromium.org/issues/40058085", "status": "Assigned", "severity": "S3-Low", "component": "Platform>DevTools", "reporter": "ha...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-12-01T05:22:41+00:00", "year": 2021, "attachment_count": 1, "local_path": "issues/40058085", "has_markdown": true }, { "id": "40058077", "title": "PDF bookmarks bypass SameSite Strict cookies.", "url": "https://issues.chromium.org/issues/40058077", "status": "Accepted", "severity": "S3-Low", "component": "Internals>Network>Cookies, Internals>Plugins>PDF", "reporter": "nd...@protonmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-11-30T13:41:28+00:00", "year": 2021, "attachment_count": 1, "local_path": "issues/40058077", "has_markdown": true }, { "id": "40058074", "title": "SUMMARY: AddressSanitizer: heap-use-after-free base/bind_internal.h:535:12 in BindState", "url": "https://issues.chromium.org/issues/40058074", "status": "New", "severity": "S3-Low", "component": "Blink>Storage", "reporter": "m....@gmail.com", "cve_ids": [], "bounty_amount": 20000.0, "reward_amount_meta": 20000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-11-30T08:42:10+00:00", "year": 2021, "attachment_count": 5, "local_path": "issues/40058074", "has_markdown": true }, { "id": "40058068", "title": "Security: Bypass of Issue 1239709: Cross-Origin Response Leak If wildcard ACAO is sent", "url": "https://issues.chromium.org/issues/40058068", "status": "Assigned", "severity": "S3-Low", "component": "Blink>BackgroundFetch", "reporter": "la...@gmail.com", "cve_ids": [], "bounty_amount": 4000.0, "reward_amount_meta": 4000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-11-29T12:02:47+00:00", "year": 2021, "attachment_count": 1, "local_path": "issues/40058068", "has_markdown": true }, { "id": "40058064", "title": "Security: [ANGLE] D3D11 : Integer Underflow in ElementsInBuffer results in wild copy", "url": "https://issues.chromium.org/issues/40058064", "status": "Assigned", "severity": "S3-Low", "component": "Internals>GPU>ANGLE", "reporter": "ne...@nesk.kr", "cve_ids": [], "bounty_amount": 7500.0, "reward_amount_meta": 7500.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-11-29T09:13:05+00:00", "year": 2021, "attachment_count": 4, "local_path": "issues/40058064", "has_markdown": true }, { "id": "40058061", "title": "Security: v8 Debug check failed: target_inobject < GetInObjectProperties().", "url": "https://issues.chromium.org/issues/40058061", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript>Compiler>Turbofan", "reporter": "h4...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-11-29T02:18:35+00:00", "year": 2021, "attachment_count": 2, "local_path": "issues/40058061", "has_markdown": true }, { "id": "40058058", "title": "uaf in chrome_pdf::PdfViewPluginBase::LoadAccessibility", "url": "https://issues.chromium.org/issues/40058058", "status": "Assigned", "severity": "S4-Minimal", "component": "Internals>Plugins>PDF>Accessibility", "reporter": "em...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-11-28T17:32:41+00:00", "year": 2021, "attachment_count": 1, "local_path": "issues/40058058", "has_markdown": true }, { "id": "40058054", "title": "Crash in SkArenaAllocWithReset::reset", "url": "https://issues.chromium.org/issues/40058054", "status": "Assigned", "severity": "S4-Minimal", "component": "Internals>Skia", "reporter": "cl...@chromium.org", "cve_ids": [], "bounty_amount": 6000.0, "reward_amount_meta": 6000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-11-28T10:57:10+00:00", "year": 2021, "attachment_count": 0, "local_path": "issues/40058054", "has_markdown": true }, { "id": "40058051", "title": "uaf in rx::vk::CommandBufferHelper::bufferWrite", "url": "https://issues.chromium.org/issues/40058051", "status": "Assigned", "severity": "S4-Minimal", "component": "Internals>GPU>ANGLE, Internals>GPU>Vulkan", "reporter": "em...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-11-28T08:45:31+00:00", "year": 2021, "attachment_count": 1, "local_path": "issues/40058051", "has_markdown": true }, { "id": "40058049", "title": "Application crashes on Safety warning page when returning to page", "url": "https://issues.chromium.org/issues/40058049", "status": "Accepted", "severity": "S3-Low", "component": "UI>Browser>Interstitials, UI>Browser>Navigation>BFCache", "reporter": "re...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-11-28T06:04:20+00:00", "year": 2021, "attachment_count": 8, "local_path": "issues/40058049", "has_markdown": true }, { "id": "40058028", "title": "AddressSanitizer: heap-use-after-free in blink::Screen::AreWebExposedScreenPropertiesEqual", "url": "https://issues.chromium.org/issues/40058028", "status": "Assigned", "severity": "S4-Minimal", "component": "Blink>Screen>MultiScreen, UI>Browser>WebAppInstalls>Desktop", "reporter": "dm...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-11-25T14:06:50+00:00", "year": 2021, "attachment_count": 4, "local_path": "issues/40058028", "has_markdown": true }, { "id": "40058015", "title": "Security: webgl global-buffer-overflow in getIncompleteTexture", "url": "https://issues.chromium.org/issues/40058015", "status": "Assigned", "severity": "S4-Minimal", "component": "Internals>GPU>ANGLE, Internals>GPU>Vulkan", "reporter": "[Deleted User]", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-11-25T01:04:01+00:00", "year": 2021, "attachment_count": 2, "local_path": "issues/40058015", "has_markdown": true }, { "id": "40058007", "title": "Security: Heap-buffer-overflow in tabgroup", "url": "https://issues.chromium.org/issues/40058007", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>TopChrome>TabStrip>TabGroups", "reporter": "me...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-11-24T11:35:45+00:00", "year": 2021, "attachment_count": 5, "local_path": "issues/40058007", "has_markdown": true }, { "id": "40057994", "title": "Security: Inappropriate implementation in PushMessaging", "url": "https://issues.chromium.org/issues/40057994", "status": "Assigned", "severity": "S3-Low", "component": "Blink>PushAPI, Internals>Sandbox>SiteIsolation", "reporter": "jt...@gmail.com", "cve_ids": [], "bounty_amount": 10000.0, "reward_amount_meta": 10000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-11-23T11:12:24+00:00", "year": 2021, "attachment_count": 1, "local_path": "issues/40057994", "has_markdown": true }, { "id": "40057990", "title": "Security: UAF in P2PSocketTcpServer::DoAccept", "url": "https://issues.chromium.org/issues/40057990", "status": "Assigned", "severity": "S3-Low", "component": "Blink>WebRTC>Network", "reporter": "jt...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-11-23T06:54:06+00:00", "year": 2021, "attachment_count": 4, "local_path": "issues/40057990", "has_markdown": true }, { "id": "40057988", "title": "Security: HeapOverflow in PageLoadMetrics", "url": "https://issues.chromium.org/issues/40057988", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>Navigation>BFCache", "reporter": "le...@gmail.com", "cve_ids": [], "bounty_amount": 15000.0, "reward_amount_meta": 15000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-11-22T09:18:53+00:00", "year": 2021, "attachment_count": 6, "local_path": "issues/40057988", "has_markdown": true }, { "id": "40057980", "title": "Security: swiftshader heap-use-after-free in getOffsetPointer", "url": "https://issues.chromium.org/issues/40057980", "status": "Assigned", "severity": "S4-Minimal", "component": "Internals>GPU>SwiftShader", "reporter": "[Deleted User]", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-11-21T02:29:06+00:00", "year": 2021, "attachment_count": 2, "local_path": "issues/40057980", "has_markdown": true }, { "id": "40057979", "title": "Security: CSS transform and backface-visibility: hidden allow to render over Chrome UI", "url": "https://issues.chromium.org/issues/40057979", "status": "Assigned", "severity": "S3-Low", "component": "Internals>Compositing, Internals>Skia>Compositing", "reporter": "su...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-11-20T22:36:42+00:00", "year": 2021, "attachment_count": 2, "local_path": "issues/40057979", "has_markdown": true }, { "id": "40057977", "title": "Security: heap-use-after-free in the media::AudioManagerBase in the browser process", "url": "https://issues.chromium.org/issues/40057977", "status": "Assigned", "severity": "S3-Low", "component": "Blink>GetUserMedia", "reporter": "0x...@gmail.com", "cve_ids": [], "bounty_amount": 15000.0, "reward_amount_meta": 15000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-11-20T11:43:31+00:00", "year": 2021, "attachment_count": 2, "local_path": "issues/40057977", "has_markdown": true }, { "id": "40057972", "title": "Security: Wild read with renderbuffers", "url": "https://issues.chromium.org/issues/40057972", "status": "Assigned", "severity": "S3-Low", "component": "Internals>GPU>ANGLE, Internals>GPU>Internals, Internals>GPU>SwiftShader", "reporter": "ao...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-11-19T21:04:56+00:00", "year": 2021, "attachment_count": 1, "local_path": "issues/40057972", "has_markdown": true }, { "id": "40057937", "title": "Performance API is not consistent for preloaded requests which can be used to leak the size of cross-origin resources", "url": "https://issues.chromium.org/issues/40057937", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Loader>Preload, Blink>PerformanceAPIs, Blink>ServiceWorker", "reporter": "he...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-11-17T02:12:41+00:00", "year": 2021, "attachment_count": 2, "local_path": "issues/40057937", "has_markdown": true }, { "id": "40057932", "title": "Security: use after free in swiftshader", "url": "https://issues.chromium.org/issues/40057932", "status": "Assigned", "severity": "S4-Minimal", "component": "Internals>GPU>SwiftShader", "reporter": "ao...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-11-16T08:40:15+00:00", "year": 2021, "attachment_count": 1, "local_path": "issues/40057932", "has_markdown": true }, { "id": "40057930", "title": "Security: Chrome for Android Delay Navigate then requestFullScreen will Hide Omnibox ", "url": "https://issues.chromium.org/issues/40057930", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>FullScreen, UI>Browser>Omnibox", "reporter": "su...@gmail.com", "cve_ids": [], "bounty_amount": 7500.0, "reward_amount_meta": 7500.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-11-16T03:02:57+00:00", "year": 2021, "attachment_count": 2, "local_path": "issues/40057930", "has_markdown": true }, { "id": "40057929", "title": "heap-use-after-free in TabGroupModel::GetTabGroup", "url": "https://issues.chromium.org/issues/40057929", "status": "Accepted", "severity": "S3-Low", "component": "UI>Browser>TopChrome>TabStrip>TabGroups", "reporter": "st...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-11-15T23:49:47+00:00", "year": 2021, "attachment_count": 4, "local_path": "issues/40057929", "has_markdown": true }, { "id": "40057926", "title": "Security: Scrolls are detectable cross-site upon using the Scroll to text fragment feature. ", "url": "https://issues.chromium.org/issues/40057926", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Scroll", "reporter": "te...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-11-15T20:45:43+00:00", "year": 2021, "attachment_count": 0, "local_path": "issues/40057926", "has_markdown": true }, { "id": "40057925", "title": "Security: FencedFrames reachable from compromised renderer due to lacking features::isEnabled(kFencedFrames) checks in Browser Process and FencedFrame::Navigate can navigate to file:// and chrome:// origins", "url": "https://issues.chromium.org/issues/40057925", "status": "Assigned", "severity": "S3-Low", "component": "Blink>FencedFrames, Internals>Sandbox>SiteIsolation, UI>Browser>Navigation", "reporter": "bt...@gmail.com", "cve_ids": [], "bounty_amount": 17000.0, "reward_amount_meta": 17000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-11-15T17:29:52+00:00", "year": 2021, "attachment_count": 7, "local_path": "issues/40057925", "has_markdown": true }, { "id": "40057910", "title": "[iOS] CSP Bypass via Service Worker", "url": "https://issues.chromium.org/issues/40057910", "status": "Assigned", "severity": "S3-Low", "component": "Mobile>iOSWeb>Security", "reporter": "pr...@gmail.com", "cve_ids": [], "bounty_amount": 500.0, "reward_amount_meta": 500.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-11-14T14:35:27+00:00", "year": 2021, "attachment_count": 1, "local_path": "issues/40057910", "has_markdown": true }, { "id": "40057908", "title": "Security: Use after Free in content::AccessibilityEventRecorderWin::AccessibleObjectFromWindowWrapper ", "url": "https://issues.chromium.org/issues/40057908", "status": "Assigned", "severity": "S4-Minimal", "component": "Internals>Accessibility", "reporter": "ha...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-11-14T07:08:57+00:00", "year": 2021, "attachment_count": 1, "local_path": "issues/40057908", "has_markdown": true }, { "id": "40057906", "title": "Security: Chrome for Android Hide Entering Fullscreen Notification Toast with HTML Select Dropdown", "url": "https://issues.chromium.org/issues/40057906", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>FullScreen", "reporter": "su...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-11-13T20:18:45+00:00", "year": 2021, "attachment_count": 2, "local_path": "issues/40057906", "has_markdown": true }, { "id": "40057890", "title": "uaf in content::BroadcastChannelService::ConnectToChannel", "url": "https://issues.chromium.org/issues/40057890", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Messaging", "reporter": "em...@gmail.com", "cve_ids": [], "bounty_amount": 20000.0, "reward_amount_meta": 20000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-11-11T17:07:46+00:00", "year": 2021, "attachment_count": 1, "local_path": "issues/40057890", "has_markdown": true }, { "id": "40057888", "title": "Security: Use after free in WebApkIconHasher", "url": "https://issues.chromium.org/issues/40057888", "status": "Assigned", "severity": "S3-Low", "component": "Mobile>WebAPKs", "reporter": "ra...@gmail.com", "cve_ids": [], "bounty_amount": 20000.0, "reward_amount_meta": 20000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-11-11T15:35:22+00:00", "year": 2021, "attachment_count": 1, "local_path": "issues/40057888", "has_markdown": true }, { "id": "40057886", "title": "Security: Memory corruption in renderer process", "url": "https://issues.chromium.org/issues/40057886", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript, Blink>JavaScript>Runtime", "reporter": "lo...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-11-11T11:41:41+00:00", "year": 2021, "attachment_count": 1, "local_path": "issues/40057886", "has_markdown": true }, { "id": "40057873", "title": "V8 debug check failed: new_target->IsConstructor()", "url": "https://issues.chromium.org/issues/40057873", "status": "Assigned", "severity": "S4-Minimal", "component": "Blink>JavaScript>Runtime", "reporter": "et...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-11-10T06:37:34+00:00", "year": 2021, "attachment_count": 1, "local_path": "issues/40057873", "has_markdown": true }, { "id": "40057869", "title": "Security: Continued cookie bypasses", "url": "https://issues.chromium.org/issues/40057869", "status": "Assigned", "severity": "S3-Low", "component": "Internals>Network>Cookies", "reporter": "la...@gmail.com", "cve_ids": [], "bounty_amount": 4000.0, "reward_amount_meta": 4000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-11-09T22:09:32+00:00", "year": 2021, "attachment_count": 1, "local_path": "issues/40057869", "has_markdown": true }, { "id": "40057867", "title": "Security: Another Cross-Origin Response Size Leak Via BackgroundFetch", "url": "https://issues.chromium.org/issues/40057867", "status": "Assigned", "severity": "S3-Low", "component": "Blink>BackgroundFetch", "reporter": "la...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-11-09T20:18:47+00:00", "year": 2021, "attachment_count": 0, "local_path": "issues/40057867", "has_markdown": true }, { "id": "40057865", "title": "Security: Bypassing of security interstitials using debugger API", "url": "https://issues.chromium.org/issues/40057865", "status": "Accepted", "severity": "S3-Low", "component": "Platform>Extensions>API", "reporter": "jo...@pa.uc3m.es", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-11-09T16:20:08+00:00", "year": 2021, "attachment_count": 2, "local_path": "issues/40057865", "has_markdown": true }, { "id": "40057864", "title": "Security: Heap-use-after-free in ui::EventDispatcher::DispatchEventToEventHandlers()", "url": "https://issues.chromium.org/issues/40057864", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>Sharing", "reporter": "ch...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-11-09T13:48:42+00:00", "year": 2021, "attachment_count": 3, "local_path": "issues/40057864", "has_markdown": true }, { "id": "40057859", "title": "Security: UaF in AccessibilityUIMessageHandler::Callback", "url": "https://issues.chromium.org/issues/40057859", "status": "Accepted", "severity": "S3-Low", "component": "UI>Accessibility", "reporter": "ha...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-11-09T03:28:05+00:00", "year": 2021, "attachment_count": 1, "local_path": "issues/40057859", "has_markdown": true }, { "id": "40057858", "title": "Security: It is possible to lock the pointer while window is not focused.", "url": "https://issues.chromium.org/issues/40057858", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Input>PointerLock", "reporter": "je...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-11-08T12:19:46+00:00", "year": 2021, "attachment_count": 2, "local_path": "issues/40057858", "has_markdown": true }, { "id": "40057854", "title": "[ozone/wayland]use-after-free in WaylandWindow", "url": "https://issues.chromium.org/issues/40057854", "status": "Assigned", "severity": "S3-Low", "component": "Internals>Ozone, UI>Browser>TopChrome>TabStrip", "reporter": "ro...@gmail.com", "cve_ids": [], "bounty_amount": 10000.0, "reward_amount_meta": 10000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-11-08T06:52:56+00:00", "year": 2021, "attachment_count": 3, "local_path": "issues/40057854", "has_markdown": true }, { "id": "40057845", "title": "Security: heap-use-after-free in content::WebContentsObserver::web_contents", "url": "https://issues.chromium.org/issues/40057845", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>WebAppInstalls", "reporter": "yu...@gmail.com", "cve_ids": [], "bounty_amount": 15000.0, "reward_amount_meta": 15000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-11-07T06:55:33+00:00", "year": 2021, "attachment_count": 5, "local_path": "issues/40057845", "has_markdown": true }, { "id": "40057844", "title": "Security: Web Serial - Out of bound read in SerialPortUnderlyingSink::WriteData().", "url": "https://issues.chromium.org/issues/40057844", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Serial", "reporter": "lo...@gmail.com", "cve_ids": [], "bounty_amount": 7500.0, "reward_amount_meta": 7500.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-11-06T22:57:35+00:00", "year": 2021, "attachment_count": 3, "local_path": "issues/40057844", "has_markdown": true }, { "id": "40057843", "title": "Security: Wild write in angle", "url": "https://issues.chromium.org/issues/40057843", "status": "Assigned", "severity": "S4-Minimal", "component": "Internals>GPU>ANGLE", "reporter": "ao...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-11-06T22:19:08+00:00", "year": 2021, "attachment_count": 1, "local_path": "issues/40057843", "has_markdown": true }, { "id": "40057837", "title": "Security: webgl heap-buffer-overflow LoadCompressedToNative", "url": "https://issues.chromium.org/issues/40057837", "status": "Assigned", "severity": "S3-Low", "component": "Internals>GPU>ANGLE", "reporter": "[Deleted User]", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-11-06T01:24:48+00:00", "year": 2021, "attachment_count": 2, "local_path": "issues/40057837", "has_markdown": true }, { "id": "40057835", "title": "Security: webgl heap-buffer-overflow getDrawSubresourceSerial", "url": "https://issues.chromium.org/issues/40057835", "status": "Assigned", "severity": "S3-Low", "component": "Internals>GPU>ANGLE", "reporter": "[Deleted User]", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-11-05T21:38:09+00:00", "year": 2021, "attachment_count": 2, "local_path": "issues/40057835", "has_markdown": true }, { "id": "40057831", "title": "SameSite cookies leak via embedded browsing context", "url": "https://issues.chromium.org/issues/40057831", "status": "Assigned", "severity": "S3-Low", "component": "Internals>Network>Cookies", "reporter": "pr...@gmail.com", "cve_ids": [], "bounty_amount": 500.0, "reward_amount_meta": 500.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-11-05T17:11:31+00:00", "year": 2021, "attachment_count": 0, "local_path": "issues/40057831", "has_markdown": true }, { "id": "40057826", "title": "Chrome_ChromeOS: Crash Report - views::Widget::CloseWithReason via TabStripPageHandler::OnTabGroupChanged", "url": "https://issues.chromium.org/issues/40057826", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>TopChrome>TabStrip>ThumbnailTabStrip", "reporter": "le...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-11-05T00:17:13+00:00", "year": 2021, "attachment_count": 0, "local_path": "issues/40057826", "has_markdown": true }, { "id": "40057825", "title": "Security: webgl heap-use-after-free in BitSetT", "url": "https://issues.chromium.org/issues/40057825", "status": "Assigned", "severity": "S3-Low", "component": "Internals>GPU>ANGLE", "reporter": "[Deleted User]", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-11-04T23:16:04+00:00", "year": 2021, "attachment_count": 2, "local_path": "issues/40057825", "has_markdown": true }, { "id": "40057810", "title": "Cross-site information leak - CSP Violation reports contain blockedURI's hostname", "url": "https://issues.chromium.org/issues/40057810", "status": "Assigned", "severity": "S3-Low", "component": "Mobile>iOSWeb>Security", "reporter": "pr...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-11-03T23:52:27+00:00", "year": 2021, "attachment_count": 1, "local_path": "issues/40057810", "has_markdown": true }, { "id": "40057806", "title": "Security: container-overflow in ExtensionsToolbarContainer::SetExtensionIconVisibility", "url": "https://issues.chromium.org/issues/40057806", "status": "Assigned", "severity": "S3-Low", "component": "Platform>Extensions", "reporter": "ch...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-11-03T17:58:16+00:00", "year": 2021, "attachment_count": 5, "local_path": "issues/40057806", "has_markdown": true }, { "id": "40057804", "title": "Use after free in getSamplerTexture", "url": "https://issues.chromium.org/issues/40057804", "status": "Assigned", "severity": "S4-Minimal", "component": "Internals>GPU>ANGLE", "reporter": "sj...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-11-03T15:20:22+00:00", "year": 2021, "attachment_count": 3, "local_path": "issues/40057804", "has_markdown": true }, { "id": "40057791", "title": "Security: webrtc: out-of-bounds write in audio channel processing", "url": "https://issues.chromium.org/issues/40057791", "status": "Assigned", "severity": "S3-Low", "component": "Blink>WebRTC>Audio", "reporter": "bt...@gmail.com", "cve_ids": [], "bounty_amount": 8500.0, "reward_amount_meta": 8500.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-11-02T05:50:20+00:00", "year": 2021, "attachment_count": 5, "local_path": "issues/40057791", "has_markdown": true }, { "id": "40801351", "title": "Security: Heap-use-after-free in lens::LensRegionSearchController::OnCaptureCompleted", "url": "https://issues.chromium.org/issues/40801351", "status": "Accepted", "severity": "S3-Low", "component": "Internals>Plugins>PDF, UI>Browser>Mobile", "reporter": "ch...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-11-01T07:15:45+00:00", "year": 2021, "attachment_count": 4, "local_path": "issues/40801351", "has_markdown": true }, { "id": "40057777", "title": "XSS from chrome-untrusted://new-tab-page URL parsing", "url": "https://issues.chromium.org/issues/40057777", "status": "Accepted", "severity": "S3-Low", "component": "Internals>Sandbox>SiteIsolation, Platform>Extensions, UI>Browser>WebUI", "reporter": "nd...@protonmail.com", "cve_ids": [], "bounty_amount": 500.0, "reward_amount_meta": 500.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-10-31T03:30:35+00:00", "year": 2021, "attachment_count": 0, "local_path": "issues/40057777", "has_markdown": true }, { "id": "40057776", "title": "Referrer leakage via object & embed tags despite setting referrer policy to no-referrer", "url": "https://issues.chromium.org/issues/40057776", "status": "Assigned", "severity": "S4-Minimal", "component": "Blink>SecurityFeature>Referrer", "reporter": "pr...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-10-31T02:27:51+00:00", "year": 2021, "attachment_count": 1, "local_path": "issues/40057776", "has_markdown": true }, { "id": "40057770", "title": "Security: ASan reports wild reads in swiftshader", "url": "https://issues.chromium.org/issues/40057770", "status": "Assigned", "severity": "S3-Low", "component": "Internals>GPU, Internals>GPU>SwiftShader", "reporter": "ao...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-10-29T22:13:33+00:00", "year": 2021, "attachment_count": 2, "local_path": "issues/40057770", "has_markdown": true }, { "id": "40057760", "title": "Security: Heap-use-after-free in sharing_hub::SharingHubBubbleController::~SharingHubBubbleController", "url": "https://issues.chromium.org/issues/40057760", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>Sharing", "reporter": "ch...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-10-29T05:27:27+00:00", "year": 2021, "attachment_count": 1, "local_path": "issues/40057760", "has_markdown": true }, { "id": "40057755", "title": "Security: Chrome for Android Hide Entering Fullscreen Notification Toast using Multiple Toast from Failed to Copy", "url": "https://issues.chromium.org/issues/40057755", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>FullScreen", "reporter": "su...@gmail.com", "cve_ids": [], "bounty_amount": 2500.0, "reward_amount_meta": 2500.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-10-28T20:32:13+00:00", "year": 2021, "attachment_count": 3, "local_path": "issues/40057755", "has_markdown": true }, { "id": "40057743", "title": "Security: UAF in SharingHub", "url": "https://issues.chromium.org/issues/40057743", "status": "New", "severity": "S3-Low", "component": "UI>Browser>Sharing", "reporter": "le...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-10-28T04:59:20+00:00", "year": 2021, "attachment_count": 2, "local_path": "issues/40057743", "has_markdown": true }, { "id": "40057716", "title": "Google Chrome MediaStreamTrackGenerator use after free vulnerability (TALOS-2021-1398)", "url": "https://issues.chromium.org/issues/40057716", "status": "Assigned", "severity": "S3-Low", "component": "Blink>MediaStream", "reporter": "ma...@gmail.com", "cve_ids": [], "bounty_amount": 7500.0, "reward_amount_meta": 7500.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-10-26T19:21:11+00:00", "year": 2021, "attachment_count": 2, "local_path": "issues/40057716", "has_markdown": true }, { "id": "40800189", "title": "Non-positive-vla-bound-value in blink::CanvasPath::roundRect", "url": "https://issues.chromium.org/issues/40800189", "status": "Assigned", "severity": "S4-Minimal", "component": "Blink>Canvas, Blink>JavaScript>API", "reporter": "m....@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-10-26T09:34:44+00:00", "year": 2021, "attachment_count": 0, "local_path": "issues/40800189", "has_markdown": true }, { "id": "40057696", "title": "Improper restriction in password saving form, while navigation from one site to another site", "url": "https://issues.chromium.org/issues/40057696", "status": "Accepted", "severity": "S3-Low", "component": "Privacy, UI>Browser>Passwords", "reporter": "ch...@gmail.com", "cve_ids": [], "bounty_amount": 500.0, "reward_amount_meta": 500.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-10-25T10:37:43+00:00", "year": 2021, "attachment_count": 2, "local_path": "issues/40057696", "has_markdown": true }, { "id": "40057694", "title": "Security: Heap-use-after-free in AccessibilityUIMessageHandler::RequestWebContentsTree", "url": "https://issues.chromium.org/issues/40057694", "status": "Accepted", "severity": "S3-Low", "component": "Internals>Accessibility", "reporter": "ch...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-10-25T06:29:22+00:00", "year": 2021, "attachment_count": 2, "local_path": "issues/40057694", "has_markdown": true }, { "id": "40057691", "title": "Security: Chrome for Android Prevent Back Button to Exit Fullscreen Mode using Text Selection", "url": "https://issues.chromium.org/issues/40057691", "status": "Accepted", "severity": "S3-Low", "component": "UI>Browser>FullScreen, UI>Browser>Selection", "reporter": "su...@gmail.com", "cve_ids": [ "CVE-2021-29983" ], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-10-24T20:13:11+00:00", "year": 2021, "attachment_count": 4, "local_path": "issues/40057691", "has_markdown": true }, { "id": "40057686", "title": "Security: Type confusion in UnderlyingSinkBase::start", "url": "https://issues.chromium.org/issues/40057686", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript", "reporter": "ji...@gmail.com", "cve_ids": [], "bounty_amount": 15000.0, "reward_amount_meta": 15000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-10-24T05:06:50+00:00", "year": 2021, "attachment_count": 2, "local_path": "issues/40057686", "has_markdown": true }, { "id": "40057683", "title": "SUMMARY: AddressSanitizer: access-violation regexp-interpreter.cc:461 in v8::internal::`anonymous namespace'::RawMatch", "url": "https://issues.chromium.org/issues/40057683", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript, Blink>JavaScript>Regexp", "reporter": "m....@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-10-23T05:19:18+00:00", "year": 2021, "attachment_count": 5, "local_path": "issues/40057683", "has_markdown": true }, { "id": "40057672", "title": "Security: heap-use-after-free swiftshader getCurrentViewCount", "url": "https://issues.chromium.org/issues/40057672", "status": "Assigned", "severity": "S3-Low", "component": "Internals>GPU>Internals, Internals>GPU>SwiftShader", "reporter": "[Deleted User]", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-10-21T11:03:04+00:00", "year": 2021, "attachment_count": 1, "local_path": "issues/40057672", "has_markdown": true }, { "id": "40057671", "title": "Security: heap-buffer-overflow swiftshader Image::copy", "url": "https://issues.chromium.org/issues/40057671", "status": "Assigned", "severity": "S3-Low", "component": "Internals>GPU>SwiftShader", "reporter": "[Deleted User]", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-10-21T09:59:02+00:00", "year": 2021, "attachment_count": 3, "local_path": "issues/40057671", "has_markdown": true }, { "id": "40057665", "title": "Security: Heap-use-after-free in feedback::FeedbackData::SendReport", "url": "https://issues.chromium.org/issues/40057665", "status": "Accepted", "severity": "S3-Low", "component": "UI>Browser>Profiles, UI>Browser>ReportAnIssue", "reporter": "ch...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-10-20T04:22:57+00:00", "year": 2021, "attachment_count": 1, "local_path": "issues/40057665", "has_markdown": true }, { "id": "40057661", "title": "Security: scrollTop of ListBox autofill preview discloses sensitive information", "url": "https://issues.chromium.org/issues/40057661", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>Autofill", "reporter": "ym...@ym.kim", "cve_ids": [], "bounty_amount": 4000.0, "reward_amount_meta": 4000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-10-20T02:20:46+00:00", "year": 2021, "attachment_count": 5, "local_path": "issues/40057661", "has_markdown": true }, { "id": "40057655", "title": "Security: UAF during sharesheet teardown with animation running", "url": "https://issues.chromium.org/issues/40057655", "status": "Assigned", "severity": "Unknown", "component": "UI>Browser>Sharing", "reporter": "ch...@gmail.com", "cve_ids": [], "bounty_amount": 7500.0, "reward_amount_meta": 7500.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-10-19T17:00:44+00:00", "year": 2021, "attachment_count": 1, "local_path": "issues/40057655", "has_markdown": true }, { "id": "40057645", "title": "Security: Form validation UI dialog can cover whole page", "url": "https://issues.chromium.org/issues/40057645", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Forms>Validation", "reporter": "st...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-10-18T20:32:14+00:00", "year": 2021, "attachment_count": 3, "local_path": "issues/40057645", "has_markdown": true }, { "id": "40057640", "title": "Security: TFC 2021 loader bug", "url": "https://issues.chromium.org/issues/40057640", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Loader", "reporter": "jt...@gmail.com", "cve_ids": [], "bounty_amount": 10000.0, "reward_amount_meta": 10000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-10-18T16:14:41+00:00", "year": 2021, "attachment_count": 4, "local_path": "issues/40057640", "has_markdown": true }, { "id": "40057634", "title": "Heap-use-after-free in color input on switching screens (MacOS)", "url": "https://issues.chromium.org/issues/40057634", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Forms>Color", "reporter": "dm...@gmail.com", "cve_ids": [], "bounty_amount": 10000.0, "reward_amount_meta": 10000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-10-18T12:20:07+00:00", "year": 2021, "attachment_count": 3, "local_path": "issues/40057634", "has_markdown": true }, { "id": "40057631", "title": "Use after free in gl::VertexArray::setDependentDirtyBit", "url": "https://issues.chromium.org/issues/40057631", "status": "Assigned", "severity": "S3-Low", "component": "Internals>GPU>ANGLE", "reporter": "sj...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-10-18T05:41:44+00:00", "year": 2021, "attachment_count": 2, "local_path": "issues/40057631", "has_markdown": true }, { "id": "40057626", "title": "Leaking size of cross-origin resources by using Range Requests, Service Workers, Fetch API, and the Cache API", "url": "https://issues.chromium.org/issues/40057626", "status": "Assigned", "severity": "S3-Low", "component": "Blink>PerformanceAPIs>ResourceTiming, Blink>ServiceWorker, Internals>Media>Network", "reporter": "he...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-10-16T19:59:49+00:00", "year": 2021, "attachment_count": 2, "local_path": "issues/40057626", "has_markdown": true }, { "id": "40057625", "title": "Security: PDFium Use-After-Free in v8::internal::ArrayBufferExtension::Mark", "url": "https://issues.chromium.org/issues/40057625", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript>Compiler, Blink>JavaScript>GarbageCollection, Internals>Plugins>PDF", "reporter": "0x...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-10-16T14:10:17+00:00", "year": 2021, "attachment_count": 1, "local_path": "issues/40057625", "has_markdown": true }, { "id": "40057616", "title": "Security: the contents of iframe is placed outside of iframe when CSS \"column-width\" is defined in main frame.", "url": "https://issues.chromium.org/issues/40057616", "status": "Accepted", "severity": "S3-Low", "component": "Blink>Paint", "reporter": "ss...@snu.ac.kr", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-10-15T04:34:54+00:00", "year": 2021, "attachment_count": 6, "local_path": "issues/40057616", "has_markdown": true }, { "id": "40057610", "title": "Security: RenderFrameHostImpl logic error leading browser UAF", "url": "https://issues.chromium.org/issues/40057610", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Portals, Internals>Sandbox>SiteIsolation, Platform>Apps>BrowserTag", "reporter": "bt...@gmail.com", "cve_ids": [], "bounty_amount": 20000.0, "reward_amount_meta": 20000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-10-14T21:46:18+00:00", "year": 2021, "attachment_count": 1, "local_path": "issues/40057610", "has_markdown": true }, { "id": "40057609", "title": "Security: V8 CreateLiteral type confusion when processing ..spread leads to RCE", "url": "https://issues.chromium.org/issues/40057609", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript>API", "reporter": "bt...@gmail.com", "cve_ids": [], "bounty_amount": 20000.0, "reward_amount_meta": 20000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-10-14T21:24:32+00:00", "year": 2021, "attachment_count": 2, "local_path": "issues/40057609", "has_markdown": true }, { "id": "40057601", "title": "Security: heap-use-after-free in ForceSigninVerifier::SendRequestIfNetworkAvailable", "url": "https://issues.chromium.org/issues/40057601", "status": "Assigned", "severity": "S3-Low", "component": "Unknown", "reporter": "yu...@gmail.com", "cve_ids": [], "bounty_amount": 10000.0, "reward_amount_meta": 10000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-10-14T06:28:33+00:00", "year": 2021, "attachment_count": 0, "local_path": "issues/40057601", "has_markdown": true }, { "id": "40057597", "title": "Contact dialog can be shown over a cross-origin page which might confuse a user into leaking sensitive information to an attacker", "url": "https://issues.chromium.org/issues/40057597", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Contacts", "reporter": "he...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-10-13T18:09:00+00:00", "year": 2021, "attachment_count": 2, "local_path": "issues/40057597", "has_markdown": true }, { "id": "40057594", "title": "Security: UAP on creating WebAssembly memories on document reload", "url": "https://issues.chromium.org/issues/40057594", "status": "Assigned", "severity": "S3-Low", "component": "Blink>GarbageCollection", "reporter": "em...@gmail.com", "cve_ids": [], "bounty_amount": 7500.0, "reward_amount_meta": 7500.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-10-13T11:54:23+00:00", "year": 2021, "attachment_count": 1, "local_path": "issues/40057594", "has_markdown": true }, { "id": "40057591", "title": "Security UI Spoofing on Chrome for Android due to the Contact permission dialog hiding the fullscreen alert message", "url": "https://issues.chromium.org/issues/40057591", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Contacts, Blink>Fullscreen, Blink>PermissionsAPI, UI>Browser>FullScreen", "reporter": "he...@gmail.com", "cve_ids": [ "CVE-2022-1307" ], "bounty_amount": 7500.0, "reward_amount_meta": 7500.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-10-13T01:59:59+00:00", "year": 2021, "attachment_count": 4, "local_path": "issues/40057591", "has_markdown": true }, { "id": "40057561", "title": "URL Spoof after crash", "url": "https://issues.chromium.org/issues/40057561", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Loader, Internals>Sandbox>SiteIsolation, UI>Browser>Navigation", "reporter": "nd...@protonmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-10-10T02:06:57+00:00", "year": 2021, "attachment_count": 1, "local_path": "issues/40057561", "has_markdown": true }, { "id": "40057545", "title": "heap-buffer-overflow in WebMediaPlayerMSCompositor::ReplaceCurrentFrameWithACopyInternal()", "url": "https://issues.chromium.org/issues/40057545", "status": "Assigned", "severity": "S3-Low", "component": "Blink>GetUserMedia, Blink>WebRTC>Video", "reporter": "em...@gmail.com", "cve_ids": [], "bounty_amount": 7500.0, "reward_amount_meta": 7500.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-10-08T03:53:50+00:00", "year": 2021, "attachment_count": 3, "local_path": "issues/40057545", "has_markdown": true }, { "id": "40057525", "title": "Sandbox escape: bypass allow-popups-to-escape-sandbox", "url": "https://issues.chromium.org/issues/40057525", "status": "Assigned", "severity": "S3-Low", "component": "Blink>SecurityFeature>IFrameSandbox", "reporter": "nd...@protonmail.com", "cve_ids": [], "bounty_amount": 2500.0, "reward_amount_meta": 2500.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-10-05T16:01:14+00:00", "year": 2021, "attachment_count": 0, "local_path": "issues/40057525", "has_markdown": true }, { "id": "40057508", "title": "Security: UI spoofing using a very long URL", "url": "https://issues.chromium.org/issues/40057508", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>MediaCapture, UI>Browser>Permissions>Prompts, UI>Security (Use Subcomponent)>UrlFormatting", "reporter": "st...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-10-04T16:07:12+00:00", "year": 2021, "attachment_count": 9, "local_path": "issues/40057508", "has_markdown": true }, { "id": "40057499", "title": "Security: Busy Rendering Cause Layer to Persist on Target Website Allow Address Bar Spoofing & Clickjacking Attack", "url": "https://issues.chromium.org/issues/40057499", "status": "Assigned", "severity": "S3-Low", "component": "UI>Input", "reporter": "su...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-10-04T01:25:41+00:00", "year": 2021, "attachment_count": 22, "local_path": "issues/40057499", "has_markdown": true }, { "id": "40057482", "title": "UaF in PDF accessibility due to relayout", "url": "https://issues.chromium.org/issues/40057482", "status": "Assigned", "severity": "S4-Minimal", "component": "Internals>Plugins>PDF, UI>Accessibility", "reporter": "em...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-10-02T04:46:39+00:00", "year": 2021, "attachment_count": 3, "local_path": "issues/40057482", "has_markdown": true }, { "id": "40057460", "title": "SUMMARY: AddressSanitizer: stack-use-after-scope renderer11_utils.cpp:2299 in rx::d3d11::SetDebugName", "url": "https://issues.chromium.org/issues/40057460", "status": "Assigned", "severity": "S3-Low", "component": "Internals>GPU>ANGLE", "reporter": "m....@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-09-30T14:44:52+00:00", "year": 2021, "attachment_count": 1, "local_path": "issues/40057460", "has_markdown": true }, { "id": "40057453", "title": "Security: Chrome 94 does not correctly set Integrity level of all processes to Untrusted", "url": "https://issues.chromium.org/issues/40057453", "status": "Assigned", "severity": "S3-Low", "component": "Internals>Sandbox", "reporter": "ji...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-09-30T07:07:14+00:00", "year": 2021, "attachment_count": 3, "local_path": "issues/40057453", "has_markdown": true }, { "id": "40057438", "title": "Primitive type confusion in ia32 AssembleCodePhase", "url": "https://issues.chromium.org/issues/40057438", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript>Compiler", "reporter": "fz...@gmail.com", "cve_ids": [], "bounty_amount": 7500.0, "reward_amount_meta": 7500.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-09-29T03:23:44+00:00", "year": 2021, "attachment_count": 1, "local_path": "issues/40057438", "has_markdown": true }, { "id": "40057427", "title": "Security: WebAudio oob read in AudioDelayDSPKernel::ProcessKRate", "url": "https://issues.chromium.org/issues/40057427", "status": "Assigned", "severity": "S3-Low", "component": "Blink>WebAudio", "reporter": "su...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-09-28T05:33:44+00:00", "year": 2021, "attachment_count": 4, "local_path": "issues/40057427", "has_markdown": true }, { "id": "40057422", "title": "Security: pdfium heap buffer overflow in cfx_dibbase.cpp", "url": "https://issues.chromium.org/issues/40057422", "status": "Assigned", "severity": "S3-Low", "component": "Internals>Plugins>PDF", "reporter": "ch...@gmail.com", "cve_ids": [], "bounty_amount": 7500.0, "reward_amount_meta": 7500.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-09-27T16:45:08+00:00", "year": 2021, "attachment_count": 2, "local_path": "issues/40057422", "has_markdown": true }, { "id": "40057389", "title": "Security: negative-size-param in image_editor::ScreenshotFlow::RemoveUIOverlay", "url": "https://issues.chromium.org/issues/40057389", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>Sharing", "reporter": "ch...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-09-25T04:12:11+00:00", "year": 2021, "attachment_count": 1, "local_path": "issues/40057389", "has_markdown": true }, { "id": "40057384", "title": "use after poison in blink::Element::DidMoveToNewDocument", "url": "https://issues.chromium.org/issues/40057384", "status": "Assigned", "severity": "S3-Low", "component": "Blink>GarbageCollection", "reporter": "em...@gmail.com", "cve_ids": [], "bounty_amount": 10000.0, "reward_amount_meta": 10000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-09-24T18:13:31+00:00", "year": 2021, "attachment_count": 8, "local_path": "issues/40057384", "has_markdown": true }, { "id": "40057377", "title": "Security: heap-use-after-free in PrefChangeRegistrar::~PrefChangeRegistrar", "url": "https://issues.chromium.org/issues/40057377", "status": "Accepted", "severity": "S3-Low", "component": "Blink>Payments, Internals", "reporter": "me...@gmail.com", "cve_ids": [], "bounty_amount": 10000.0, "reward_amount_meta": 10000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-09-24T10:06:21+00:00", "year": 2021, "attachment_count": 11, "local_path": "issues/40057377", "has_markdown": true }, { "id": "40057362", "title": "Security: UAF in IdentityDialogController::ShowIdProviderWindow", "url": "https://issues.chromium.org/issues/40057362", "status": "Fixed", "severity": "S3-Low", "component": "Blink>Identity>FedCM", "reporter": "jt...@gmail.com", "cve_ids": [], "bounty_amount": 25000.0, "reward_amount_meta": 25000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-09-23T11:50:22+00:00", "year": 2021, "attachment_count": 5, "local_path": "issues/40057362", "has_markdown": true }, { "id": "40057349", "title": "Security: Top-level redirect from cross-origin iframe by setting `Content-Security-Policy: sandbox allow-top-navigation`", "url": "https://issues.chromium.org/issues/40057349", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>PopupBlocker", "reporter": "da...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-09-21T21:57:19+00:00", "year": 2021, "attachment_count": 0, "local_path": "issues/40057349", "has_markdown": true }, { "id": "40057344", "title": "Security: Continued AddEventListener GC problems", "url": "https://issues.chromium.org/issues/40057344", "status": "Assigned", "severity": "Unknown", "component": "Blink>GarbageCollection", "reporter": "m....@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-09-21T17:30:16+00:00", "year": 2021, "attachment_count": 5, "local_path": "issues/40057344", "has_markdown": true }, { "id": "40057339", "title": "Security: download protection bypass on macOS with .inetloc", "url": "https://issues.chromium.org/issues/40057339", "status": "Accepted", "severity": "S3-Low", "component": "UI>Browser>Downloads", "reporter": "ho...@gmail.com", "cve_ids": [ "CVE-2021-38510" ], "bounty_amount": 500.0, "reward_amount_meta": 500.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-09-21T12:12:59+00:00", "year": 2021, "attachment_count": 1, "local_path": "issues/40057339", "has_markdown": true }, { "id": "40057334", "title": "Security: Universal Cross-Site Scripting (UXSS) - completing previously searched text in NTP", "url": "https://issues.chromium.org/issues/40057334", "status": "Assigned", "severity": "S3-Low", "component": "Unknown", "reporter": "as...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-09-21T09:15:59+00:00", "year": 2021, "attachment_count": 4, "local_path": "issues/40057334", "has_markdown": true }, { "id": "40057322", "title": "Security: Fetch leaks information about cross-origin redirects", "url": "https://issues.chromium.org/issues/40057322", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript, Blink>SecurityFeature>CORS, Privacy", "reporter": "la...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-09-20T14:53:00+00:00", "year": 2021, "attachment_count": 0, "local_path": "issues/40057322", "has_markdown": true }, { "id": "40057320", "title": "Chrome downgrades long-running requests from HTTPS to HTTP after 3 s.", "url": "https://issues.chromium.org/issues/40057320", "status": "Accepted", "severity": "S3-Low", "component": "Internals>Network, UI>Browser>Omnibox", "reporter": "[Deleted User]", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-09-20T06:53:28+00:00", "year": 2021, "attachment_count": 1, "local_path": "issues/40057320", "has_markdown": true }, { "id": "40057314", "title": "Security: URL spoofing using LATIN SMALL LETTER L WITH STROKE", "url": "https://issues.chromium.org/issues/40057314", "status": "Accepted", "severity": "S3-Low", "component": "UI>Security (Use Subcomponent)>UrlFormatting", "reporter": "ra...@gmail.com", "cve_ids": [], "bounty_amount": 500.0, "reward_amount_meta": 500.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-09-19T15:55:19+00:00", "year": 2021, "attachment_count": 1, "local_path": "issues/40057314", "has_markdown": true }, { "id": "40057297", "title": "#Summary SUMMARY: AddressSanitizer: heap-use-after-free in gpu::CommandBufferProxyImpl::OnDisconnect", "url": "https://issues.chromium.org/issues/40057297", "status": "Assigned", "severity": "S3-Low", "component": "Internals>GPU", "reporter": "m....@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-09-17T09:26:40+00:00", "year": 2021, "attachment_count": 1, "local_path": "issues/40057297", "has_markdown": true }, { "id": "40057288", "title": "SUMMARY: AddressSanitizer: heap-use-after-free web_view_impl.cc:1020 in blink::WebViewImpl::ClosePagePopup", "url": "https://issues.chromium.org/issues/40057288", "status": "Assigned", "severity": "S3-Low", "component": "Blink>WindowDialog", "reporter": "m....@gmail.com", "cve_ids": [], "bounty_amount": 7500.0, "reward_amount_meta": 7500.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-09-16T08:29:05+00:00", "year": 2021, "attachment_count": 2, "local_path": "issues/40057288", "has_markdown": true }, { "id": "40057268", "title": "Security: Use After Free in DevToolsFileHelper::GetFileSystems", "url": "https://issues.chromium.org/issues/40057268", "status": "Assigned", "severity": "S3-Low", "component": "Platform>DevTools>Extensions", "reporter": "ha...@gmail.com", "cve_ids": [], "bounty_amount": 10000.0, "reward_amount_meta": 10000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-09-15T11:43:36+00:00", "year": 2021, "attachment_count": 0, "local_path": "issues/40057268", "has_markdown": true }, { "id": "40057260", "title": "use after free in ash::sharesheet::SharesheetBubbleView::CloseBubble", "url": "https://issues.chromium.org/issues/40057260", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>Sharing", "reporter": "wx...@gmail.com", "cve_ids": [], "bounty_amount": 7500.0, "reward_amount_meta": 7500.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-09-14T16:01:31+00:00", "year": 2021, "attachment_count": 3, "local_path": "issues/40057260", "has_markdown": true }, { "id": "40057258", "title": "heap buffer overflow in BookmarkManagerPrivateDropFunction::RunOnReady", "url": "https://issues.chromium.org/issues/40057258", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>Bookmarks", "reporter": "wx...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-09-14T11:55:54+00:00", "year": 2021, "attachment_count": 2, "local_path": "issues/40057258", "has_markdown": true }, { "id": "40057239", "title": "CSP Violation reports contain blockedURI's hostname", "url": "https://issues.chromium.org/issues/40057239", "status": "Assigned", "severity": "S3-Low", "component": "Mobile>iOSWeb>Security", "reporter": "pr...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-09-13T04:45:19+00:00", "year": 2021, "attachment_count": 1, "local_path": "issues/40057239", "has_markdown": true }, { "id": "40057229", "title": "Security: heap-use-after-free in app_controller_mac.mm", "url": "https://issues.chromium.org/issues/40057229", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>Incognito", "reporter": "me...@gmail.com", "cve_ids": [], "bounty_amount": 10000.0, "reward_amount_meta": 10000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-09-11T02:14:16+00:00", "year": 2021, "attachment_count": 1, "local_path": "issues/40057229", "has_markdown": true }, { "id": "40057228", "title": "SEGV in vk::Image::clear()", "url": "https://issues.chromium.org/issues/40057228", "status": "Assigned", "severity": "S4-Minimal", "component": "Internals>GPU>SwiftShader", "reporter": "at...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-09-10T21:03:36+00:00", "year": 2021, "attachment_count": 2, "local_path": "issues/40057228", "has_markdown": true }, { "id": "40057223", "title": "Guessing the URL a cross-origin iframe was redirected to by listening to the load event", "url": "https://issues.chromium.org/issues/40057223", "status": "Assigned", "severity": "S3-Low", "component": "Internals>Sandbox>SiteIsolation, UI>Browser>Navigation", "reporter": "he...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-09-10T16:06:34+00:00", "year": 2021, "attachment_count": 3, "local_path": "issues/40057223", "has_markdown": true }, { "id": "40057221", "title": "SUMMARY: AddressSanitizer: use-after-poison event_listener_map.cc:144 in blink::EventListenerMap::Add", "url": "https://issues.chromium.org/issues/40057221", "status": "Assigned", "severity": "S4-Minimal", "component": "Blink>GarbageCollection", "reporter": "m....@gmail.com", "cve_ids": [], "bounty_amount": 7500.0, "reward_amount_meta": 7500.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-09-10T15:23:23+00:00", "year": 2021, "attachment_count": 13, "local_path": "issues/40057221", "has_markdown": true }, { "id": "40057217", "title": "Security: heap-use-after-free in the views::Widget::GetNativeTheme in the browser process ", "url": "https://issues.chromium.org/issues/40057217", "status": "Fixed", "severity": "S3-Low", "component": "UI>Browser>Omnibox", "reporter": "0x...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-09-09T14:08:37+00:00", "year": 2021, "attachment_count": 2, "local_path": "issues/40057217", "has_markdown": true }, { "id": "40057215", "title": "Security: Use After Free in FileSystemAccessManagerImpl", "url": "https://issues.chromium.org/issues/40057215", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Storage>FileSystem", "reporter": "so...@gmail.com", "cve_ids": [], "bounty_amount": 15000.0, "reward_amount_meta": 15000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-09-09T12:21:28+00:00", "year": 2021, "attachment_count": 2, "local_path": "issues/40057215", "has_markdown": true }, { "id": "40057200", "title": "Security: Possible to see the user's system environment variables like secrets, tokens or keys", "url": "https://issues.chromium.org/issues/40057200", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Storage>FileSystem", "reporter": "ma...@gmail.com", "cve_ids": [], "bounty_amount": 10000.0, "reward_amount_meta": 10000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-09-07T20:40:09+00:00", "year": 2021, "attachment_count": 4, "local_path": "issues/40057200", "has_markdown": true }, { "id": "40057198", "title": "Google Chrome WebRTC RTPSenderVideoFrameTransformerDelegate memory corruption vulnerability (TALOS-2021-1372)", "url": "https://issues.chromium.org/issues/40057198", "status": "Assigned", "severity": "S3-Low", "component": "Blink>WebRTC>Video", "reporter": "ma...@gmail.com", "cve_ids": [], "bounty_amount": 7500.0, "reward_amount_meta": 7500.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-09-07T13:54:56+00:00", "year": 2021, "attachment_count": 3, "local_path": "issues/40057198", "has_markdown": true }, { "id": "40057185", "title": "SUMMARY: AddressSanitizer: use-after-poison timer.cc:217 in base::internal::TimerBase::OnScheduledTaskInvoked", "url": "https://issues.chromium.org/issues/40057185", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Media>Controls", "reporter": "m....@gmail.com", "cve_ids": [], "bounty_amount": 7500.0, "reward_amount_meta": 7500.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-09-06T03:43:50+00:00", "year": 2021, "attachment_count": 7, "local_path": "issues/40057185", "has_markdown": true }, { "id": "40057168", "title": "SUMMARY: AddressSanitizer: heap-buffer-overflow SkPixmap.cpp:321 in SkPixmap::getColor", "url": "https://issues.chromium.org/issues/40057168", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Forms>Color", "reporter": "m....@gmail.com", "cve_ids": [], "bounty_amount": 20000.0, "reward_amount_meta": 20000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-09-04T15:25:35+00:00", "year": 2021, "attachment_count": 6, "local_path": "issues/40057168", "has_markdown": true }, { "id": "40057153", "title": "Security: heap-use-after-free C:\\b\\s\\w\\ir\\cache\\builder\\src\\chrome\\browser\\ui\\views\\media_router\\web_contents_display_observer_view.cc:56:22 in media_router::WebContentsDisplayObserverView::OnBrowserSetLastActive(class Browser *)", "url": "https://issues.chromium.org/issues/40057153", "status": "Assigned", "severity": "S3-Low", "component": "Internals>Cast>UI", "reporter": "rh...@gmail.com", "cve_ids": [], "bounty_amount": 15000.0, "reward_amount_meta": 15000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-09-03T14:51:13+00:00", "year": 2021, "attachment_count": 21, "local_path": "issues/40057153", "has_markdown": true }, { "id": "40057147", "title": "Security: Compromised renderer can set custom cursor up to 1024px over browser UI and other windows", "url": "https://issues.chromium.org/issues/40057147", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Input", "reporter": "al...@alesandroortiz.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-09-02T23:32:20+00:00", "year": 2021, "attachment_count": 4, "local_path": "issues/40057147", "has_markdown": true }, { "id": "40057133", "title": "AddressSanitizer: use-after-poison execution_context_lifecycle_observer.cc:40 in blink::ExecutionContextLifecycleObserver::GetExecutionContext", "url": "https://issues.chromium.org/issues/40057133", "status": "Assigned", "severity": "S3-Low", "component": "Blink>GetDisplayMedia", "reporter": "m....@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-09-02T03:40:38+00:00", "year": 2021, "attachment_count": 3, "local_path": "issues/40057133", "has_markdown": true }, { "id": "40057132", "title": "Security: Incomplete fix for CVE-2021-30577", "url": "https://issues.chromium.org/issues/40057132", "status": "Assigned", "severity": "S3-Low", "component": "Internals>Updater", "reporter": "ve...@gmail.com", "cve_ids": [ "CVE-2021-30577" ], "bounty_amount": 10000.0, "reward_amount_meta": 10000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-09-02T03:39:01+00:00", "year": 2021, "attachment_count": 1, "local_path": "issues/40057132", "has_markdown": true }, { "id": "40057126", "title": "Security: Security DCHECK failure at blink::LayoutInline", "url": "https://issues.chromium.org/issues/40057126", "status": "Assigned", "severity": "S4-Minimal", "component": "Blink>Internals>WTF, Blink>Layout", "reporter": "ao...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-09-01T21:24:51+00:00", "year": 2021, "attachment_count": 1, "local_path": "issues/40057126", "has_markdown": true }, { "id": "40057118", "title": "heap-use-after-free in OnBrowserSetLastActive", "url": "https://issues.chromium.org/issues/40057118", "status": "Assigned", "severity": "S3-Low", "component": "Unknown", "reporter": "ro...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-09-01T13:41:03+00:00", "year": 2021, "attachment_count": 0, "local_path": "issues/40057118", "has_markdown": true }, { "id": "40057113", "title": "Security: heap-use-after-free in PPAPIDownloadRequest::AllowlistCheckComplete", "url": "https://issues.chromium.org/issues/40057113", "status": "Assigned", "severity": "S3-Low", "component": "Unknown", "reporter": "me...@gmail.com", "cve_ids": [], "bounty_amount": 20000.0, "reward_amount_meta": 20000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-09-01T10:34:12+00:00", "year": 2021, "attachment_count": 2, "local_path": "issues/40057113", "has_markdown": true }, { "id": "40057097", "title": "Security: Cross-Origin Response Size Leak Via BackgroundFetch", "url": "https://issues.chromium.org/issues/40057097", "status": "Assigned", "severity": "S3-Low", "component": "Blink>BackgroundFetch", "reporter": "la...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-08-30T20:48:11+00:00", "year": 2021, "attachment_count": 0, "local_path": "issues/40057097", "has_markdown": true }, { "id": "40057086", "title": "Security: Cross-Origin information leak or delete in ContentIndex", "url": "https://issues.chromium.org/issues/40057086", "status": "Assigned", "severity": "S3-Low", "component": "Blink>ContentIndexing", "reporter": "so...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-08-30T12:54:47+00:00", "year": 2021, "attachment_count": 1, "local_path": "issues/40057086", "has_markdown": true }, { "id": "40057069", "title": "Security: Heap-use-after-free in ui::EventDispatcher::DispatchEventToEventHandlers", "url": "https://issues.chromium.org/issues/40057069", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>Mobile", "reporter": "ch...@gmail.com", "cve_ids": [], "bounty_amount": 15000.0, "reward_amount_meta": 15000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-08-29T01:52:33+00:00", "year": 2021, "attachment_count": 3, "local_path": "issues/40057069", "has_markdown": true }, { "id": "40057062", "title": "Security: SameSite Cookie Bypass via BackgroundFetch", "url": "https://issues.chromium.org/issues/40057062", "status": "Assigned", "severity": "S3-Low", "component": "Blink>BackgroundFetch, Internals>Network>Cookies", "reporter": "la...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-08-28T11:14:13+00:00", "year": 2021, "attachment_count": 0, "local_path": "issues/40057062", "has_markdown": true }, { "id": "40057057", "title": "uaf in content::DesktopCaptureDevice::Core::AllocateAndStart", "url": "https://issues.chromium.org/issues/40057057", "status": "Assigned", "severity": "S3-Low", "component": "Internals>Media>ScreenCapture", "reporter": "wx...@gmail.com", "cve_ids": [], "bounty_amount": 10000.0, "reward_amount_meta": 10000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-08-27T22:40:15+00:00", "year": 2021, "attachment_count": 4, "local_path": "issues/40057057", "has_markdown": true }, { "id": "40057030", "title": "Security: RCE - Download Silently *.exe or *.dll to users Desktop or Downloads folder ", "url": "https://issues.chromium.org/issues/40057030", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Storage>FileSystem", "reporter": "ma...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-08-26T20:11:00+00:00", "year": 2021, "attachment_count": 4, "local_path": "issues/40057030", "has_markdown": true }, { "id": "40057026", "title": "Security: container-overflow in RecordEngagementMetric", "url": "https://issues.chromium.org/issues/40057026", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>Permissions>Prompts", "reporter": "me...@gmail.com", "cve_ids": [], "bounty_amount": 20000.0, "reward_amount_meta": 20000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-08-26T11:24:43+00:00", "year": 2021, "attachment_count": 7, "local_path": "issues/40057026", "has_markdown": true }, { "id": "40057025", "title": "Security: Cross-Origin information leak in GetDeveloperIdsTask", "url": "https://issues.chromium.org/issues/40057025", "status": "Assigned", "severity": "S3-Low", "component": "Blink>BackgroundFetch", "reporter": "so...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-08-26T09:31:48+00:00", "year": 2021, "attachment_count": 2, "local_path": "issues/40057025", "has_markdown": true }, { "id": "40057001", "title": "Security: UAF in AvailableOfflineContentProvider", "url": "https://issues.chromium.org/issues/40057001", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>Offline", "reporter": "hu...@gmail.com", "cve_ids": [], "bounty_amount": 15000.0, "reward_amount_meta": 15000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-08-24T23:59:35+00:00", "year": 2021, "attachment_count": 0, "local_path": "issues/40057001", "has_markdown": true }, { "id": "40056997", "title": "Security: heap-buffer-overflow in SelectFileDialogImpl::OnSelectFileExecuted", "url": "https://issues.chromium.org/issues/40056997", "status": "Assigned", "severity": "S3-Low", "component": "Internals>Cast>UI", "reporter": "ch...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-08-24T16:23:15+00:00", "year": 2021, "attachment_count": 3, "local_path": "issues/40056997", "has_markdown": true }, { "id": "40056991", "title": "Security: UAF in WebAppIdentityUpdate", "url": "https://issues.chromium.org/issues/40056991", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>WebAppInstalls", "reporter": "le...@gmail.com", "cve_ids": [], "bounty_amount": 7000.0, "reward_amount_meta": 7000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-08-24T10:04:48+00:00", "year": 2021, "attachment_count": 5, "local_path": "issues/40056991", "has_markdown": true }, { "id": "40056988", "title": "Security: heap-buffer-overflow in TabStripModel::MoveWebContentsAtImpl", "url": "https://issues.chromium.org/issues/40056988", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>TopChrome>TabStrip>ThumbnailTabStrip", "reporter": "ch...@gmail.com", "cve_ids": [], "bounty_amount": 10000.0, "reward_amount_meta": 10000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-08-23T23:40:01+00:00", "year": 2021, "attachment_count": 1, "local_path": "issues/40056988", "has_markdown": true }, { "id": "40056980", "title": "Security: History Cached Page of the Lens region search cause url spoof", "url": "https://issues.chromium.org/issues/40056980", "status": "Assigned", "severity": "S3-Low", "component": "Internals>Permissions>SearchEngineGeolocation, UI>Browser>Navigation, UI>Browser>Navigation>BFCache", "reporter": "0x...@gmail.com", "cve_ids": [], "bounty_amount": 2000.0, "reward_amount_meta": 2000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-08-23T15:05:46+00:00", "year": 2021, "attachment_count": 2, "local_path": "issues/40056980", "has_markdown": true }, { "id": "40056977", "title": "oob in function StartupPagesHandler::HandleEditStartupPage", "url": "https://issues.chromium.org/issues/40056977", "status": "Assigned", "severity": "S3-Low", "component": "UI>Settings", "reporter": "wx...@gmail.com", "cve_ids": [], "bounty_amount": 6000.0, "reward_amount_meta": 6000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-08-23T14:32:05+00:00", "year": 2021, "attachment_count": 3, "local_path": "issues/40056977", "has_markdown": true }, { "id": "40056972", "title": "Security: Manifest.json can display overlay on non-origin tabs", "url": "https://issues.chromium.org/issues/40056972", "status": "Accepted", "severity": "S3-Low", "component": "UI>Browser>WebAppInstalls>Android", "reporter": "te...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-08-23T09:03:02+00:00", "year": 2021, "attachment_count": 2, "local_path": "issues/40056972", "has_markdown": true }, { "id": "40056969", "title": "Security: Blink - Use After Free of DawnCallback.", "url": "https://issues.chromium.org/issues/40056969", "status": "Assigned", "severity": "S3-Low", "component": "Blink>WebGPU", "reporter": "lo...@gmail.com", "cve_ids": [], "bounty_amount": 7500.0, "reward_amount_meta": 7500.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-08-23T04:24:53+00:00", "year": 2021, "attachment_count": 4, "local_path": "issues/40056969", "has_markdown": true }, { "id": "40056968", "title": "Heap-use-after-free in ui::SendDamagedRectsRecursive", "url": "https://issues.chromium.org/issues/40056968", "status": "Assigned", "severity": "S3-Low", "component": "Internals>Compositing", "reporter": "cl...@chromium.org", "cve_ids": [], "bounty_amount": 16000.0, "reward_amount_meta": 16000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-08-23T03:52:30+00:00", "year": 2021, "attachment_count": 0, "local_path": "issues/40056968", "has_markdown": true }, { "id": "40056951", "title": "SUMMARY: AddressSanitizer: heap-use-after-free Runtime.cpp:439 in v8_inspector::protocol::Runtime::Frontend::exceptionThrown", "url": "https://issues.chromium.org/issues/40056951", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript", "reporter": "m....@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-08-20T15:32:10+00:00", "year": 2021, "attachment_count": 1, "local_path": "issues/40056951", "has_markdown": true }, { "id": "40056936", "title": "Security: Page can use space key input to cause autofill prompt to render under cursor, bypasses mouse movement/designated keyboard input requirements for autofill", "url": "https://issues.chromium.org/issues/40056936", "status": "Accepted", "severity": "S3-Low", "component": "UI>Browser>Autofill", "reporter": "al...@alesandroortiz.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-08-19T20:33:23+00:00", "year": 2021, "attachment_count": 2, "local_path": "issues/40056936", "has_markdown": true }, { "id": "40056924", "title": "Security: \"Origin\" header incorrectly set for cross-site request via service worker", "url": "https://issues.chromium.org/issues/40056924", "status": "Assigned", "severity": "S3-Low", "component": "Blink>ServiceWorker, UI>Browser>Navigation", "reporter": "ho...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-08-18T21:33:45+00:00", "year": 2021, "attachment_count": 8, "local_path": "issues/40056924", "has_markdown": true }, { "id": "40056923", "title": "Security: [ANGLE] Stack buffer overwrite in rx::StateManager11::syncVertexBuffersAndInputLayout", "url": "https://issues.chromium.org/issues/40056923", "status": "Assigned", "severity": "S3-Low", "component": "Internals>GPU>ANGLE", "reporter": "ne...@nesk.kr", "cve_ids": [], "bounty_amount": 7500.0, "reward_amount_meta": 7500.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-08-18T18:30:14+00:00", "year": 2021, "attachment_count": 5, "local_path": "issues/40056923", "has_markdown": true }, { "id": "40056920", "title": "Chrome ANGLE Out-of-Bound in texStorage3D", "url": "https://issues.chromium.org/issues/40056920", "status": "Assigned", "severity": "S3-Low", "component": "Blink>WebGL, Internals>GPU>ANGLE", "reporter": "sj...@gmail.com", "cve_ids": [], "bounty_amount": 7500.0, "reward_amount_meta": 7500.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-08-18T14:40:08+00:00", "year": 2021, "attachment_count": 4, "local_path": "issues/40056920", "has_markdown": true }, { "id": "40056909", "title": "Security: UAF in EditAddressProfileView::WindowClosing", "url": "https://issues.chromium.org/issues/40056909", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>Autofill", "reporter": "jt...@gmail.com", "cve_ids": [], "bounty_amount": 17000.0, "reward_amount_meta": 17000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-08-18T04:35:10+00:00", "year": 2021, "attachment_count": 3, "local_path": "issues/40056909", "has_markdown": true }, { "id": "40056900", "title": "Security: Page can cause autofill prompt to render under cursor in order to bypass mouse movement/keyboard input requirements for autofill", "url": "https://issues.chromium.org/issues/40056900", "status": "Assigned", "severity": "S3-Low", "component": "Privacy", "reporter": "al...@alesandroortiz.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-08-17T04:15:04+00:00", "year": 2021, "attachment_count": 9, "local_path": "issues/40056900", "has_markdown": true }, { "id": "40056896", "title": "javascript URL is broken in ChromeCustom tab for Android Apps", "url": "https://issues.chromium.org/issues/40056896", "status": "Assigned", "severity": "S3-Low", "component": "Mobile>Intents, UI>Browser>Mobile>CustomTabs", "reporter": "as...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-08-16T07:24:59+00:00", "year": 2021, "attachment_count": 0, "local_path": "issues/40056896", "has_markdown": true }, { "id": "40056885", "title": "Security: Web GPU - Out of bound object manupilation in WebGPUImplementation::OnGpuControlReturnData()", "url": "https://issues.chromium.org/issues/40056885", "status": "Assigned", "severity": "S3-Low", "component": "Blink>WebGPU", "reporter": "lo...@gmail.com", "cve_ids": [], "bounty_amount": 7500.0, "reward_amount_meta": 7500.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-08-15T00:29:12+00:00", "year": 2021, "attachment_count": 2, "local_path": "issues/40056885", "has_markdown": true }, { "id": "40056879", "title": "Security: Insufficient CORS Check Leads to Cross-Origin Size Leak via BackgroundFetch API", "url": "https://issues.chromium.org/issues/40056879", "status": "Assigned", "severity": "S3-Low", "component": "Blink>BackgroundFetch", "reporter": "la...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-08-13T19:58:45+00:00", "year": 2021, "attachment_count": 0, "local_path": "issues/40056879", "has_markdown": true }, { "id": "40056878", "title": "use after free in DiceTurnSyncOnHelperDelegateImpl::ShowEnterpriseAccountConfirmation(", "url": "https://issues.chromium.org/issues/40056878", "status": "Assigned", "severity": "S3-Low", "component": "Unknown", "reporter": "wx...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-08-13T12:00:57+00:00", "year": 2021, "attachment_count": 0, "local_path": "issues/40056878", "has_markdown": true }, { "id": "40056871", "title": "use after free in sharing_hub::ScreenshotCapturedBubbleController::Capture", "url": "https://issues.chromium.org/issues/40056871", "status": "Accepted", "severity": "S3-Low", "component": "UI>Browser>Sharing", "reporter": "wx...@gmail.com", "cve_ids": [], "bounty_amount": 10000.0, "reward_amount_meta": 10000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-08-13T07:38:05+00:00", "year": 2021, "attachment_count": 4, "local_path": "issues/40056871", "has_markdown": true }, { "id": "40056870", "title": "Security: Pointer lock can be used to bypass mouse movement/keyboard input requirements for autofill", "url": "https://issues.chromium.org/issues/40056870", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Input>PointerLock, UI>Browser>Autofill", "reporter": "al...@alesandroortiz.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-08-13T06:09:28+00:00", "year": 2021, "attachment_count": 5, "local_path": "issues/40056870", "has_markdown": true }, { "id": "40056868", "title": "Security: UAF in dav1d_get_bits function", "url": "https://issues.chromium.org/issues/40056868", "status": "Assigned", "severity": "S4-Minimal", "component": "Internals>Media>Codecs", "reporter": "ha...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-08-13T03:06:33+00:00", "year": 2021, "attachment_count": 1, "local_path": "issues/40056868", "has_markdown": true }, { "id": "40056857", "title": "Security: UaF in TabStripModel::MoveWebContentsAtImpl", "url": "https://issues.chromium.org/issues/40056857", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>TopChrome>TabStrip, UI>Browser>TopChrome>TabStrip>TabGroups", "reporter": "ch...@gmail.com", "cve_ids": [], "bounty_amount": 10000.0, "reward_amount_meta": 10000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-08-12T01:16:26+00:00", "year": 2021, "attachment_count": 2, "local_path": "issues/40056857", "has_markdown": true }, { "id": "40056854", "title": "Android Chrome & Chromium Browsers Address Bar Spoofing", "url": "https://issues.chromium.org/issues/40056854", "status": "Assigned", "severity": "S3-Low", "component": "Internals>Compositing, Internals>Sandbox>SiteIsolation, UI>Browser>Navigation", "reporter": "sh...@gmail.com", "cve_ids": [], "bounty_amount": 3000.0, "reward_amount_meta": 3000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-08-11T19:41:31+00:00", "year": 2021, "attachment_count": 4, "local_path": "issues/40056854", "has_markdown": true }, { "id": "40056849", "title": "Security: Refcount overflow in RefCountedThreadSafeBase", "url": "https://issues.chromium.org/issues/40056849", "status": "Accepted", "severity": "S3-Low", "component": "Internals>Core", "reporter": "so...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-08-11T05:06:00+00:00", "year": 2021, "attachment_count": 0, "local_path": "issues/40056849", "has_markdown": true }, { "id": "40056848", "title": "Security: Share dialog on Windows can render over address bar, window controls", "url": "https://issues.chromium.org/issues/40056848", "status": "Accepted", "severity": "S3-Low", "component": "Blink>WebShare", "reporter": "al...@alesandroortiz.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-08-11T03:51:08+00:00", "year": 2021, "attachment_count": 4, "local_path": "issues/40056848", "has_markdown": true }, { "id": "40056840", "title": "Security: Chrome incorrectly interprets newlines in HTTP headers in HTTP/3, allowing for some header splitting possibilities", "url": "https://issues.chromium.org/issues/40056840", "status": "Accepted", "severity": "S3-Low", "component": "Internals>Network>QUIC", "reporter": "on...@gmail.com", "cve_ids": [], "bounty_amount": 1000.0, "reward_amount_meta": 1000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-08-10T11:13:00+00:00", "year": 2021, "attachment_count": 0, "local_path": "issues/40056840", "has_markdown": true }, { "id": "40056839", "title": "Security: heap-use-after-free in in download::NetworkStatusListenerImpl::OnNetworkStatusReady", "url": "https://issues.chromium.org/issues/40056839", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>Downloads", "reporter": "yu...@gmail.com", "cve_ids": [], "bounty_amount": 20000.0, "reward_amount_meta": 20000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-08-10T08:26:13+00:00", "year": 2021, "attachment_count": 4, "local_path": "issues/40056839", "has_markdown": true }, { "id": "40056837", "title": "container-overflow in blink::UserMediaProcessor::DetermineExistingAudioSessionId", "url": "https://issues.chromium.org/issues/40056837", "status": "Assigned", "severity": "S3-Low", "component": "Blink>GetUserMedia", "reporter": "em...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-08-10T04:46:51+00:00", "year": 2021, "attachment_count": 10, "local_path": "issues/40056837", "has_markdown": true }, { "id": "40056819", "title": "Security: v8 CHECK Failed IsStruct_NonInline in Torgue Struct-Tq-Inl", "url": "https://issues.chromium.org/issues/40056819", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript>Runtime", "reporter": "re...@yahoo.de", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-08-08T08:10:46+00:00", "year": 2021, "attachment_count": 2, "local_path": "issues/40056819", "has_markdown": true }, { "id": "40056812", "title": " TALOS-2021-1352: Google Chrome Blink setBaseAndExtent use after free vulnerability", "url": "https://issues.chromium.org/issues/40056812", "status": "Assigned", "severity": "S3-Low", "component": "Blink>Editing>Selection", "reporter": "ma...@gmail.com", "cve_ids": [], "bounty_amount": 7500.0, "reward_amount_meta": 7500.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-08-06T19:04:12+00:00", "year": 2021, "attachment_count": 2, "local_path": "issues/40056812", "has_markdown": true }, { "id": "40056781", "title": "Security: UAF in Screens::UpdateScreenInfos due to iterator invalidation", "url": "https://issues.chromium.org/issues/40056781", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>WebAppInstalls", "reporter": "hu...@gmail.com", "cve_ids": [], "bounty_amount": 7500.0, "reward_amount_meta": 7500.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-08-04T19:51:47+00:00", "year": 2021, "attachment_count": 0, "local_path": "issues/40056781", "has_markdown": true }, { "id": "40056780", "title": "Security: BigInt ToStringFormatter Crash ", "url": "https://issues.chromium.org/issues/40056780", "status": "Accepted", "severity": "S3-Low", "component": "Blink>JavaScript", "reporter": "re...@yahoo.de", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-08-04T19:28:26+00:00", "year": 2021, "attachment_count": 0, "local_path": "issues/40056780", "has_markdown": true }, { "id": "40056776", "title": "Security: Extensions with debugger permission can list URLs and send commands to incognito tabs and other profile tabs", "url": "https://issues.chromium.org/issues/40056776", "status": "Assigned", "severity": "S3-Low", "component": "Platform>DevTools, Platform>Extensions", "reporter": "al...@alesandroortiz.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-08-04T03:47:35+00:00", "year": 2021, "attachment_count": 3, "local_path": "issues/40056776", "has_markdown": true }, { "id": "40056774", "title": "AddressSanitizer: heap-buffer-overflow mojo::internal::Serializer::Serialize", "url": "https://issues.chromium.org/issues/40056774", "status": "Assigned", "severity": "S3-Low", "component": "Blink>ShapeDetection, Internals>Core, Internals>Mojo>Bindings", "reporter": "m....@gmail.com", "cve_ids": [], "bounty_amount": 7500.0, "reward_amount_meta": 7500.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-08-04T02:51:42+00:00", "year": 2021, "attachment_count": 3, "local_path": "issues/40056774", "has_markdown": true }, { "id": "40056766", "title": "Security: heap-use-after-free in ~PermissionRequestChip", "url": "https://issues.chromium.org/issues/40056766", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>Permissions>Prompts", "reporter": "me...@gmail.com", "cve_ids": [], "bounty_amount": 10000.0, "reward_amount_meta": 10000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-08-03T05:38:51+00:00", "year": 2021, "attachment_count": 3, "local_path": "issues/40056766", "has_markdown": true }, { "id": "40056756", "title": "use after free in blink::FrameLoader::DetachDocument", "url": "https://issues.chromium.org/issues/40056756", "status": "Assigned", "severity": "S3-Low", "component": "Blink>GarbageCollection, Blink>Internals>WTF, Blink>Loader, UI>Browser>Navigation", "reporter": "em...@gmail.com", "cve_ids": [], "bounty_amount": 7500.0, "reward_amount_meta": 7500.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-08-02T13:53:09+00:00", "year": 2021, "attachment_count": 2, "local_path": "issues/40056756", "has_markdown": true }, { "id": "40056733", "title": "Security: [ANGLE] Heap use-after-free in TextureD3D::releaseTexStorage", "url": "https://issues.chromium.org/issues/40056733", "status": "Assigned", "severity": "S3-Low", "component": "Internals>GPU>ANGLE", "reporter": "gg...@gmail.com", "cve_ids": [], "bounty_amount": 9500.0, "reward_amount_meta": 9500.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-07-30T17:30:29+00:00", "year": 2021, "attachment_count": 1, "local_path": "issues/40056733", "has_markdown": true }, { "id": "40056730", "title": "v8/Turbofan: Wrong optimization of bitfield checks", "url": "https://issues.chromium.org/issues/40056730", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript>Compiler", "reporter": "ma...@gmail.com", "cve_ids": [], "bounty_amount": 21000.0, "reward_amount_meta": 21000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-07-30T13:49:10+00:00", "year": 2021, "attachment_count": 3, "local_path": "issues/40056730", "has_markdown": true }, { "id": "40056729", "title": "v8/Turbofan: Invalid rotate-right optimization + Typer hardening bypass", "url": "https://issues.chromium.org/issues/40056729", "status": "Assigned", "severity": "S3-Low", "component": "Blink>JavaScript>Compiler", "reporter": "ma...@gmail.com", "cve_ids": [], "bounty_amount": 21000.0, "reward_amount_meta": 21000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-07-30T13:43:58+00:00", "year": 2021, "attachment_count": 4, "local_path": "issues/40056729", "has_markdown": true }, { "id": "40056720", "title": "Use-after-Free in AudioDebugRecordingsHandler::StartAudioDebugRecordings", "url": "https://issues.chromium.org/issues/40056720", "status": "Assigned", "severity": "S3-Low", "component": "Blink>WebRTC, Platform>Extensions>API", "reporter": "et...@gmail.com", "cve_ids": [], "bounty_amount": 20000.0, "reward_amount_meta": 20000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-07-29T07:18:44+00:00", "year": 2021, "attachment_count": 4, "local_path": "issues/40056720", "has_markdown": true }, { "id": "40056717", "title": "Security: a READ memory access in jsimd_huff_encode_one_block_sse2", "url": "https://issues.chromium.org/issues/40056717", "status": "Accepted", "severity": "S4-Minimal", "component": "Internals>Images>Codecs", "reporter": "mu...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-07-29T05:55:37+00:00", "year": 2021, "attachment_count": 1, "local_path": "issues/40056717", "has_markdown": true }, { "id": "40056714", "title": "container overflow in Browser Process(PermissionUmaUtil::PermissionPromptResolved)", "url": "https://issues.chromium.org/issues/40056714", "status": "Assigned", "severity": "Unknown", "component": "UI>Browser>Permissions", "reporter": "em...@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-07-29T05:35:42+00:00", "year": 2021, "attachment_count": 2, "local_path": "issues/40056714", "has_markdown": true }, { "id": "40056709", "title": "Nearby Share UI incorrectly appears in non-ChromeOS browsers: causes UAF", "url": "https://issues.chromium.org/issues/40056709", "status": "Assigned", "severity": "S3-Low", "component": "UI>Browser>Sharing", "reporter": "wx...@gmail.com", "cve_ids": [], "bounty_amount": 15000.0, "reward_amount_meta": 15000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-07-28T17:17:35+00:00", "year": 2021, "attachment_count": 4, "local_path": "issues/40056709", "has_markdown": true }, { "id": "40056708", "title": "Use-after-Free in FileSystemChooseEntryFunction::FilesSelected", "url": "https://issues.chromium.org/issues/40056708", "status": "Assigned", "severity": "S3-Low", "component": "Platform>Extensions>API", "reporter": "et...@gmail.com", "cve_ids": [], "bounty_amount": 20000.0, "reward_amount_meta": 20000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-07-28T15:59:49+00:00", "year": 2021, "attachment_count": 8, "local_path": "issues/40056708", "has_markdown": true }, { "id": "40056706", "title": "Use-after-Free on HandleOnPerformDrop", "url": "https://issues.chromium.org/issues/40056706", "status": "Assigned", "severity": "S3-Low", "component": "Blink>DataTransfer", "reporter": "et...@gmail.com", "cve_ids": [], "bounty_amount": 20000.0, "reward_amount_meta": 20000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-07-28T14:03:48+00:00", "year": 2021, "attachment_count": 3, "local_path": "issues/40056706", "has_markdown": true }, { "id": "40056704", "title": "Use-after-Free on AudioDebugRecordingsHandler::StopAudioDebugRecordings", "url": "https://issues.chromium.org/issues/40056704", "status": "Assigned", "severity": "S3-Low", "component": "Blink>WebRTC, Platform>Extensions>API", "reporter": "et...@gmail.com", "cve_ids": [], "bounty_amount": 20000.0, "reward_amount_meta": 20000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-07-28T12:38:11+00:00", "year": 2021, "attachment_count": 5, "local_path": "issues/40056704", "has_markdown": true }, { "id": "40056683", "title": "Type confusion in blink::StyleBuilderConverterBase::ConvertFontSize Security DCHECK failed: IsA(from). ", "url": "https://issues.chromium.org/issues/40056683", "status": "Assigned", "severity": "S3-Low", "component": "Blink>CSS", "reporter": "m....@gmail.com", "cve_ids": [], "bounty_amount": 5000.0, "reward_amount_meta": 5000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-07-27T09:20:38+00:00", "year": 2021, "attachment_count": 2, "local_path": "issues/40056683", "has_markdown": true }, { "id": "40056682", "title": "Security: Out of bounds memory access in BigInt", "url": "https://issues.chromium.org/issues/40056682", "status": "Assigned", "severity": "S4-Minimal", "component": "Blink>JavaScript", "reporter": "p4...@gmail.com", "cve_ids": [], "bounty_amount": 15000.0, "reward_amount_meta": 15000.0, "public_issue": true, "inclusion_reason": "reward_amount_meta", "award_text_found": false, "created_date": "2021-07-27T07:03:09+00:00", "year": 2021, "attachment_count": 1, "local_path": "issues/40056682", "has_markdown": true }, { "id": "40056681", "title": "Referrer Spoof using and