| 981114 | Security: BT Classic Pairing Hijack | - | 2020-07-08 |
| 1059955 | dawn_wire_server_and_vulkan_backend_fuzzer: Heap-use-after-free in vk::CommandBuffer::submit | - | 2020-07-08 |
| 1061933 | aec3_fuzzer: Container-overflow in webrtc::FilterAnalyzer::AnalyzeRegion | - | 2020-07-08 |
| 1061235 | Security: libcameraservice: heap-based-buffer-overflow-in-DepthPhotoProcessor | - | 2020-07-07 |
| 1064429 | Heap-use-after-free in PrefChangeRegistrar::~PrefChangeRegistrar | - | 2020-07-07 |
| 1065704 | Security: UAF in WebSocket Network Service | $20000 | 2020-07-07 |
| 1065772 | ProbeForLowSeverityLifetimeIssue in ~CXFA_FFPageWidgetIterator() | - | 2020-07-07 |
| 1058895 | Security: Slow Read HTTP Attack | $500 | 2020-07-06 |
| 1040755 | Security: Another "universal" XSS via copy&paste | $2000 | 2020-07-03 |
| 1062868 | heap-use-after-free : v8::internal::wasm::WasmCode::DecrementRefCount | - | 2020-07-03 |
| 1064898 | Heap-use-after-free in metrics::PerfOutputCall::OnGetPerfOutput | - | 2020-07-03 |
| 978632 | heap-use-after-free : sctp_release_pr_sctp_chunk | - | 2020-07-02 |
| 990581 | Security: Security: CSP does not propagate to blob: URIs | $500 | 2020-07-02 |
| 1060559 | [Web NFC] Block YubiKeys | - | 2020-07-02 |
| 1061682 | Security DCHECK failure: IsA<Derived>(from) in casting.h | - | 2020-07-02 |
| 1019161 | UAF In ProcessManager | $7500 | 2020-07-01 |
| 1064112 | Segv on unknown address in blink::Internals::getAgentId | - | 2020-07-01 |
| 1067270 | Talos Security Advisory for Google Chrome PDFium (TALOS-2020-1044) | $5000 | 2020-07-01 |
| 1063177 | Declarative Net Request: Potential use after free while reindexing rulesets. | - | 2020-06-30 |
| 1054229 | media_pipeline_integration_fuzzer: Use-of-uninitialized-value in ogg_find_codec | - | 2020-06-28 |
| 1059764 | Security: container-overflow in MediaStream mojo | - | 2020-06-26 |
| 1060549 | Security: PDFium heap-use-after-free in CPDFXFA_Page::GetNextXFAAnnot (XFA) | $7500 | 2020-06-26 |
| 1062247 | Incomplete fix of 1055788 and 1057627 | - | 2020-06-26 |
| 1032531 | CrOS: Vulnerability reported in dev-db/sqlite | - | 2020-06-25 |
| 1034223 | CrOS: Vulnerability reported in dev-db/sqlite | - | 2020-06-25 |
| 1035370 | CrOS: Vulnerability reported in dev-db/sqlite | - | 2020-06-25 |
| 1037730 | Security: Full screen notification overlap on Windows and Linux | $500 | 2020-06-25 |
| 1038580 | CrOS: Vulnerability reported in dev-db/sqlite | - | 2020-06-25 |
| 1038884 | CrOS: Vulnerability reported in dev-db/sqlite | - | 2020-06-25 |
| 1040055 | CrOS: Vulnerability reported in dev-db/sqlite | - | 2020-06-25 |
| 1040488 | CrOS: Vulnerability reported in dev-db/sqlite | - | 2020-06-25 |
| 1052647 | Security: Debug check failed: !context.get(context_entry).IsTheHole(isolate) | - | 2020-06-24 |
| 1061878 | dawn_wire_server_and_vulkan_backend_fuzzer: Heap-use-after-free in vk::CommandPool::destroy | - | 2020-06-24 |
| 1059533 | use-after-free in web_graphics_context_3d_provider_wrapper | $2000 | 2020-06-23 |
| 933171 | Trusted Types bypass with blob and meta refresh | - | 2020-06-20 |
| 933172 | Trusted Type bypass with SVG | - | 2020-06-20 |
| 1004106 | Security: heap-buffer-overflow in CFXJSE_FormCalcContext::unfoldArgs | $7500 | 2020-06-20 |
| 1020026 | Security: 'Press Esc to exit fullscreen' covered up by a popup page | $1000 | 2020-06-20 |
| 1030901 | Site Isolation Bypass: QuotaDispatcherHost doesn't properly check origin from renderer | - | 2020-06-20 |
| 1042210 | Security: fullscreen notification spoof (repro issue 882812) | $500 | 2020-06-20 |
| 1045787 | Security: ChromeDriver is vulnerable to CSRF attack | - | 2020-06-20 |
| 1055303 | Security: PDFium (XFA) Use uninitialized value in function CPDFSDK_FormFillEnvironment::SendOnFocusChange | - | 2020-06-20 |
| 1059669 | Out-of-bounds read in WebSQL | $3000 | 2020-06-20 |
| 1059686 | UaF in DeferredTaskHandler::BreakConnections(2) | - | 2020-06-20 |
| 1060548 | CrOS: Vulnerability reported in app-arch/libarchive | - | 2020-06-20 |
| 1060647 | Security: WebRTC certificate parsing | - | 2020-06-20 |
| 1061018 | UaF in DeferredTaskHandler::ProcessAutomaticPullNodes | - | 2020-06-20 |
| 1061154 | gpu_fuzzer: Crash in gpu::gles2::Texture::SetLevelInfo | - | 2020-06-20 |
| 1061231 | net_quic_stream_factory_fuzzer: Use-of-uninitialized-value in quic::QuicSentPacketManager::GetRetransmissionTime | - | 2020-06-20 |
| 1061389 | gpu_fuzzer.exe: Crash in base::subtle::RefCountedBase::ReleaseImpl | - | 2020-06-20 |
| 1058515 | Chrome fetches DevTools stuff using insecure http protocol | - | 2020-06-16 |
| 1059349 | Security: usersctp: out-of-bounds reads in sctp_load_addresses_from_init | - | 2020-06-16 |
| 1059472 | v8_wasm_compile_fuzzer: DCHECK failure in is_gp() in liftoff-register.h | - | 2020-06-16 |
| 1030909 | Site Isolation Bypass: DedicatedWorkerHostFactory doesn't properly check origin from renderer | - | 2020-06-15 |
| 1046021 | CrOS: Vulnerability reported in media-libs/opencv | - | 2020-06-15 |
| 1055524 | Not only "devools://" but also "chrome-devtools://" should be registered as display-isolated | - | 2020-06-15 |
| 1056222 | MojoVideoEncodeAcceleratorService allows renderer to misuse its API leading to UAF | - | 2020-06-15 |
| 785159 | Wrong origin shown for permission prompts after navigations that lead to interstitials | $500 | 2020-06-13 |
| 1054966 | Policy page opens a file dialogue even if the AllowFileSelectionDialogs policy is set to false | $500 | 2020-06-13 |
| 1059187 | Bad-cast to blink::LayoutBlock from blink::LayoutTableSection in blink::AXLayoutObject::IsDataTable | - | 2020-06-13 |
| 1057418 | skia_image_filter_proto_fuzzer: Use-of-uninitialized-value in sse2::repeat_y | - | 2020-06-12 |
| 1058653 | Security: PDFium heap-use-after-free in CFDE_TextEditEngine::ReplaceSelectedText (XFA) | $5000 | 2020-06-12 |
| 1054732 | Heap-use-after-free in test_runner::WebFrameTestClient::DidAddMessageToConsole | - | 2020-06-10 |
| 1055869 | Security: PDFium (XFA) Use-after-free in function CFDE_TextEditEngine::ReplaceSelectedText | $5000 | 2020-06-10 |
| 1057593 | UaF in DeferredTaskHandler::BreakConnections | - | 2020-06-10 |
| 1057627 | UaP in AudioScheduledSourceHandler::NotifyEnded | - | 2020-06-10 |
| 1038527 | cras_rclient_message_fuzzer: Heap-use-after-free in cras_dsp_ini_free | - | 2020-06-09 |
| 1054260 | heap-use-after-free : content::FileChooserImpl::~FileChooserImpl | - | 2020-06-09 |
| 1057309 | use-after-move in BinaryUploadService::UploadForDeepScanning | - | 2020-06-09 |
| 1057369 | Use-of-uninitialized-value in double_conversion::DoubleToStringConverter::ToPrecision | - | 2020-06-09 |
| 1055131 | Crash in Builtins_ArgumentsAdaptorTrampoline | - | 2020-06-07 |
| 1056273 | Heap-use-after-free in test_runner::WebFrameTestClient::DidClearWindowObject | - | 2020-06-06 |
| 1056154 | Chromium: Vulnerability reported in third_party/sqlite | - | 2020-06-05 |
| 1056440 | Use-of-uninitialized-value in blink::WebGLRenderingContextBase::CreateWebGraphicsContext3DProvider | - | 2020-06-05 |
| 986108 | Security: PDFium heap-buffer-overflow in CFX_SkiaDeviceDriver::RestoreState | $1000 | 2020-06-04 |
| 1035315 | iframe sandbox allow_top_navigation_by_user_activation can be bypassed with certain extensions | $1000 | 2020-06-04 |
| 1055788 | UaP in IIRFilterHandler::Process | - | 2020-06-04 |
| 1056152 | CrOS: Vulnerability reported in app-arch/libarchive | - | 2020-06-04 |
| 1056153 | CrOS: Vulnerability reported in dev-libs/libpcre2 | - | 2020-06-04 |
| 965611 | Security: Possible to open chrome-native:// pages on Android and the new tab page on desktop using window.open | $1000 | 2020-06-03 |
| 976767 | Security: heap-use-after-free in CPDFSDK_PageView::ExitWidget | - | 2020-06-03 |
| 1034519 | Security: WebContentsViewAura::EndDrag may dereference a pointer to deleted RenderWidgetHost | - | 2020-06-03 |
| 1041406 | UAF in chrome!content::FrameTreeNode::~FrameTreeNode | $20000 | 2020-06-03 |
| 1054466 | v8_wasm_compile_fuzzer: DCHECK failure in is_fp_pair() == other.is_fp_pair() in liftoff-register.h | - | 2020-06-03 |
| 1055124 | Security DCHECK failure: IsA<Derived>(from) in casting.h | - | 2020-06-03 |
| 1055142 | Security DCHECK failure: IsA<Derived>(from) in casting.h | - | 2020-06-03 |
| 1055223 | Container-overflow in content::VizProcessTransportFactory::DisableGpuCompositing | - | 2020-06-03 |
| 1055338 | Crash in blink::CSSPropertyValueSet::PropertyReference::PropertyValue | - | 2020-06-03 |
| 1055692 | v8_wasm_code_fuzzer: Heap-buffer-overflow in v8::internal::wasm::ThreadImpl::Push | - | 2020-06-03 |
| 1056044 | ulpfec_generator_fuzzer: Heap-buffer-overflow in webrtc::ForwardErrorCorrection::GenerateFecPayloads | - | 2020-06-03 |
| 949913 | Use-after-free in CXFA_FFComboBox::OnProcessEvent | $3000 | 2020-06-02 |
| 1054765 | Heap-use-after-free in blink::MathMLSpaceElement::CollectStyleForPresentationAttribute | - | 2020-06-02 |
| 1055128 | Crash in blink::StyleBuilderConverter::ConvertFontVariantEastAsian | - | 2020-06-02 |
| 1055221 | Security DCHECK failure: IsA<Derived>(from) in casting.h | - | 2020-06-02 |
| 1055393 | UAF in chrome chrome!content::BrowserAccessibilityManager::GetFromAXNode | $20000 | 2020-06-02 |
| 1055713 | Segv on unknown address in blink::StyleBuilderConverterBase::ConvertFontFamily | - | 2020-06-02 |
| 1054139 | gpu_angle_passthrough_fuzzer: Null-dereference READ in gpu::gles2::GLES2DecoderPassthroughImpl::DoDrawArraysIndirect | - | 2020-05-30 |
| 982193 | Security: PDFium (XFA) Use-after-free in CXFA_FFTextEdit::OnProcessEvent | $5000 | 2020-05-29 |
| 1026991 | pdfium (XFA): invalid-vptr / uaf in CPDFSDK_PageView::ExitWidget | $5000 | 2020-05-29 |
| 1045803 | rtnl_handler_fuzzer: Crash in std::__1::enable_if<__is_cpp17_forward_iterator<unsigned char const*>::value, vo | - | 2020-05-29 |
| 1047838 | Missing browser-process permission checks for WebNFC | - | 2020-05-29 |
| 1050046 | ASSERT: CSA_ASSERT failed: SmiBelow(effective_index, LoadFixedArrayBaseLength(array)) | - | 2020-05-29 |
| 1054733 | Use-after-poison in blink::LayoutObject::ViewRect | - | 2020-05-29 |
| 1054785 | Bad-cast to blink::Node from invalid vptr in blink::LayoutObject::GetDocument | - | 2020-05-29 |
| 990897 | Security: PDFium (XFA) Use-after-free in CXFA_FFDocView::SetFocus | $7500 | 2020-05-28 |
| 1031152 | cras_rclient_message_fuzzer: Heap-buffer-overflow in dsp_util_deinterleave_s24le | - | 2020-05-28 |
| 1031153 | cras_rclient_message_fuzzer: Heap-buffer-overflow in cras_fmt_conv_create | - | 2020-05-28 |
| 1040329 | heap use-after-free in CFDE_TextEditEngine::Insert | $7500 | 2020-05-28 |
| 1051748 | Use-after-poison in WebGLRenderingContextBase | $8500 | 2020-05-28 |
| 1052651 | Security: PDFium (XFA) Use-after-free in CFWL_Edit::OnChar | $7500 | 2020-05-28 |
| 1052786 | Security: PDFium (XFA) Use-after-free in CXFA_FFTextEdit::UpdateFWLData | $7500 | 2020-05-28 |
| 1053617 | Security: PDFium heap-use-after-free in CFWL_DateTimePicker::SetEditText (XFA) | $7500 | 2020-05-28 |
| 1054429 | Security: PDFium heap-use-after-free in CFWL_Edit::OnKeyDown (XFA) | - | 2020-05-28 |
| 453937 | Cross origin access with exception object + full exploit | $25633 | 2020-05-27 |
| 583431 | Universal XSS in DocumentLoader::createWriterFor + full-chain exploit | $25633 | 2020-05-27 |
| 1041749 | Security: tel: protocal spoofing 2 | $500 | 2020-05-27 |
| 1050996 | Security: MediaElementAudioSourceNode bypasses CORS checks | $1000 | 2020-05-27 |
| 1051017 | Security: Type inference issue in Typer::Visitor::TypeInductionVariablePhi | - | 2020-05-27 |
| 1042566 | Security: Use After Free in Deserializer::DeserializeDeferredObjects | - | 2020-05-26 |
| 1051368 | navigator.sendBeacon doesn't make CORS preflight request | - | 2020-05-26 |
| 1051439 | Security: sendBeacon allows sending arbitrary POST requests with application/octet-stream content type without CORS | - | 2020-05-26 |
| 1034023 | Check Raw Clipboard permission and feature flag browser-side | - | 2020-05-24 |
| 1041330 | Security: use-of-uninitialized-value in containsNoEmptyCheck | - | 2020-05-24 |
| 1040046 | Security: Investigate "Zero length" BIOS write protect range UMA reports | - | 2020-05-24 |
| 1045931 | Security: General check for streams not checking states correctly | - | 2020-05-24 |
| 1048555 | Use after free in CodeSerializer::Deserialize | $500 | 2020-05-24 |
| 1050011 | Security: URL Spoof in Android PageInfo | - | 2020-05-24 |
| 1051075 | libipp_fuzzer: Segv on unknown address in std::__1::__vector_base<ipp::StringWithLanguage, std::__1::allocator<ipp::String | - | 2020-05-24 |
| 1051564 | libipp_fuzzer: Segv on unknown address in std::__1::vector<std::__1::basic_string<char, std::__1::char_traits<char>, std:: | - | 2020-05-24 |
| 1051912 | DCHECK failure in 1 == map_.count(key) in wasm-engine.cc | - | 2020-05-24 |
| 1052442 | Windows: Potential UaF In Job Object Notification. | - | 2020-05-24 |
| 1052576 | CHECK failure: locale__value.IsString() in class-verifiers-tq.cc | - | 2020-05-24 |
| 995566 | Heap-use-after-free in ChromePasswordManagerClient::OnPaste | - | 2020-05-21 |
| 1048038 | Use after free in Logger::MapEvent | $500 | 2020-05-21 |
| 1003501 | PDFium (XFA) Use-after-free in CXFA_FFCheckButton::OnProcessEvent | $6000 | 2020-05-20 |
| 1044277 | Security: Possible to bypass restrictions on multiple downloads by initiating download from data: frame | $500 | 2020-05-20 |
| 1049510 | Unexpected reveal of service worker interception by using nextHopProtocol | $2000 | 2020-05-20 |
| 1050419 | Security: Use-after-poison in AudioWorkletNode | $7500 | 2020-05-20 |
| 1051462 | CrOS: Vulnerability reported in app-text/poppler | - | 2020-05-20 |
| 1049581 | Security: Debug check failed: bytecode_offset >= 0 (-1 vs. 0) | - | 2020-05-19 |
| 1050756 | Security: 'Copy As Curl' in the network panel of the devtools uses '--data' instead of '--data-raw', leading to arbitrary local file access | $500 | 2020-05-19 |
| 1033972 | Segv on unknown address in views::FocusSearch::FindNextFocusableView | - | 2020-05-16 |
| 1050090 | Fix security vulnerability in PaintController on subsequence under-invalidation | - | 2020-05-16 |
| 925834 | Security: seneschal allows bind-mounting arbitrary paths into 9p subtree | - | 2020-05-15 |
| 1043603 | use-after-poison in mojo::MessageDispatcher | $5000 | 2020-05-15 |
| 1048473 | Use-after-destroy in WebAudio | $7500 | 2020-05-15 |
| 1049129 | rtp_frame_reference_finder_fuzzer: Use-of-uninitialized-value in unsigned long webrtc::Subtract<32768ul> | - | 2020-05-15 |
| 998514 | Security: buffer overflow in modprobe | - | 2020-05-14 |
| 1036373 | CrOS: Vulnerability reported in dev-libs/openssl | - | 2020-05-14 |
| 1036376 | CrOS: Vulnerability reported in dev-libs/openssl | - | 2020-05-14 |
| 1044570 | Security: SEGV_MAPERR with Intl.ListFormat and long strings | $5000 | 2020-05-14 |
| 1047942 | CVE-2020-8428 CrOS: Vulnerability reported in Linux kernel | - | 2020-05-14 |
| 1031670 | ☂ Site Isolation Bypass via component extensions (e.g. via "Google Hangouts") | - | 2020-05-13 |
| 1045386 | CrOS: Vulnerability reported in sys-fs/e2fsprogs | - | 2020-05-13 |
| 1047911 | rtp_frame_reference_finder_fuzzer: Invalid-free in webrtc::RTPVideoHeader::GenericDescriptorInfo::~GenericDescriptorInfo | - | 2020-05-13 |
| 1047914 | pdfium (XFA): oob read / use-of-uninitialized-value in CXFA_Node::SetSelectedItems | $1000 | 2020-05-13 |
| 1047932 | rtp_frame_reference_finder_fuzzer: Crash in webrtc::RtpGenericFrameDescriptor::~RtpGenericFrameDescriptor | - | 2020-05-13 |
| 1048005 | rtp_frame_reference_finder_fuzzer: Bad parameters to --sanitizer-annotate-contiguous-container in webrtc::video_coding::RtpFrameObject::~RtpFrameObject | - | 2020-05-13 |
| 1048013 | rtp_frame_reference_finder_fuzzer: Invalid-free in webrtc::RTPVideoHeader::~RTPVideoHeader | - | 2020-05-13 |
| 1048024 | rtp_frame_reference_finder_fuzzer: Crash in absl::allocator_traits<std::__Cr::allocator<long> >::deallocate | - | 2020-05-13 |
| 1032158 | Security of some component extensions relies on untrustworthy MessageSender.id | - | 2020-05-12 |
| 1040700 | heap-use-after-free : v8::internal::ArrayBufferTracker::RegisterNew | - | 2020-05-12 |
| 1047285 | Security of media-router built-in extension relies on untrustworthy MessageSender.id | - | 2020-05-12 |
| 1048241 | v8_wasm_compile_fuzzer: Stack-buffer-overflow in v8::internal::wasm::LiftoffAssembler::VarState::is_reg | - | 2020-05-12 |
| 966507 | Possible Sec-Fetch-Site bypass via PaymentRequest | - | 2020-05-11 |
| 1046019 | CrOS: Vulnerability reported in app-arch/libarchive | - | 2020-05-11 |
| 639322 | Automation API leaks tab URLs | $500 | 2020-05-09 |
| 1010844 | CXFA_FFPageView Use After Free | $5000 | 2020-05-09 |
| 1041190 | CVE-2019-19927 CrOS: Vulnerability reported in Linux kernel | - | 2020-05-09 |
| 1042915 | pdfium (XFA): wrong object type in CXFA_FFPageView::GetPageViewRect | $1000 | 2020-05-09 |
| 1043965 | Security: Possible to navigate to extension resources not listed in web_accessible_resources | $1000 | 2020-05-09 |
| 1045225 | v8_wasm_compile_fuzzer: Stack-buffer-overflow in v8::internal::wasm::LiftoffAssembler::VarState::is_reg | - | 2020-05-09 |
| 1045487 | rtnl_handler_fuzzer: Heap-buffer-overflow in shill::ParseAttrs | - | 2020-05-09 |
| 1045738 | sqlite3_ossfuzz_fuzzer: Use-of-uninitialized-value in sqlite3Atoi64 | - | 2020-05-09 |
| 1046995 | rtp_frame_reference_finder_fuzzer.exe: Invalid-free in webrtc::RTPVideoHeader::~RTPVideoHeader | - | 2020-05-09 |
| 1047024 | rtp_frame_reference_finder_fuzzer: Heap-buffer-overflow in webrtc::video_coding::RtpFrameReferenceFinder::ManageFrameVp9 | - | 2020-05-09 |
| 1047054 | heap-buffer-underflow : content::DWriteFontLookupTableBuilder::CallbackOnTaskRunner::CallbackOnTaskRunner | - | 2020-05-09 |
| 1047095 | rtp_frame_reference_finder_fuzzer: Crash in absl::allocator_traits<std::__Cr::allocator<long long> >::deallocate | - | 2020-05-09 |
| 1047097 | PDFium: Apply fix for CVE-2020-8112 | - | 2020-05-09 |
| 1047156 | CVE-2019-18282 CrOS: Vulnerability reported in Linux kernel | - | 2020-05-09 |
| 1047165 | rtp_frame_reference_finder_fuzzer: Heap-buffer-overflow in webrtc::video_coding::RtpFrameReferenceFinder::ManageFrameVp9 | - | 2020-05-09 |
| 1047264 | rtp_frame_reference_finder_fuzzer: Bad parameters to --sanitizer-annotate-contiguous-container in webrtc::RtpGenericFrameDescriptor::~RtpGenericFrameDescriptor | - | 2020-05-09 |
| 1047355 | Crash in v8::internal::StringHasher::HashSequentialString<char> | - | 2020-05-09 |
| 1047368 | DCHECK failure in name->IsFlat() in factory.cc | - | 2020-05-09 |
| 851302 | UI/URL Spoofing by opening popups and putting the background page into fullscreen | $3000 | 2020-05-07 |
| 852645 | requestFullscreen should consume user activation to prevent UI/URL spoofing | $1000 | 2020-05-07 |
| 977872 | pdf_codec_tiff_fuzzer: Heap-buffer-overflow in null_convert | - | 2020-05-07 |
| 1047074 | DCHECK failure in Heap::IsLargeObject(obj) || Page::FromHeapObject(obj)->IsFlagSet(Page::SWEEP_TO_ | - | 2020-05-07 |
| 1006012 | Security: URL bar spoofing on iOS | $500 | 2020-05-06 |
| 1034225 | CVE-2019-19524 CrOS: Vulnerability reported in Linux kernel | - | 2020-05-06 |
| 1034228 | CVE-2019-19527 CrOS: Vulnerability reported in Linux kernel | - | 2020-05-06 |
| 1043443 | CrOS: Vulnerability reported in net-analyzer/tcpdump | - | 2020-05-06 |
| 1044331 | Use-after-poison in blink::SecurityContextInit::SecurityContextInit | - | 2020-05-06 |
| 1045812 | Heap-buffer-overflow in cc::ScrollTimeline::UpdateScrollerIdAndScrollOffsets | - | 2020-05-06 |
| 1045797 | Use-of-uninitialized-value in v8::internal::JSFunction::ToString | - | 2020-05-06 |
| 1045874 | Security: OOB access in ReadableStream::Close | - | 2020-05-06 |
| 1046026 | vtest_fuzzer: Heap-use-after-free in vrend_finish_context_switch | - | 2020-05-06 |
| 1046098 | Use-of-uninitialized-value in v8::internal::wasm::NativeModuleCache::GetStreamingCompilationOwnership | - | 2020-05-06 |
| 1046321 | CVE-2019-19332 CrOS: Vulnerability reported in Linux kernel | - | 2020-05-06 |
| 1045703 | transfer_cache_fuzzer: Crash in GrConvertPixels | - | 2020-05-03 |
| 1045719 | gpu_raster_swiftshader_fuzzer: Heap-buffer-overflow in void downsample_3_2<ColorTypeFilter_RGBA_F16> | - | 2020-05-03 |
| 1045721 | gpu_raster_angle_fuzzer: Heap-buffer-overflow in sse2::load_af16 | - | 2020-05-03 |
| 1045722 | gpu_raster_passthrough_fuzzer: Heap-buffer-overflow in SkRectMemcpy | - | 2020-05-03 |
| 1045723 | transfer_cache_fuzzer: Heap-buffer-overflow in SkData::PrivateNewWithCopy | - | 2020-05-03 |
| 1045757 | gpu_raster_swiftshader_fuzzer: Crash in void egl::Transfer< | - | 2020-05-03 |
| 1043070 | CrOS: Vulnerability reported in dev-db/sqlite | - | 2020-05-02 |
| 1043095 | dawn_wire_server_and_vulkan_backend_fuzzer: Null-dereference READ in dawn_native::DeviceBase::BaseDestructor | - | 2020-05-02 |
| 868145 | Security: Loading mixed content without insecure warning | $500 | 2020-05-01 |
| 1033824 | Security: Unquoted Path in user Chrome Updater registry key | - | 2020-05-01 |
| 1035271 | Security: 3D CSS transform and drop-shadow can draw over address bar | $3000 | 2020-05-01 |
| 1045388 | CVE-2020-7053 CrOS: Vulnerability reported in Linux kernel | - | 2020-05-01 |
| 1035399 | Security: Site Isolation bypass in BlobURLStoreImpl::Register | - | 2020-04-30 |
| 1041828 | Potential UaF in NavigationPredicator | - | 2020-04-30 |
| 1042091 | Warn Chrome on downloads of for all .HTA files | - | 2020-04-30 |
| 1042145 | Null-dereference READ in sqlite3VdbeExec | - | 2020-04-30 |
| 1042578 | Security: SQLite 3.30.1 CVE-2019-19923 - NULL pointer dereference (or incorrect results) | - | 2020-04-30 |
| 1042700 | Security: SQLite CVE-2019-19926 | $500 | 2020-04-30 |
| 1042879 | Security: Data race in AudioArray::Allocate can lead to OOB access | - | 2020-04-30 |
| 1042956 | pdfium (XFA): UAF in CXFA_Node::HasFlag | $5000 | 2020-04-30 |
| 1043508 | pdfium (XFA): wrong object type in CXFA_FFNotify::OpenDropDownList | $5000 | 2020-04-30 |
| 1043510 | pdfium (XFA): wild-addr-read in GetWordBreakProperty | $7500 | 2020-04-30 |
| 1044379 | Bad-cast to blink::WebMouseEvent from blink::WebGestureEvent in test_runner::EventSender::HandleInputEventOnViewOrPopup | - | 2020-04-30 |
| 1031479 | Security: Debug check failed: has_feedback_vector() | $2000 | 2020-04-28 |
| 1041222 | Container-overflow in PermissionRequestManager::GetDisplayNameOrOrigin | - | 2020-04-28 |
| 1042535 | Security: webrtc: out-of-bounds write in FEC extension processing | - | 2020-04-28 |
| 1042933 | Security: WebRTC: out-of-bounds write when updating layer info with frame marking extension | - | 2020-04-28 |
| 1039241 | Use-of-uninitialized-value in blink::ObjectPainter::PaintAllPhasesAtomically | - | 2020-04-27 |
| 1043530 | Use-of-uninitialized-value in v8::internal::GlobalHandles::NodeSpace<v8::internal::GlobalHandles::Node>::Relea | - | 2020-04-27 |
| 1025521 | Security: <portal>s with an autofocus element get focus | $500 | 2020-04-24 |
| 1029437 | pdfium (XFA): oob read+write in CFDE_TextEditEngine::AdjustGap | $5000 | 2020-04-24 |
| 1041411 | heap-buffer-overflow in HRTFKernel | $500 | 2020-04-24 |
| 1041546 | Security: linux shell has all inheritable capabilities set by default | - | 2020-04-24 |
| 1042254 | Security: More UaFs in WebAudio | - | 2020-04-24 |
| 1029829 | gpu_angle_passthrough_fuzzer: Null-dereference READ in gpu::gles2::GLES2DecoderPassthroughImpl::EmulatedDefaultFramebuffer::Blit | - | 2020-04-23 |
| 1030167 | Crash in v8::internal::Simulator::LoadStorePairHelper | - | 2020-04-23 |
| 1038828 | Heap-use-after-free in net::URLRequestContext::CreateRequest | - | 2020-04-23 |
| 1039470 | Heap-use-after-free in blink::NGPaintFragment::PopulateDescendants | - | 2020-04-23 |
| 1039869 | Leaking the URL of any cross-origin redirect through AppCache's network section and wildcards | $5000 | 2020-04-23 |
| 1040883 | Heap-use-after-free in blink::NGPaintFragment::LayoutObjectWillBeDestroyed | - | 2020-04-23 |
| 1041174 | Heap-use-after-free in views::NativeWidgetAura::Close | - | 2020-04-23 |
| 1031909 | SIGTRAP hit in JIT code (Builtins_InterpreterEntryTrampoline) | $2000 | 2020-04-21 |
| 1033771 | Security: Debug check failed: is_valid(value). | - | 2020-04-21 |
| 1034695 | third_party/sqlite version 3.30.1 is vulnerable | - | 2020-04-21 |
| 1037889 | From secure page it is navigating to insecure page. | $1000 | 2020-04-21 |
| 1038036 | Security: Cross-Origin (Partial) Status Code Leakage | $1000 | 2020-04-21 |
| 1040325 | CHECK failure: *old_buffer != memory_object->array_buffer() in wasm-objects.cc | $2000 | 2020-04-21 |
| 1040489 | CrOS: Vulnerability reported in app-editors/vim | - | 2020-04-21 |
| 1041210 | CHECK failure: Bytecode mismatch at offset 10 in interpreter.cc | - | 2020-04-21 |
| 1041240 | DCHECK failure in 0 <= length in factory.cc | - | 2020-04-21 |
| 1041303 | pdfium (XFA): use-of-uninitialized-value in CFWL_DateTimePicker::DrawWidget | $500 | 2020-04-21 |
| 1041616 | DCHECK failure in cache != this implies cache->outer_scope()->deserialized_scope_uses_external_cac | - | 2020-04-21 |
| 1062091 | Security: UAF in InstalledAppProviderImpl (Desktop) | $25000 | 2020-04-20 |
| 894477 | Security: Extensions can continue to temporarily execute code and access file after being uninstalled | $500 | 2020-04-18 |
| 997515 | Security: Use-after-free in CXFA_FFDocView::SetFocus | $5000 | 2020-04-18 |
| 1018677 | Security: heap-use-after-free in content::SpeechRecognizerImpl::Abort | $5000 | 2020-04-18 |
| 1020745 | Security: Roll expat to patch CVE-2019-18197, CVE-2019-13117, CVE-2019-13118 | $500 | 2020-04-18 |
| 1031679 | Container-overflow in PermissionRequestManager::GetDisplayNameOrOrigin | - | 2020-04-18 |
| 1030415 | DCHECK failure in !HasOptimizedCode() in js-objects.cc | - | 2020-04-18 |
| 1032677 | Crash in v8::internal::Isolate::GetCodeTracer | - | 2020-04-18 |
| 1033461 | sqlite3_select_expr_lpm_fuzzer: Heap-use-after-free in resetAccumulator | - | 2020-04-18 |
| 1037703 | Heap-use-after-free in webrtc::VideoRtpReceiver::OnGenerateKeyFrame | - | 2020-04-18 |
| 1036667 | Heap-use-after-free in blink::NGContainerFragmentBuilder::MoveOutOfFlowDescendantCandidatesToDescendant | - | 2020-04-18 |
| 1037872 | Security:Potential Use after free in the function PerfJitLogger::LogWriteDebugInfo | - | 2020-04-18 |
| 1038243 | Security DCHECK failure: !NeedsLayout() || LayoutBlockedByDisplayLock(DisplayLockLifecycleTarget::kChildr | - | 2020-04-18 |
| 1038489 | pdfium_xfa_fuzzer: Heap-use-after-free in CJX_Object::~CJX_Object | - | 2020-04-18 |
| 1038863 | Security: SQLite 3.30.1 vulnerabilities reported: CVE-2019-19880 and CVE-2019-19925 | - | 2020-04-18 |
| 1039059 | CVE-2019-19447 CrOS: Vulnerability reported in Linux kernel | - | 2020-04-18 |
| 1039159 | mediasource_MP4_FLAC_pipeline_integration_fuzzer: Use-of-uninitialized-value in decode_residuals | - | 2020-04-18 |
| 1040080 | Security: 'Copy As Curl' in the network panel of the devtools does not escape the HTTP method properly, leading to local code execution | $500 | 2020-04-18 |
| 1040403 | DCHECK failure in mode == JSHeapBroker::BrokerMode::kSerialized implies kind == kUnserializedReadO | - | 2020-04-18 |
| 1040444 | DCHECK failure in mode == JSHeapBroker::BrokerMode::kSerialized implies kind == kUnserializedReadO | - | 2020-04-18 |
| 1040493 | CVE-2019-20095 CrOS: Vulnerability reported in Linux kernel | - | 2020-04-18 |
| 633352 | Security: If two windows are in fullscreen at the same time they can navigate to different origins without fullscreen being exited automatically. | $1000 | 2020-04-15 |
| 803365 | Cookies with SameSite=Strict; are sent for link rel="prerender" when requested from 3rd party site | $2000 | 2020-04-15 |
| 959194 | Heap-use-after-free in net::HttpCache::Transaction::DoCacheWriteResponse | - | 2020-04-15 |
| 995081 | Security: PDFium (XFA) Use-after-free in CXFA_FFComboBox::OnKillFocus | $5000 | 2020-04-15 |
| 1029865 | heap-use-after-free : content::MediaInterfaceFactory::CreateVideoDecoder | - | 2020-04-15 |
| 1038019 | Heap-use-after-free in content::RenderProcessHostImpl::CreateCodeCacheHost | - | 2020-04-15 |
| 1038178 | Security: Missing deoptimization information for OptimizedFrame::Summarize | - | 2020-04-15 |
| 1039629 | Security: PDFium (XFA) Use-after-free in CXFA_FFComboBox::OnSelectChanged | $7500 | 2020-04-15 |
| 710190 | Security: Reloading the content of a changed file | - | 2020-04-14 |
| 809350 | Security: CORS bypassing by reusing CORS-successful Resources across SecurityOrigins on MemoryCache | - | 2020-04-14 |
| 991217 | Security: Memory access violations when setting a breakpoint at a specific location | - | 2020-04-14 |
| 991899 | Security: PDFium (XFA) Use-after-free in CXFA_FFWidget::OnKillFocus | $7500 | 2020-04-14 |
| 1014371 | Security: iframe sandbox can be worked around via javascript: links and window.opener | $3000 | 2020-04-14 |
| 1035464 | Heap-use-after-free in blink::NGOutOfFlowLayoutPart::Run | - | 2020-04-14 |
| 1021871 | cras_rclient_message_fuzzer: Null-dereference READ in pthread_create | - | 2020-04-13 |
| 1031697 | AutofillAssistantFacade.callerIsOnWhitelist() is not secure | - | 2020-04-13 |
| 609527 | Make sure active mixed content and broken-https subresources do something reasonable on weird origins | - | 2020-04-11 |
| 1034299 | media_pipeline_integration_fuzzer: Use-of-uninitialized-value in decode_residuals | - | 2020-04-11 |
| 1034480 | CVE-2019-19332: Security: kvm: OOB memory write via kvm_dev_ioctl_get_cpuid | - | 2020-04-11 |
| 1030411 | JavaScript injection via malicious WebExtension in CWS | $5000 | 2020-04-10 |
| 1030892 | Site Isolation Bypass: SpeechRecognitionDispatcherHost doesn't properly check origin from renderer | - | 2020-04-10 |
| 1033795 | UAF in blink::PaintLayer::CommonAncestor | $5000 | 2020-04-10 |
| 1035058 | Security: Autocomplete preview text leak #4: using ::first-line pseudo-element | $5000 | 2020-04-10 |
| 1036697 | CrOS: Vulnerability reported in dev-db/sqlite | - | 2020-04-09 |
| 1031142 | Security: ☂ Site Isolation Bypass and Browser Code execution with heap-use-after-free in DesktopMediaPickerController::WebContentsDestroyed | - | 2020-04-08 |
| 999114 | CVE-2019-15117 CrOS: Vulnerability reported in Linux kernel | - | 2020-04-07 |
| 999115 | CVE-2019-15118 CrOS: Vulnerability reported in Linux kernel | - | 2020-04-07 |
| 1034563 | Heap-use-after-free in views::BoundsAnimator::AnimationProgressed | - | 2020-04-07 |
| 1036604 | CVE-2019-19241 CrOS: Vulnerability reported in Linux kernel | - | 2020-03-30 |
| 714617 | Security: chrome.tabs.executeScript can reveal Chrome's profile path | $500 | 2020-03-28 |
| 1035779 | Security: heap-use-after-free in blink::BaseRenderingContext2D::DrawImageInternal | - | 2020-03-28 |
| 639173 | ignored TLS errors propagate from webview to main browser | $500 | 2020-03-27 |
| 959571 | Security: Mixed content state reset when navigating back | $500 | 2020-03-27 |
| 1033407 | Security:Potential Use after free in the function ProfilerListener::CodeCreateEvent | $2000 | 2020-03-27 |
| 1035371 | Chromium: Two Vulnerabilities reported in sqlite 3.30.1 | - | 2020-03-27 |
| 571546 | Security: Prompt boxes steal focus in popups | - | 2020-03-26 |
| 1025700 | CrOS: Vulnerability reported in media-libs/tiff | - | 2020-03-26 |
| 1028722 | sqlite3_shadow_table_fuzzer: Heap-buffer-overflow in sqlite3Fts3GetVarint | $3000 | 2020-03-26 |
| 1029002 | sqlite3_shadow_table_fuzzer: ASSERT: pWriter || bIgnoreEmpty | - | 2020-03-26 |
| 1029027 | sqlite3_shadow_table_fuzzer: Heap-buffer-overflow in sqlite3Fts3GetVarint | - | 2020-03-26 |
| 1029210 | sqlite3_shadow_table_fuzzer: Heap-buffer-overflow in sqlite3Fts3Incrmerge | - | 2020-03-26 |
| 1029506 | sqlite3_shadow_table_fuzzer: Use-of-uninitialized-value in fts3IncrmergeHintPop | - | 2020-03-26 |
| 1031112 | CVE-2019-17133 CrOS: Vulnerability reported in Linux kernel | - | 2020-03-26 |
| 1032170 | Use browser-side URL to verify if extension messaging connection is allowed | - | 2020-03-26 |
| 1033395 | Security:Wrong assumption lead to Use After Free in deserializer.cc | $500 | 2020-03-26 |
| 1034745 | Security: QuicStreamFactory incorrectly installs NullDecrypter | - | 2020-03-26 |
| 1035331 | DCHECK failure in !HAS_WEAK_HEAP_OBJECT_TAG(ptr_) in tagged-impl.h | - | 2020-03-26 |
| 1035373 | CVE-2019-19602 CrOS: Vulnerability reported in Linux kernel | - | 2020-03-26 |
| 1035723 | Security: Heap-use-after-free in PaintController::FinishCycle() related to devtools overlay | - | 2020-03-26 |
| 1032090 | pdfium: use-of-uninitialized-value in CRYPT_AESSetKey | $2000 | 2020-03-24 |
| 1033841 | Security: Debug check failed: IsNumber(). | - | 2020-03-23 |
| 1034394 | A null pointer dereference has been discovered in V8 compiler which affects the latest version. | $5000 | 2020-03-23 |
| 1015693 | net_quic_stream_factory_fuzzer: Heap-use-after-free in quic::QuicSpdyStreamBodyManager::ReadBody | - | 2020-03-21 |
| 1032422 | Security: pdfium(XFA) heap-use-after-free in CXFA_FFComboBox::OnProcessEvent | $5000 | 2020-03-21 |
| 1033974 | DCHECK failure in 0 <= at_least_space_for in objects.cc | - | 2020-03-21 |
| 1034167 | DCHECK failure in i::AllowHeapAllocation::IsAllowed() in api.cc | - | 2020-03-21 |
| 1023810 | use-after-poison in webaudio | $10000 | 2020-03-20 |
| 1029462 | use-after-free in AudioWorklet | $7500 | 2020-03-20 |
| 1029530 | CHECK failure: BigIntAsUintN of kRepWord64 (BigInt) cannot be changed to kRepWord32 in represen | - | 2020-03-20 |
| 1032548 | Security: heap-buffer-overflow in AudioDelayDSPKernel::Process | - | 2020-03-20 |
| 1033260 | Heap-use-after-free in net::VerifyWithGivenFlags | - | 2020-03-20 |
| 1026546 | Security: Steal any local picture when open a local html file | $1000 | 2020-03-19 |
| 1029375 | Security: extensions with downloads.open permission can execute code on the device using .fileloc files | $500 | 2020-03-19 |
| 1031895 | Security: ReadableStream::pipeTo do not check IsLockedStream | - | 2020-03-19 |
| 1032054 | Security: Debug check failed: IsAligned(ptr, kSlotDataAlignment) | - | 2020-03-19 |
| 1032906 | Use-of-uninitialized-value in v8::internal::Runtime_StringCompareSequence | - | 2020-03-19 |
| 1033092 | mediasource_MP4_FLAC_pipeline_integration_fuzzer: Use-of-uninitialized-value in decode_residuals | - | 2020-03-19 |
| 1013906 | Security: expose stored (in cache) cross-site response's size | $500 | 2020-03-18 |
| 1029612 | audio_decoder_fuzzer: Use-of-uninitialized-value in decode_residuals | - | 2020-03-18 |
| 1030381 | Crash in cc::LayerTreeImpl::TotalScrollOffset | - | 2020-03-18 |
| 1031653 | Security: heap-use-after-free in DesktopMediaPickerController::WebContentsDestroyed | - | 2020-03-18 |
| 1019732 | Make sure that NetworkService doesn't propagate HttpOnly cookies to a renderer process | - | 2020-03-17 |
| 1032534 | CVE-2019-19319 CrOS: Vulnerability reported in Linux kernel | - | 2020-03-17 |
| 922882 | Security: Possible load of unitialized memory in WebRtcAec_Create | - | 2020-03-16 |
| 1022044 | cups_ippreadio_fuzzer: Global-buffer-overflow in ippEnumString | - | 2020-03-14 |
| 1029054 | cups_ippreadio_fuzzer: Heap-buffer-overflow in _cupsStrAlloc | - | 2020-03-14 |
| 1030660 | CrOS: Vulnerability reported in net-analyzer/tcpdump | - | 2020-03-14 |
| 1031102 | CrOS: Vulnerability reported in app-arch/libarchive | - | 2020-03-14 |
| 1031523 | pdfium (XFA): oob read in HTMLSTR2Code | $2500 | 2020-03-14 |
| 875503 | Chrome notification system permits to a domain to request permissions for each 3rd level domain with no restriction | $500 | 2020-03-13 |
| 968303 | heap-use-after-free : base::RunLoop::Delegate::ShouldQuitWhenIdle | - | 2020-03-13 |
| 1027408 | Security: tel: URL scheme reference origin spoof on Windows and Linux | $2000 | 2020-03-12 |
| 1029414 | Security: The sharing dialog can appear over the wrong tab (spoof) | $2000 | 2020-03-12 |
| 1030583 | Negative size parameter to memcpy in CPDF_SecurityHandler::GetUserPassword | $500 | 2020-03-12 |
| 1030912 | v8_wasm_compile_fuzzer: Segv on unknown address in unsigned long v8::internal::Simulator::MemoryRead<unsigned long, unsigned long> | - | 2020-03-12 |
| 1029565 | pdfium (XFA): oob read in EncodeXML | $2000 | 2020-03-11 |
| 1029576 | Security: Debug check failed: 0 <= index && index < node->op()->ValueInputCount(). | - | 2020-03-11 |
| 1029617 | gpu_angle_passthrough_fuzzer: Null-dereference READ in gpu::gles2::GLES2DecoderPassthroughImpl::DoDeleteQueriesEXT | - | 2020-03-11 |
| 1018629 | Use-of-uninitialized-value in SkPngEncoder::onEncodeRows | - | 2020-03-10 |
| 1025470 | Security: Negative size passed to memcpy() in fts3NodeAddTerm (OOB read) | - | 2020-03-10 |
| 1025471 | Security: Negative size passed to memcpy() in fts3IncrmergePush | - | 2020-03-10 |
| 1025472 | Security: Memory leak in fts4, matchinfo() | - | 2020-03-10 |
| 1027426 | Security: UaF in BrowserTabStripController::AddNewTabInGroup() | - | 2020-03-10 |
| 1028152 | Heap-buffer-overflow in blink::FindBuffer::RangeFromBufferIndex | $3000 | 2020-03-10 |
| 1028208 | DCHECK failure in !is_compiled() || IsInterpreted() in js-objects.cc | - | 2020-03-10 |
| 1029338 | DCHECK failure in !name->AsIntegerIndex(&index) in lookup-inl.h | - | 2020-03-10 |
| 1025463 | Security: TFC2019 - Multiple issues in sqlite (Tracking Bug) | - | 2020-03-09 |
| 1028863 | v8: Wrong JIT code that triggers SIGTRAP at runtime | $5000 | 2020-03-09 |
| 1029129 | Crash in cc::LayerTreeImpl::TotalScrollOffset | - | 2020-03-09 |
| 1026911 | gpu_angle_passthrough_fuzzer: Null-dereference READ in gpu::error::Error gpu::gles2::GLES2DecoderPassthroughImpl::DoCommandsImpl<false> | - | 2020-03-07 |
| 1027065 | gpu_angle_passthrough_fuzzer: Null-dereference READ in gpu::gles2::GLES2DecoderPassthroughImpl::DoDeleteQueriesEXT | - | 2020-03-07 |
| 1027470 | gpu_angle_passthrough_fuzzer: Null-dereference READ in gpu::gles2::GLES2DecoderPassthroughImpl::HandleDrawBuffersEXTImmediate | - | 2020-03-07 |
| 1023807 | Update WHL microcode to enable kernel TAA mitigations | - | 2020-03-06 |
| 1025489 | use-after-poison in base::internal::WeakReferenceOwner::Invalidate() | $5000 | 2020-03-06 |
| 1028862 | Trap in Builtins_InterpreterEntryTrampoline | $5000 | 2020-03-06 |
| 1017871 | Security: Injecting styles via copy-and-paste | $10000 | 2020-03-05 |
| 1021431 | Heap-use-after-free in content::GpuBenchmarking::Freeze | - | 2020-03-05 |
| 1022278 | render_text_api_fuzzer: Heap-buffer-overflow in gfx::GetTextIndexForOtherText | - | 2020-03-05 |
| 1023843 | CVE-2019-2201: libjpeg-turbo: code execution | - | 2020-03-05 |
| 1024182 | Security: Arbitrary system memory access Intel GPU vulnerability (CVE-2019-0155) | - | 2020-03-05 |
| 1028172 | agc_fuzzer: Heap-buffer-overflow in webrtc::GainControlImpl::ProcessCaptureAudio | - | 2020-03-05 |
| 1029174 | DCHECK failure in *result == *match_info in js-regexp.cc | - | 2020-03-05 |
| 1029200 | Crash in v8::internal::OrderedHashSet::ConvertToKeysArray | - | 2020-03-05 |
| 708595 | Security: Print Preview allows spoofing on other tab | $500 | 2020-03-04 |
| 1026994 | Security: EC host commands leaking stack to AP userspace | - | 2020-03-04 |
| 1027025 | DCHECK failure in *(maybe_code_handler.object()) == *StoreHandler::StoreSlow(GetIsolate()) in feed | - | 2020-03-04 |
| 1027176 | Check feature policy for payment in the browser. | - | 2020-03-04 |
| 1028809 | audio_processing_fuzzer: Use-of-uninitialized-value in webrtc::FloatToFloatS16 | - | 2020-03-04 |
| 1028614 | audio_processing_fuzzer: Use-of-uninitialized-value in webrtc::FileWrapper::Write | - | 2020-03-04 |
| 990428 | Tighten IDN policy for Kana + Latin domains | - | 2020-03-03 |
| 1016506 | heap-buffer-overflow : WebRtcSpl_DownsampleFastC | - | 2020-03-03 |
| 1023095 | zucchini_disassembler_elf_fuzzer: Heap-buffer-overflow in zucchini::Rel32FinderX86::Scan | - | 2020-03-03 |
| 1023183 | zucchini_disassembler_elf_fuzzer: Heap-buffer-overflow in (std::is_function<std::__Cr::remove_pointer<unsigned | - | 2020-03-03 |
| 1025255 | hammerd_load_ec_image_fuzzer: Crash in hammerd::FirmwareUpdater::LoadEcImage | - | 2020-03-03 |
| 1025464 | Security: SQLite defense-in-depth bypass | - | 2020-03-03 |
| 1025465 | Security: Uninitialized memory leak by nPrefix in fts3SegReaderNext | - | 2020-03-03 |
| 1025466 | Security: Arbitrary memory overwrites (write-what-where) by nHeight in fts3IncrmergeLoad | - | 2020-03-03 |
| 1026729 | DCHECK failure in !name->AsIntegerIndex(&index) in lookup-inl.h | - | 2020-03-03 |
| 1026909 | DCHECK failure in name.IsUniqueName() in stub-cache.cc | - | 2020-03-03 |
| 1027109 | DCHECK failure in heap_object.IsInternalizedString() in feedback-vector.cc | - | 2020-03-03 |
| 1027498 | CHECK failure: 0 == instance_descriptors().number_of_slack_descriptors() in objects-debug.cc | - | 2020-03-03 |
| 1027926 | Security: v8 Debug check failed: ResumeJumpTargetsAreValid(). | - | 2020-03-03 |
| 1028092 | agc_fuzzer: Heap-buffer-overflow in webrtc::ApplyDigitalGain | - | 2020-03-03 |
| 1028181 | DCHECK failure in !Heap::InYoungGeneration(name) in stub-cache.cc | - | 2020-03-03 |
| 1028191 | CHECK failure: IsValidHeapObject(isolate->heap(), HeapObject::cast(p)) in objects-debug.cc | - | 2020-03-03 |
| 1028207 | Security: Debug check failed: !Heap::InYoungGeneration(name) | - | 2020-03-03 |
| 1028396 | CHECK failure: descriptors != ReadOnlyRoots(isolate).empty_descriptor_array() implies !parent.o | - | 2020-03-03 |
| 1028475 | DCHECK failure in start + search_string->length() <= string->length() in runtime-strings.cc | - | 2020-03-03 |
| 968809 | Security: Clear rollback info from FPMCU stack when accessed | - | 2020-02-29 |
| 1026918 | pdfium (XFA): invalid-vptr in CXFA_FFTextEdit::UpdateFWLData | $2000 | 2020-02-29 |
| 1027410 | DCHECK failure in dst_offset != src_offset in liftoff-assembler-x64.h | - | 2020-02-29 |
| 1027650 | net_quic_stream_factory_fuzzer: Heap-use-after-free in quic::QpackInstructionDecoder::Decode | - | 2020-02-29 |
| 1027707 | transfer_cache_fuzzer: Heap-buffer-overflow in SkRectMemcpy | - | 2020-02-29 |
| 1021677 | Security DCHECK failure: unit.TextContentEnd() <= text.length() in ng_offset_mapping.cc | - | 2020-02-28 |
| 1024741 | transfer_cache_fuzzer: Crash in SkRectMemcpy | - | 2020-02-28 |
| 1025209 | net_quic_stream_factory_fuzzer: Bad-cast to quic::QpackProgressiveDecoder from invalid vptr in quic::QpackProgressiveDecoder::Decode | - | 2020-02-28 |
| 1025467 | 2 Vulnerabilities in websql & sqlite (Tracking Bug) | $2000 | 2020-02-28 |
| 1025911 | transfer_cache_fuzzer: Heap-buffer-overflow in GrConvertPixels | - | 2020-02-28 |
| 1026354 | gpu_raster_angle_fuzzer: Heap-buffer-overflow in void downsample_1_2<ColorTypeFilter_8> | - | 2020-02-28 |
| 1027152 | Security: heap-buffer-overflow in PasswordFormManager::OnGeneratedPasswordAccepted | - | 2020-02-28 |
| 1027292 | Security: import maps are executed as classic scripts when the import map's flag is disabled | - | 2020-02-28 |
| 884693 | Security: IDN URL Spoofing with using "ы" | $500 | 2020-02-27 |
| 896453 | Domain spoof using unicode characters that look like numbers | - | 2020-02-27 |
| 1025442 | Security: IDN spoof with Latin Middle Dot (U+00B7) | - | 2020-02-27 |
| 1025468 | DCHECK failure in result.NumberOfOwnDescriptors() == result.instance_descriptors().number_of_descr | - | 2020-02-27 |
| 1026500 | Use-of-uninitialized-value in v8::internal::Simulator::FPRoundInt | - | 2020-02-27 |
| 1027045 | Bad-cast to v8::internal::compiler::Operator1<v8::internal::compiler::FrameStateInfo, v8::internal::compiler::OpEqualTo<v8::internal::compiler::FrameStateInfo>, v8::internal::compiler::OpHash<v8::internal::compiler::FrameStateInfo> > from v8::internal::compiler::Operator1<v8::internal::MachineRepresentation, v8::internal::compiler::OpEqualTo<v8::internal::MachineRepresentation>, v8::internal::compiler::OpHash<v8::internal::MachineRepresentation> > in v8::internal::compiler::FrameStateInfoOf | - | 2020-02-27 |
| 930683 | Security: Broadcom Bluetooth firmware vulnerability | - | 2020-02-26 |
| 954207 | Heap-buffer-overflow in s_RLE_process | - | 2020-02-26 |
| 1015518 | spvtools_as_fuzzer: Bad-free in spvBinaryDestroy | - | 2020-02-26 |
| 1015697 | spvtools_as_fuzzer: Use-of-uninitialized-value in spvtools_as_fuzzer.cpp | - | 2020-02-26 |
| 1024256 | Crash in blink::FindBuffer::RangeFromBufferIndex with emoji input | - | 2020-02-26 |
| 1025067 | UaF in BluetoothAdapter::OnDiscoveryChangeComplete | $20000 | 2020-02-26 |
| 1025109 | Heap-use-after-free in blink::NGPhysicalFragment::HasSelfPaintingLayer | - | 2020-02-26 |
| 1026479 | CHECK failure: Type cast failed in CAST(last_index) at ../../src/builtins/builtins-regexp-gen.c | - | 2020-02-26 |
| 1053604 | Security: Incorrect side effect modelling for JSCreate | - | 2020-02-26 |
| 1024758 | Security: OOB Write in ReduceRegExpPrototypeTest | $7500 | 2020-02-25 |
| 1025502 | gpu_raster_angle_fuzzer: Crash in void downsample_1_2<ColorTypeFilter_8> | - | 2020-02-25 |
| 1018493 | ndproxy_fuzzer: Stack-buffer-overflow in arc_networkd::NDProxy::Icmpv6Checksum | - | 2020-02-24 |
| 1022695 | Crash in Builtins_InterpreterEntryTrampoline | - | 2020-02-24 |
| 1023144 | ndproxy_fuzzer: Heap-buffer-overflow in arc_networkd::NDProxy::TranslateNDFrame | - | 2020-02-24 |
| 1024736 | transfer_cache_fuzzer: Crash in GrConvertPixels | - | 2020-02-22 |
| 1024762 | gpu_raster_angle_fuzzer: Heap-buffer-overflow in void downsample_1_2<ColorTypeFilter_8> | - | 2020-02-22 |
| 881675 | Chrome v69 URL Spoof via FILE_SCHEME | $500 | 2020-02-21 |
| 1022466 | render_text_api_fuzzer: Heap-buffer-overflow in u_strlen_65 | - | 2020-02-21 |
| 1023853 | use after poison in rtc_rtp_sender_impl.cc | $5000 | 2020-02-21 |
| 1024099 | CHECK failure: bytes <= NUMBER in runtime-typedarray.cc | - | 2020-02-21 |
| 1024116 | Out-of-bounds access in WebBluetoothServiceImpl | $20000 | 2020-02-21 |
| 1025089 | Security: Fix number of arguments being passed when setting the thread name on Windows. | - | 2020-02-21 |
| 999956 | Security: U2F misses reloading hardware binding secrets after deep sleep | - | 2020-02-20 |
| 1013669 | Security: USBGuard accepts D-Bus messages from any | - | 2020-02-20 |
| 1019616 | wayland_fuzzer: Heap-use-after-free in GrMemoryPool::allocate | - | 2020-02-20 |
| 1022554 | render_text_api_fuzzer: Heap-buffer-overflow in gfx::CreateObscuredText | - | 2020-02-20 |
| 1022598 | render_text_api_fuzzer: Stack-buffer-overflow in gfx::RenderText::OnTextAttributeChanged | - | 2020-02-20 |
| 1022855 | Security: Missing HasPrototypeSlot() check in ConstructorBuiltinsbAssembler::EmitFastNewObject() results in out-of-bound read. | $3000 | 2020-02-20 |
| 1022893 | render_text_api_fuzzer: Heap-buffer-overflow in gfx::RenderText::OnTextAttributeChanged | - | 2020-02-20 |
| 1023442 | ExcludeSchemeFromRequestInitiatorSiteLockChecks bypasses GetTrustworthyInitiator | - | 2020-02-20 |
| 1023941 | heap-use-after-free : views::View::SetBackground | - | 2020-02-20 |
| 1024121 | Heap-use-after-free in WebBluetoothServiceImpl | $20000 | 2020-02-20 |
| 1016106 | hammerd_load_ec_image_fuzzer: Crash in hammerd::FirmwareUpdater::LoadEcImage | - | 2020-02-19 |
| 1017793 | vb2_keyblock_fuzzer: Global-buffer-overflow in vb2_load_fw_keyblock | - | 2020-02-19 |
| 1021855 | Download Protection bypass | - | 2020-02-19 |
| 1023351 | Use-after-poison in blink::EventListenerMap::Find | - | 2020-02-19 |
| 1023972 | DCHECK failure in 4 == kSystemPointerSize in code-generator.cc | - | 2020-02-19 |
| 1016703 | DCHECK failure in static_cast<unsigned>(index) < static_cast<unsigned>(capacity()) in fixed-array- | - | 2020-02-18 |
| 1007414 | Security: Tracking Chrome OS running e2fsck on an untrusted file system? | - | 2020-02-17 |
| 1020031 | CHECK failure: static_cast<uintptr_t>(caller_frame_top_) - total_output_frame_size > stack_guar | - | 2020-02-17 |
| 699342 | Security: //components/search_engine appears to be parsing arbitrary XML in the browser process | - | 2020-02-15 |
| 754304 | UI Spoofing in External Protocol confirmation | $1000 | 2020-02-15 |
| 947876 | pdfium (XFA): oob read in CFXJSE_FormCalcContext::WordNum | $2500 | 2020-02-15 |
| 968505 | Security: Domain name spoofing on Unicode top-level domains | - | 2020-02-15 |
| 984513 | The Permission for an important activity is set to null, as the result it can launched by any app. | $1000 | 2020-02-15 |
| 997724 | trunks_resource_manager_fuzzer: Use-of-uninitialized-value in base::debug::ProcessBacktrace | - | 2020-02-15 |
| 1005596 | Security: tel: URL scheme reference origin spoof | $2000 | 2020-02-15 |
| 1013882 | Security: Autocomplete preview text STILL leaks credit card numbers - attacker can simply override system-ui font | $5000 | 2020-02-15 |
| 1015872 | libbrillo_dbus_data_serialization_fuzzer: Crash in variant_reader_recurse | - | 2020-02-15 |
| 1015858 | libbrillo_dbus_data_serialization_fuzzer: Crash in _dbus_marshal_skip_array | - | 2020-02-15 |
| 1015881 | zucchini_disassembler_elf_fuzzer: Heap-buffer-overflow in (std::is_function<std::__Cr::remove_pointer<unsigned | - | 2020-02-15 |
| 1016092 | hammerd_load_ec_image_fuzzer: Use-of-uninitialized-value in fmap_find_area | - | 2020-02-15 |
| 1016099 | arc_setup_util_expand_property_contents_fuzzer: Heap-buffer-overflow in std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<ch | - | 2020-02-15 |
| 1016103 | runtime_probe_probestatement_fuzzer: Index-out-of-bounds in _dbus_mem_pool_alloc | - | 2020-02-15 |
| 1016168 | libbrillo_dbus_data_serialization_fuzzer: Use-of-uninitialized-value in _dbus_first_type_in_signature | - | 2020-02-15 |
| 1016813 | cups_ippreadio_fuzzer: Heap-buffer-overflow in _cupsStrFree | - | 2020-02-15 |
| 1017020 | heap-use-after-free : libusb_get_next_timeout | - | 2020-02-15 |
| 1017494 | Security: PDFium heap-use-after-free in CPDFSDK_PageView::ExitWidget (XFA) | $7500 | 2020-02-15 |
| 1017256 | cups_ippreadio_fuzzer: Heap-buffer-overflow in ippAttributeString | - | 2020-02-15 |
| 1017707 | Security: Phishing with Unicode Domains | $500 | 2020-02-15 |
| 1017797 | cgpt_fuzzer: Use-of-uninitialized-value in Crc32 | - | 2020-02-15 |
| 1017961 | Heap-use-after-free in blink::AudioNodeOutput::Pull | - | 2020-02-15 |
| 1018512 | ndproxy_fuzzer: Use-of-uninitialized-value in arc_networkd::NDProxy::TranslateNDFrame | - | 2020-02-15 |
| 1019648 | v8_wasm_fuzzer: DCHECK failure in val.type == kWasmBottom || ValueTypes::MachineRepresentationFor(val.type) == Val | - | 2020-02-15 |
| 1020533 | DCHECK failure in cell->value().IsTheHole(isolate) in js-objects.cc | - | 2020-02-15 |
| 1020906 | ndproxy_fuzzer: Stack-buffer-overflow in arc_networkd::NDProxy::TranslateNDFrame | - | 2020-02-15 |
| 1021457 | Security: Out of bounds index in array in function parameters | $3000 | 2020-02-15 |
| 1021919 | Use-after-poison in blink::RTCPeerConnectionHandler::OnaddICECandidateResult | - | 2020-02-15 |
| 1022558 | Bad-cast to blink::RTCVoidRequest from invalid vptr in blink::OnReplaceTrackCompleted | - | 2020-02-15 |
| 856927 | Omnibox with URL is displayed on NTP when forward history is browsed with Wifi or Mobile network disabled. | - | 2020-02-06 |
| 925035 | CodeCacheHostImpl::DidGenerateCacheableMetadataInCacheStorage should verify |cache_storage_origin|. | - | 2020-02-06 |
| 1017695 | spvtools_opt_legalization_fuzzer: Container-overflow in spvtools::Optimizer::Run | - | 2020-02-06 |
| 1018528 | Flickering WebGL with {alpha:false} on mali-400 | $500 | 2020-02-06 |
| 1018871 | DCHECK failure in !has_pending_exception() in isolate.cc | - | 2020-02-06 |
| 1000887 | Crash in v8::internal::Simulator::LoadStorePairHelper | - | 2020-02-05 |
| 1014607 | Security: Out-of-bounds read/write in RegisterAllocationData after ResetSpillState | - | 2020-02-05 |
| 1017441 | Sandboxed iframe Document can end up sharing execution context/type system with iframe's initial about:blank Document | $5000 | 2020-02-05 |
| 1019226 | Security - UAF in OfflineAudioContext | $13370 | 2020-02-05 |
| 1019544 | gpu_angle_passthrough_fuzzer: Null-dereference READ in gpu::gles2::GLES2DecoderPassthroughImpl::DoDeleteQueriesEXT | - | 2020-02-05 |
| 1019553 | gpu_angle_passthrough_fuzzer: Null-dereference READ in gpu::error::Error gpu::gles2::GLES2DecoderPassthroughImpl::DoCommandsImpl<false> | - | 2020-02-05 |
| 1019565 | gpu_angle_passthrough_fuzzer: Null-dereference READ in gpu::gles2::GLES2DecoderPassthroughImpl::HandleDrawBuffersEXTImmediate | - | 2020-02-05 |
| 1008312 | heap-use-after-free : GrSurfaceProxy::~GrSurfaceProxy | - | 2020-02-04 |
| 1010526 | Security: URL bar spoofing with using a file:/// URL | $500 | 2020-02-04 |
| 1017918 | Heap-buffer-overflow in hsw::store_NUMBER | - | 2020-02-04 |
| 1008470 | Security: AV in blink::ReadableStreamNative::Trace | - | 2020-02-03 |
| 1018565 | Use-of-uninitialized-value in v8::internal::compiler::Hints::Add | - | 2020-02-03 |
| 1011600 | PaymentManager: attacker has some control over PaymentManager/PaymentInstruments of a cross-origin context | $500 | 2020-01-31 |
| 1016167 | powerd_als_fuzzer: Use-of-uninitialized-value in base::internal::find_first_not_of | - | 2020-01-31 |
| 1016169 | vpn_manager_service_manager_fuzzer: Stack-buffer-overflow in vpn_manager::ServiceManager::ConvertSockAddrToIPString | - | 2020-01-31 |
| 1017564 | Security: URL bar spoofing on iOS with a very long URL | $2000 | 2020-01-31 |
| 1016061 | Container-overflow in performance_manager::SharedWorkerWatcher::RemoveChildWorker | - | 2020-01-30 |
| 1016100 | ndproxy_fuzzer: Stack-buffer-overflow in arc_networkd::NDProxy::Icmpv6Checksum | - | 2020-01-30 |
| 1016109 | ec_usb_tcpm_v2_fuzzer: Index-out-of-bounds in prl_tx_construct_message | - | 2020-01-30 |
| 1016111 | ndproxy_fuzzer: Use-of-uninitialized-value in arc_networkd::NDProxy::TranslateNDFrame | - | 2020-01-30 |
| 1016393 | v8_wasm_async_fuzzer: Heap-buffer-overflow in v8::internal::wasm::LiftoffCompiler::UnOp | - | 2020-01-30 |
| 1016436 | Bad-cast to content::RenderFrameImpl from invalid vptr in content::GpuBenchmarkingContext::GpuBenchmarkingContext | - | 2020-01-30 |
| 1017061 | v8_wasm_code_fuzzer: DCHECK failure in stack_height >= c->end_label->target_stack_height in wasm-interpreter.cc | - | 2020-01-30 |
| 1015864 | trunks_tpm_pinweaver_fuzzer: Stack-buffer-overflow in trunks::Serialize_pw_insert_leaf_t | - | 2020-01-29 |
| 1016166 | dlcservice_boot_device_fuzzer: Use-of-uninitialized-value in dlcservice::BootDevice::GetBootDevice | - | 2020-01-29 |
| 1016450 | DCHECK failure in HAS_SMI_TAG(ptr) in smi.h | - | 2020-01-29 |
| 993706 | Security: Possible to obtain results of queryObjects using custom devtools formatters | - | 2020-01-28 |
| 1016038 | Security: IndexedDB transactions should be inactive during structured serialization | - | 2020-01-28 |
| 1016165 | Heap-buffer-overflow in blink::AudioDelayDSPKernel::Process | - | 2020-01-28 |
| 1016515 | Unknown signal in Builtins_InterpreterEntryTrampoline | - | 2020-01-28 |
| 1010581 | Use-of-uninitialized-value in test_runner::TestRunner::WorkQueue::ProcessWork | - | 2020-01-27 |
| 1015945 | CHECK failure: !v8::internal::FLAG_enable_slow_asserts || (this->IsStruct()) in class-definitio | - | 2020-01-27 |
| 1013868 | Security: heap-use-after-free in CPDF_AnnotList::CPDF_AnnotList | $7500 | 2020-01-25 |
| 1015070 | net_base_address_tracker_linux_fuzzer: Heap-buffer-overflow in net::internal::IgnoreWirelessChange | - | 2020-01-25 |
| 1015129 | net_base_address_tracker_linux_fuzzer: Heap-buffer-overflow in net::internal::AddressTrackerLinux::HandleMessage | - | 2020-01-25 |
| 1015567 | Null-dereference READ in v8::internal::VariableProxy::var | - | 2020-01-25 |
| 971917 | Site Isolation: Multiple restriction bypasses in registerProtocolHandler | $3000 | 2020-01-24 |
| 1011950 | Security: "universal" XSS via copy&paste | $2000 | 2020-01-24 |
| 1013418 | Bad-cast to ToolbarIconContainerView from views::View in AvatarToolbarButton::~AvatarToolbarButton | - | 2020-01-24 |
| 1015042 | chaps_attributes_fuzzer: Heap-buffer-overflow in chaps::Attributes::ParseInternal | - | 2020-01-24 |
| 1015256 | rtcp_receiver_fuzzer: Use-of-uninitialized-value in webrtc::RTCPReceiver::HandlePli | - | 2020-01-24 |
| 1015791 | Use-of-uninitialized-value in v8::internal::Scope::Scope | - | 2020-01-24 |
| 696208 | Security: Chrome extension is disabled by crafted chrome-extension:// URL | $500 | 2020-01-23 |
| 853670 | SameSite cookies leakage via child browsing context | $1000 | 2020-01-23 |
| 1013823 | zucchini_disassembler_elf_fuzzer: Crash in zucchini::Rel32FinderX86::Scan | - | 2020-01-23 |
| 1013871 | zucchini_disassembler_elf_fuzzer: Heap-buffer-overflow in (std::is_function<std::__Cr::remove_pointer<unsigned | - | 2020-01-23 |
| 1014834 | v8_wasm_async_fuzzer: Heap-buffer-overflow in v8::internal::wasm::LiftoffCompiler::UnOp | - | 2020-01-23 |
| 1010518 | Security: AbsentPlaster bug on Chrome OS | - | 2020-01-22 |
| 1013490 | Heap-use-after-free in blink::LayoutObject::IsDescendantOf | - | 2020-01-22 |
| 944619 | Security: CORB not enforced for WebSocket requests | $10000 | 2020-01-21 |
| 1013920 | Security: Debug check failed: is_wasm_memory_. | - | 2020-01-21 |
| 1010569 | Heap-use-after-free in content::WebContentsImpl::~WebContentsImpl | - | 2020-01-20 |
| 467329 | Popups can be moved below the taskbar in windows | $500 | 2020-01-18 |
| 990867 | Cross-origin-read attack by using an audio tag to download a cross-origin resource | $500 | 2020-01-18 |
| 1012055 | Use-after-poison in mojo::ReceiverSetBase<mojo::Receiver<blink::mojom::blink::ManifestManager, mojo: | - | 2020-01-18 |
| 1012579 | CHECK failure: Failed to create ICU number format, are ICU data files missing? in js-relative-t | - | 2020-01-18 |
| 1012663 | Heap-use-after-free in std::__1::vector<performance_manager::ProcessNode const*, std::__1::allocator<pe | - | 2020-01-18 |
| 1012727 | Container-overflow in performance_manager::SharedWorkerWatcher::RemoveChildWorker | - | 2020-01-18 |
| 1013048 | Use-of-uninitialized-value in performance_manager::GraphImpl::GetAllProcessNodes | - | 2020-01-18 |
| 1013485 | Heap-use-after-free in performance_manager::GraphImpl::AddNewNode | - | 2020-01-18 |
| 981100 | Security: ChromeVox exposes browser text from locked screen | - | 2020-01-17 |
| 999932 | Security: Possible to spoof URL through use of document.open | $500 | 2020-01-17 |
| 1001503 | Security: UaF in Aura | $20000 | 2020-01-17 |
| 1004212 | Security: Insecure Chrome download allows malicious software to change downloaded file integrity | - | 2020-01-17 |
| 1004458 | Use-of-uninitialized-value in password_manager::PasswordReuseDetectionManager::OnPaste | - | 2020-01-17 |
| 1005218 | Security: Multiple file download protection bypass 2 | $1000 | 2020-01-17 |
| 1007334 | Sanitizer CHECK failure in "((*(u8*)MemToShadow(a))) == ((0))" (0x4, 0x0) | $2000 | 2020-01-17 |
| 1010765 | Security: URL in Omnibox doesn't always match page content on iOS | - | 2020-01-17 |
| 1013013 | CHECK failure: !v8::internal::FLAG_enable_slow_asserts || (IsJSReceiver()) in js-objects-inl.h | - | 2020-01-17 |
| 1013042 | Security: Debug check failed: Smi::IsValid(value) | $5000 | 2020-01-17 |
| 1013058 | DCHECK failure in static_cast<unsigned>(index) < static_cast<unsigned>(length()) in fixed-array-in | - | 2020-01-17 |
| 1013135 | DCHECK failure in !kCanBeWeak implies !IsSmi() == HAS_STRONG_HEAP_OBJECT_TAG(ptr_) in tagged-impl. | - | 2020-01-17 |
| 954219 | Heap-use-after-free in pdf14_decrement_smask_color | - | 2020-01-15 |
| 984327 | gstoraster_fuzzer: Heap-use-after-free in ptr_struct_mark | - | 2020-01-15 |
| 993415 | Use-after-poison in blink::Node::EnsureEventTargetData | $3000 | 2020-01-15 |
| 1003316 | CVE-2017-18595 CrOS: Vulnerability reported in Linux kernel | - | 2020-01-15 |
| 1008947 | Heap-use-after-free in AvatarMenu::~AvatarMenu | - | 2020-01-15 |
| 1011596 | javascript_parser_proto_fuzzer: DCHECK failure in !parsing_module_ in preparser.h | - | 2020-01-15 |
| 1011677 | heap-use-after-free : base::OnTaskRunnerDeleter::OnTaskRunnerDeleter | - | 2020-01-15 |
| 1011980 | DCHECK failure in effect_edges > 0 in verifier.cc | - | 2020-01-15 |
| 1012580 | Use-of-uninitialized-value in blink::GraphicsContext::SetURLForRect | - | 2020-01-15 |
| 1001854 | CVE-2019-15214 CrOS: Vulnerability reported in Linux kernel | - | 2020-01-14 |
| 1003325 | CVE-2019-15902 CrOS: Vulnerability reported in Linux kernel | - | 2020-01-14 |
| 1003326 | CVE-2019-15916 CrOS: Vulnerability reported in Linux kernel | - | 2020-01-14 |
| 1010379 | Security DCHECK failure: !object || (object->IsBox()) in layout_box.h | - | 2020-01-12 |
| 1010477 | Security DCHECK failure: !object || (object->IsLayoutInline()) in layout_inline.h | - | 2020-01-12 |
| 1010759 | Use-of-uninitialized-value in blink::LayoutObject::DestroyAndCleanupAnonymousWrappers | - | 2020-01-12 |
| 1011267 | Heap-use-after-free in blink::PaintLayer::CompositingContainer | - | 2020-01-12 |
| 1011603 | Heap-use-after-free in blink::LayoutObject::SetShouldCheckForPaintInvalidation | - | 2020-01-12 |
| 1010690 | Use-of-uninitialized-value in views::ScrollView::Viewport::ViewHierarchyChanged | - | 2020-01-11 |
| 1010703 | dawn_wire_server_and_frontend_fuzzer: Crash in dawn_native::ErrorScope::HandleErrorImpl | - | 2020-01-11 |
| 1010706 | Heap-use-after-free in blink::LayoutObject::DestroyAndCleanupAnonymousWrappers | - | 2020-01-11 |
| 1011294 | net_quic_stream_factory_fuzzer: Heap-use-after-free in quic::QpackHeaderTable::UnregisterObserver | - | 2020-01-11 |
| 1007194 | Security: Use after free in MojoCdmProxyService | $5000 | 2020-01-09 |
| 1009458 | Use-after-poison in void blink::ScriptPromiseResolver::ResolveOrReject<blink::ScriptValue> | - | 2020-01-09 |
| 918674 | Security: CVE-2018-19664 in libjpeg-turbo | - | 2020-01-08 |
| 948445 | Security: multiple issues in SafeSetID LSM | - | 2020-01-08 |
| 957314 | ClientNativePixmap implelementations don't validate handles | - | 2020-01-08 |
| 974375 | ClientNativePixmapDmaBuf::ImportFromDmabuf() doesn't validate buffer size | - | 2020-01-08 |
| 1005251 | Security: heap-use-after-free in RTCPeerConnectionHandler::SetLocalDescription | $7500 | 2020-01-08 |
| 1005635 | transfer_cache_fuzzer: Use-of-uninitialized-value in sse2::store_NUMBER | - | 2020-01-08 |
| 1010026 | Heap-use-after-free in std::__1::vector<performance_manager::ProcessNode const*, std::__1::allocator<pe | - | 2020-01-08 |
| 981649 | Use-of-uninitialized-value in send_delete_event | - | 2020-01-07 |
| 1004341 | Security: Upgrade expat to 2.2.8 | $500 | 2020-01-07 |
| 1005615 | transfer_cache_fuzzer: Heap-buffer-overflow in load2 | - | 2020-01-07 |
| 1005630 | transfer_cache_fuzzer: Heap-buffer-overflow in sse2::load_rgf16 | - | 2020-01-07 |
| 1005948 | Security: Headers are processed for aborted requests when passed through service worker | $500 | 2020-01-07 |
| 1008419 | Crash in blink::MarkingVisitorBase::Visit | - | 2020-01-07 |
| 1008632 | Sanitizer CHECK failure in "((*(u8*)MemToShadow(a))) == ((0))" (0x4, 0x0) | - | 2020-01-07 |
| 1009207 | Crash in blink::HeapObjectHeader::CheckHeader | - | 2020-01-07 |
| 1009260 | pdf_font_fuzzer: Use-of-uninitialized-value in ft_mem_free | - | 2020-01-07 |
| 1009278 | Crash in blink::DOMWrapperWorld::Current | - | 2020-01-07 |
| 1009382 | Crash in v8::internal::GlobalHandles::InvokeFirstPassWeakCallbacks | - | 2020-01-07 |
| 1008414 | CHECK failure: Bytecode mismatch at offset 177 in interpreter.cc | - | 2020-01-06 |
| 1008714 | Crash in blink::IsCallbackFunctionRunnableInternal | - | 2020-01-06 |
| 1007423 | Heap-use-after-free in test_runner::TestRunner::WorkQueue::ProcessWork | - | 2020-01-05 |
| 974648 | Use-of-uninitialized-value in uint64divmod | - | 2020-01-04 |
| 1000543 | Use-of-uninitialized-value in blink::LayoutObject::ShouldUseTransformFromContainer | - | 2020-01-03 |
| 1007866 | Security DCHECK failure: IsA<Derived>(from) in casting.h | - | 2020-01-03 |
| 1008216 | Bad-cast to blink::Nodeblink::Node::ShadowIncludingRoot in blink::Node::UpdateDistributionInternal | - | 2020-01-03 |
| 1008316 | Crash in blink::EventListenerMap::Contains | - | 2020-01-03 |
| 1008506 | Use-of-uninitialized-value in viz::ContextCacheController::ClientBecameNotVisible | - | 2020-01-03 |
| 1008610 | Bad-cast to GrContext from invalid vptr in viz::ContextCacheController::ClientBecameNotVisible | - | 2020-01-03 |
| 1008631 | DCHECK failure in index < length_ in vector.h | - | 2020-01-03 |
| 1008709 | Use-of-uninitialized-value in hsw::blit_row_s32a_opaque | - | 2020-01-03 |
| 985499 | third_party/liblouis version 3.2.0 is vulnerable | - | 2020-01-02 |
| 990234 | sqlite3_fts3_lpm_fuzzer: Heap-use-after-free in findElementWithHash | - | 2020-01-02 |
| 991888 | SOP & Site Isolation bypass with Reader mode | $5000 | 2020-01-02 |
| 1005753 | Security: UAF in indexed_db_cursor.cc | $20500 | 2020-01-02 |
| 1006544 | Use-of-uninitialized-value in gfx::CubicBezier::SolveCurveX | $4000 | 2020-01-02 |
| 1006545 | Heap-use-after-free in blink::NGBlockNode::CopyChildFragmentPosition | - | 2020-01-02 |
| 1006763 | Security: https://www.madeupdomainforcheck123.com reference in Chrome and Chromium code | - | 2020-01-02 |
| 824715 | Security: RTL+ space, formatting, invisible characters can lead to URL Spoofing | $3000 | 2020-01-01 |
| 1006435 | spvtools_opt_size_fuzzer: Container-overflow in spvtools::opt::Instruction::GetSingleWordOperand | - | 2020-01-01 |