| 961540 | Heap-buffer-overflow in courgette::DisassemblerElf32ARM::ParseRelocationSection | - | 2019-12-31 |
| 981628 | Security: URL in Omnibox doesn't always match page content (repro 897641) | $1,000 | 2019-12-31 |
| 1001283 | CSP bypass with about:srcdoc | $3,000 | 2019-12-31 |
| 1006670 | v8_regexp_parser_fuzzer: Crash in v8::base::SmallVector<int, 64u>::Grow | - | 2019-12-31 |
| 1006630 | CHECK failure: filter.IsValid(slot.address()) in mark-compact.cc | - | 2019-12-30 |
| 442579 | It's possible to load chrome-extension:// URLs | $500 | 2019-12-28 |
| 922433 | CrOS: Vulnerability reported in app-text/poppler | - | 2019-12-28 |
| 922434 | CrOS: Vulnerability reported in app-text/poppler | - | 2019-12-28 |
| 953298 | Extension permission bypass by poisoning bookmarks with javascript url(Bookmarklet) | - | 2019-12-27 |
| 990779 | CrOS: Vulnerability reported in x11-libs/pango | - | 2019-12-27 |
| 998431 | Security: Accessing set::end in GamepadService | $15,000 | 2019-12-27 |
| 1004730 | Security: UaF in MojoAudioDecoder (Android) | $15,000 | 2019-12-27 |
| 929621 | CrOS: Vulnerability reported in media-gfx/imagemagick | - | 2019-12-26 |
| 1005599 | Crash in Builtins_InterpreterEntryTrampoline | - | 2019-12-26 |
| 966914 | Security: Possible to spoof the contents of the omnibox to display any http/https URL, some extension URLs and some internal URLs | $3,000 | 2019-12-25 |
| 977043 | Heap-buffer-overflow in ash::ShelfView::LayoutOverflowButton | - | 2019-12-25 |
| 998284 | Security: Possible to temporarily spoof URL by navigating back then forward | $1,000 | 2019-12-25 |
| 1003241 | DCHECK failure in static_cast<unsigned>(index) < static_cast<unsigned>(length()) in fixed-array-in | - | 2019-12-25 |
| 1003336 | CVE-2019-15926 CrOS: Vulnerability reported in Linux kernel | - | 2019-12-25 |
| 1003337 | CVE-2019-15927 CrOS: Vulnerability reported in Linux kernel | - | 2019-12-25 |
| 1004912 | CHECK failure: Type cast failed in CAST(CallBuiltin(Builtins::kToName, p->context(), p->name()) | - | 2019-12-25 |
| 1003730 | CHECK failure: Object is not known to the heap broker in js-heap-broker.cc | - | 2019-12-23 |
| 985451 | Security: Secuirty crash in TabAnimation::operator | - | 2019-12-21 |
| 1001818 | Bad-cast to blink::LayoutBox from invalid vptr in blink::NGBlockNode::CopyChildFragmentPosition | - | 2019-12-21 |
| 979441 | Security: Navigating to "chrome://" URLs on Android | $500 | 2019-12-20 |
| 1003327 | CVE-2019-15917 CrOS: Vulnerability reported in Linux kernel | - | 2019-12-20 |
| 1003331 | CVE-2019-15921 CrOS: Vulnerability reported in Linux kernel | - | 2019-12-20 |
| 955191 | Disk cache refcount overflows? | - | 2019-12-19 |
| 1000922 | Crash in pthread_create | - | 2019-12-19 |
| 1002388 | CHECK failure: !v8::internal::FLAG_enable_slow_asserts || (this->IsStruct()) in class-definitio | - | 2019-12-19 |
| 1002687 | Security: Idn-spoof with using CJK character skeletons | - | 2019-12-19 |
| 1003140 | Bad-cast to blink::ScriptWrappable from blink::NavigatorGeolocation in blink::FinalizerTrait<blink::ScriptWrappable>::Finalize | - | 2019-12-19 |
| 1003341 | CHECK failure: static_cast<uintptr_t>(caller_frame_top_) - total_output_frame_size > stack_guar | - | 2019-12-19 |
| 990849 | Leaking size of cross-origin resource by using Range Requests and Service Workers | $2,000 | 2019-12-18 |
| 991568 | Security: forced redirection from cross-origin iframe | $3,000 | 2019-12-18 |
| 996786 | Check cookie domain on setting cookies | - | 2019-12-18 |
| 1001159 | pdfium: oob read in PDF_DecodeText | $2,000 | 2019-12-18 |
| 803187 | Security: Interstitials WebUI should have a stricter CSP | - | 2019-12-17 |
| 840180 | Address Bar Spoofing when spoofing target is NOT a top domain but a related domain is in the top list (e.g. adidas.de vs adidas.com ) | - | 2019-12-17 |
| 961651 | CrOS: Vulnerability reported in net-libs/gnutls | - | 2019-12-17 |
| 995964 | Security: UAF in InProcessVideoCaptureDeviceLauncher | $20,000 | 2019-12-17 |
| 997401 | CHECK failure: U_SUCCESS(status) in intl-objects.cc | - | 2019-12-17 |
| 999793 | CrOS: Vulnerability reported in media-libs/tiff | - | 2019-12-17 |
| 1000002 | Security: OfflinePageAutoFetcher UAF 2 | $20,000 | 2019-12-17 |
| 1000882 | Security: Regression : 'Press Esc to exit fullscreen' warning doesn't display | $3,000 | 2019-12-17 |
| 1000934 | Security: Heap-use-after-free in SharingDialogView::WindowClosing() | $15,000 | 2019-12-17 |
| 1001804 | CHECK failure: AllowJavascriptExecution::IsAllowed(isolate) in execution.cc | - | 2019-12-17 |
| 999118 | CVE-2019-15213 CrOS: Vulnerability reported in Linux kernel | - | 2019-12-14 |
| 982326 | ChromeVox extension injects attacker-controlled scripts and requests attacker-controlled URLs | $5,000 | 2019-12-13 |
| 1000635 | Security: Use After Free in the function JavaScriptFrame::Summarize | $7,500 | 2019-12-13 |
| 931894 | Security: http authentication spoof on chrome iOS | $1,000 | 2019-12-12 |
| 988590 | Overflow of the transform scale CSS property freezes/crashes the renderer allowing cross-origin content spoofing | $500 | 2019-12-12 |
| 994044 | Security: URL bar spoofing with using a file:/// URL | $500 | 2019-12-12 |
| 996741 | Security: Site Isolation bypass and local file disclosure via Payment Handler API | - | 2019-12-12 |
| 1000563 | Heap-use-after-free in ash::OverviewHighlightController::OnViewDestroyingOrDisabling | - | 2019-12-12 |
| 696454 | Security: Filesystem dialog box to cover the self-window and no origin for spoof | $1,000 | 2019-12-11 |
| 760855 | Security: Address bar RTL spoofing using hebrew | $500 | 2019-12-11 |
| 859349 | Security: Confused deputy attack against Chrome Android application might lead to internal storage file disclosure | $1,000 | 2019-12-11 |
| 991321 | Security: use-after-poison in blink::VideoTrackRecorder::InitializeEncoder | $5,000 | 2019-12-11 |
| 997403 | Heap-use-after-free in blink::NGPaintFragment::LayoutObjectWillBeDestroyed | - | 2019-12-11 |
| 998395 | Heap-use-after-free in blink::NGOffsetMappingUnit::AssertValid | - | 2019-12-11 |
| 998548 | Security: UaF in ImageCapture | $20,000 | 2019-12-11 |
| 999469 | Crash in blink::NonSharedCharacterBreakIterator::Next | - | 2019-12-11 |
| 999760 | Security: Tab sharing UI crash | $500 | 2019-12-11 |
| 1000050 | ulpfec_receiver_fuzzer: Heap-buffer-overflow in webrtc::ForwardErrorCorrection::StartPacketRecovery | - | 2019-12-11 |
| 1000167 | Crash in blink::NonSharedCharacterBreakIterator::IsCRBeforeLF | - | 2019-12-11 |
| 1000217 | Security: Potential UAF in Isolate::ReportPendingMessagesImpl | - | 2019-12-11 |
| 996751 | DCHECK failure in bytecode->IsBytecodeEqual( *outer_function_job->compilation_info()->bytecode_arr | - | 2019-12-09 |
| 997449 | Use-of-uninitialized-value in blink::NGPaintFragment::ClearAssociationWithLayoutObject | - | 2019-12-09 |
| 999463 | Stack-use-after-scope in viz::LocalSurfaceId::parent_sequence_number | - | 2019-12-08 |
| 998196 | Global-buffer-overflow in content::WebWidgetLockTarget::OnLockMouseACK | - | 2019-12-07 |
| 999497 | Use-of-uninitialized-value in ui::X11Window::OnXWindowStateChanged | - | 2019-12-07 |
| 937131 | Feature Policy 'allow' attribute can override top-level policy in frames | - | 2019-12-06 |
| 979443 | Security: URL bar spoofing via download redirect | $2,000 | 2019-12-06 |
| 997925 | Security: Possible to retrieve cross-origin data in certain cases using devtools custom formatters | $500 | 2019-12-06 |
| 998679 | Security: Crash in content::`anonymous namespace'::OnInstallPaymentApp | $10,000 | 2019-12-06 |
| 999470 | Use-of-uninitialized-value in ui::X11Window::OnXWindowStateChanged | - | 2019-12-06 |
| 972463 | Security: Multiple vulnerabilities in chromeos-disk-firmware.sh | $1,000 | 2019-12-05 |
| 996391 | v8_regexp_parser_fuzzer: DCHECK failure in index < length_ in vector.h | - | 2019-12-05 |
| 998127 | Crash in blink::ScriptState::From | - | 2019-12-05 |
| 998204 | Crash in v8::internal::LoopChoiceNode::Accept | - | 2019-12-05 |
| 999005 | Heap-buffer-overflow in blink::NGInlineNodeDataEditor::Run | - | 2019-12-05 |
| 982812 | CSS injection in any website using Color Enhancer extension | $2,000 | 2019-12-04 |
| 986751 | UAP in blink::PersistentBase | - | 2019-12-04 |
| 997982 | Crash in v8::internal::GlobalHandles::CreateTraced | - | 2019-12-04 |
| 998215 | Crash in v8::internal::MarkCompactCollector::IsUnmarkedHeapObject | - | 2019-12-04 |
| 998322 | Crash in v8::HandleScope::CreateHandle | - | 2019-12-04 |
| 997440 | Crash in v8::internal::Simulator::WriteW | - | 2019-12-03 |
| 998093 | Bad-cast to blink::Nodeblink::Node::GetRegisteredMutationObserversOfType in blink::MutationObserverInterestGroup::CreateIfNeeded | - | 2019-12-03 |
| 1005713 | Security: Parser bug can introduce mXSS and HTML sanitizers bypass | - | 2019-12-02 |
| 997411 | CHECK failure: (map().has_fast_smi_or_object_elements() || map().has_frozen_or_sealed_elements( | - | 2019-12-01 |
| 997421 | DCHECK failure in result.NumberOfOwnDescriptors() == result.instance_descriptors().number_of_descr | - | 2019-12-01 |
| 987205 | Unknown signal in Builtins_JSEntryTrampoline | - | 2019-11-30 |
| 995712 | Security: PDFium (XFA) Use-after-free in CFWL_PushButton::OnKeyDown | $7,500 | 2019-11-30 |
| 996515 | Use-of-uninitialized-value in OmniboxViewViews::HandleKeyEvent | - | 2019-11-30 |
| 996526 | Heap-use-after-free in AutocompleteMatch::IsTabSwitchSuggestion | - | 2019-11-30 |
| 996571 | Heap-buffer-overflow in AutocompleteMatch::IsTabSwitchSuggestion | - | 2019-11-30 |
| 997190 | Security: UaF in MediaSession, Android only | $20,000 | 2019-11-30 |
| 901789 | Security: Same origin policy bypass via 401 page | - | 2019-11-29 |
| 915538 | Security: Origin header-based CSRF protection bypass | $500 | 2019-11-29 |
| 990223 | CHECK failure: status == CompilationJob::SUCCEEDED in function-compiler.cc | - | 2019-11-29 |
| 993553 | Security: PDFium (XFA) Use-after-free in CJX_HostPseudoModel::openList | $9,500 | 2019-11-29 |
| 997057 | Heap-use-after-free in v8::internal::compiler::ConstantFoldingReducer::Reduce | - | 2019-11-29 |
| 595841 | Require browser process interaction to open files from chrome://downloads | - | 2019-11-28 |
| 756825 | Chrome automatically downloads certain files even though the "Ask before downloading" option is enabled | $500 | 2019-11-28 |
| 769662 | Security: openvpn - CVE-2017-12166: out of bounds write in key-method 1 | - | 2019-11-28 |
| 839239 | Security: Fullscreen notification can be obscured by external protocol prompt | - | 2019-11-28 |
| 875178 | Security: spoof google via onbeforeunload of ssl error page | - | 2019-11-28 |
| 988024 | config_validator_fuzzer: Heap-buffer-overflow in parse_file | - | 2019-11-28 |
| 988025 | config_validator_fuzzer: Use-of-uninitialized-value in krb5int_aes_enc_key | - | 2019-11-28 |
| 989078 | Reading local files and cross-origin resources through an extension that only has the "downloads" permission | $2,000 | 2019-11-28 |
| 992838 | Security: URL bar spoofing on Android with a very long URL | $3,000 | 2019-11-28 |
| 995709 | Heap-use-after-free in blink::AutoplayPolicy::IsDocumentAllowedToPlay | - | 2019-11-28 |
| 996211 | gpu_raster_passthrough_fuzzer: Use-of-uninitialized-value in SkDescriptor::isValid | - | 2019-11-28 |
| 992914 | Security: v8 Map migration doesn't respect element kinds changes, leading to type confusion | - | 2019-11-27 |
| 995591 | IndexedDB: GetDatabaseInfo() should check AllowIndexedDB() before issuing a request to the browser | - | 2019-11-27 |
| 996099 | DCHECK failure in result.NumberOfOwnDescriptors() == result.instance_descriptors().number_of_descr | - | 2019-11-27 |
| 992808 | Heap-use-after-free in content::IndexedDBDatabase::DeleteRequest::DoDelete | - | 2019-11-26 |
| 995010 | Heap-use-after-free in chromeos::device_sync::CryptAuthGCMManagerImpl::~CryptAuthGCMManagerImpl | - | 2019-11-26 |
| 967780 | Security: Code run by redirecting same-origin download to a javascript: URL gains user activation and bypasses CSP | $1,000 | 2019-11-25 |
| 993288 | Security: Possible to read cross-origin data using debug console utility function | - | 2019-11-25 |
| 994203 | spvtools_opt_performance_fuzzer: Heap-buffer-overflow in spvtools::opt::Instruction::GetSingleWordOperand | - | 2019-11-25 |
| 994248 | spvtools_opt_legalization_fuzzer: Heap-buffer-overflow in spvtools::opt::StructuredCFGAnalysis::AddBlocksInFunction | - | 2019-11-25 |
| 995071 | spvtools_opt_legalization_fuzzer: Heap-buffer-overflow in spvtools::utils::SmallVector<unsigned int, 2u>::operator | - | 2019-11-25 |
| 995114 | Use-of-uninitialized-value in blink::NGBlockLayoutAlgorithm::ComputeChildData | - | 2019-11-25 |
| 995275 | DCHECK failure in nexus.IsMegamorphic() || nexus.GetFeedback().IsCleared() in js-heap-broker.cc | - | 2019-11-25 |
| 925791 | Security: PDFium Uninitialized Memory Read in CXFA_LayoutPageMgr::GetAvailHeight | $1,000 | 2019-11-23 |
| 977527 | sequence_manager_fuzzer: Heap-use-after-free in scoped_refptr<base::SingleThreadTaskRunner>::scoped_refptr | - | 2019-11-23 |
| 980183 | Unknown signal in Builtins_ArrayPrototypeFindIndex | - | 2019-11-23 |
| 990635 | CVE-2018-20856 CrOS: Vulnerability reported in Linux kernel | - | 2019-11-23 |
| 991125 | Security: Privilege Elevation via Google Chrome Elevation Service | $5,000 | 2019-11-23 |
| 993771 | Security: pdfium XFA m_pFocusWidget Use After Free | $5,000 | 2019-11-23 |
| 994086 | Crash in sw::Renderer::executeTask | - | 2019-11-23 |
| 994089 | Use-of-uninitialized-value in password_manager::PasswordReuseDetectionManager::OnPaste | - | 2019-11-23 |
| 984386 | Security DCHECK failure: new_box->IsInlineFlowBox() in layout_block_flow_line.cc | - | 2019-11-22 |
| 882812 | Security: fullscreen notification spoof (registerProtocolHandler) | $1,000 | 2019-11-21 |
| 990582 | DCHECK failure in maybe_table.IsSourcePositionTableWithFrameCache() in code.cc | - | 2019-11-21 |
| 993223 | Security: Heap-use-after-free in payments::PaymentRequestSheetController::UpdateHeaderView | $5,000 | 2019-11-21 |
| 977871 | vtest_fuzzer: Crash in try_setup_line | - | 2019-11-20 |
| 986043 | Security: Malicious Extension can ignore SOP, with only `downloads` permission. | $3,000 | 2019-11-20 |
| 992389 | Crash in v8::internal::IrregexpInterpreter::Result v8::internal::RawMatch<unsigned char> | - | 2019-11-20 |
| 993266 | blink_png_decoder_fuzzer: Heap-buffer-overflow in blink::PNGImageDecoder::RowAvailable | - | 2019-11-20 |
| 993474 | CHECK failure: static_cast<uintptr_t>(caller_frame_top_) - total_output_frame_size > stack_guar | - | 2019-11-20 |
| 993601 | Security: PurpleWolf HTTP/2 denial of service attacks | - | 2019-11-20 |
| 978793 | UAP in UpdatePlaceholderImage | $5,500 | 2019-11-19 |
| 986211 | Heap-buffer-overflow in net::SpdyReadQueue::Dequeue | - | 2019-11-19 |
| 992844 | Crash in sw::Renderer::executeTask | - | 2019-11-19 |
| 992679 | Crash in blink::HeapHashTableBacking<WTF::HashTable<WTF::LinkedHashSetNode<blink::WeakMem | - | 2019-11-18 |
| 992688 | Use-of-uninitialized-value in Cr_z_crc32_z | - | 2019-11-18 |
| 992703 | Use-of-uninitialized-value in Cr_z_crc32_sse42_simd_ | - | 2019-11-18 |
| 991328 | Use-of-uninitialized-value in test_runner::TestRunner::WorkQueue::ProcessWork | - | 2019-11-17 |
| 981492 | UAP in SetDispatchContext | $3,000 | 2019-11-16 |
| 984811 | Use-after-free inside CFX_SkiaDeviceDriver::Flush() when SkiaPaths is enabled | - | 2019-11-16 |
| 992285 | Security: use-after-free in payment app | $500 | 2019-11-16 |
| 991085 | Use-after-poison in mojo::InterfaceEndpointClient::HandleValidatedMessage | - | 2019-11-15 |
| 991901 | Crash in void v8::internal::MarkCompactCollector::ProcessMarkingWorklistInternal< | - | 2019-11-15 |
| 960305 | Security: storage estimate allows obtaining size of cached cross-origin resource | $500 | 2019-11-14 |
| 986393 | Security: Possible to leak global window object via console | $500 | 2019-11-14 |
| 987502 | Security: Possible to leak exceptions across contexts via devtools | - | 2019-11-14 |
| 991446 | Bad-cast to blink::LayoutObject from invalid vptr in blink::NGPaintFragment::PopulateDescendants | - | 2019-11-14 |
| 973928 | Heap-use-after-free in password_manager::PasswordReuseDetectionManager::OnPaste | - | 2019-11-13 |
| 981597 | Pointer lock propagates user activation to sandboxed frame | - | 2019-11-13 |
| 989305 | Bad-cast to blink::LayoutBoxModelObject from invalid vptr in blink::LayoutBlockFlow::AddOverhangingFloats | - | 2019-11-13 |
| 990222 | content_security_policy_fuzzer: Crash in qos_class_main | - | 2019-11-13 |
| 929763 | Security: BT classic MITM 1-byte key length negotiation | - | 2019-11-12 |
| 989497 | Security: URL bar spoofing on iOS (with SlimNav ON) | $3,000 | 2019-11-12 |
| 989742 | Crash in blink::NGExclusionSpaceInternal::DerivedGeometry::FindLayoutOpportunity | - | 2019-11-12 |
| 990590 | Heap-use-after-free in content::IndexedDBContextImpl::DatabaseDeleted | - | 2019-11-12 |
| 956420 | CrOS: Vulnerability reported in media-libs/tiff | - | 2019-11-11 |
| 986063 | Security: Calling console utility functions causes data to be shared between contexts | $500 | 2019-11-11 |
| 989909 | Accessors created from FunctionTemplate have the wrong native context | - | 2019-11-11 |
| 921561 | CrOS: Vulnerability reported in net-wireless/hostapd | - | 2019-11-08 |
| 946633 | Security: Download dialog spoofing | $500 | 2019-11-08 |
| 984344 | V8 Invalid Read in v8::internal::HeapObject::IsHeapNumber | $2,000 | 2019-11-08 |
| 985758 | Bad-cast to blink::WebView from invalid vptr in test_runner::TestRunner::FinishTestIfReady | - | 2019-11-08 |
| 986007 | gpu_raster_swiftshader_fuzzer: Use-of-uninitialized-value in cc::ServiceImageTransferCacheEntry::Deserialize | - | 2019-11-08 |
| 986029 | transfer_cache_fuzzer: Use-of-uninitialized-value in cc::ServiceImageTransferCacheEntry::Deserialize | - | 2019-11-08 |
| 986792 | UAF in blink::ImageBitmapFactories::ImageBitmapLoader::DecodeImageOnDecoderThread | $7,500 | 2019-11-08 |
| 989827 | Security DCHECK failure: IsA<Derived>(from) in casting.h | - | 2019-11-08 |
| 863661 | Security:IDN url spoofing using U+4e00 | $500 | 2019-11-06 |
| 977989 | Security: pdfium heap-use-after-free in CXFA_ItemLayoutProcessor::InsertFlowedItem | $500 | 2019-11-06 |
| 981618 | CrOS: Vulnerability reported in dev-libs/glib | - | 2019-11-06 |
| 988241 | Security DCHECK failure: !object || (object->IsBox()) in layout_box.h | - | 2019-11-06 |
| 988541 | Security DCHECK failure: IsA<Derived>(from) in casting.h | - | 2019-11-06 |
| 989471 | CVE-2007-6762 CrOS: Vulnerability reported in Linux kernel | - | 2019-11-06 |
| 989472 | CVE-2010-5331 CrOS: Vulnerability reported in Linux kernel | - | 2019-11-06 |
| 989473 | CVE-2010-5332 CrOS: Vulnerability reported in Linux kernel | - | 2019-11-06 |
| 989474 | CVE-2018-20784 CrOS: Vulnerability reported in Linux kernel | - | 2019-11-06 |
| 994957 | Security: buffer OOB *read* in libc++ random | - | 2019-11-05 |
| 866162 | Security: IDN URL Spoofing with Greek Letter | - | 2019-11-05 |
| 927150 | Security: 'Press Esc to exit fullscreen' covered up by <select> | - | 2019-11-05 |
| 982397 | PDFium (XFA) Use-after-free in CPDFSDK_XFAWidgetHandler::OnXFAChangedFocus | $5,500 | 2019-11-05 |
| 987956 | CVE-2019-13272 CrOS: Vulnerability reported in Linux kernel | - | 2019-11-05 |
| 988304 | DCHECK failure in bytecode->IsBytecodeEqual( *outer_function_job->compilation_info()->bytecode_arr | - | 2019-11-05 |
| 988858 | [IndexedDB] Prevent using uninitialized memory in IndexedDBBackingStore | - | 2019-11-05 |
| 988919 | DCHECK failure in loop_node_->EatsAtLeast(true) >= continue_node_->EatsAtLeast(true) in regexp-com | - | 2019-11-05 |
| 972030 | CrOS: Vulnerability reported in dev-libs/glib | - | 2019-11-04 |
| 868846 | Security: URL spoof using CJK combining character (U+3099 U+309A) | $1,000 | 2019-11-02 |
| 987270 | audio_decoder_fuzzer: Use-of-uninitialized-value in wav_parse_bext_string | - | 2019-11-02 |
| 973360 | Use-after-free in WasmMemoryObject::Grow | $5,000 | 2019-11-01 |
| 980161 | Security: PDFium (XFA) Use-after-free in CPDFSDK_AnnotHandlerMgr::GetNextAnnot | $5,500 | 2019-11-01 |
| 983147 | DCHECK failure in bytecode->IsBytecodeEqual( *outer_function_job->compilation_info()->bytecode_arr | - | 2019-11-01 |
| 987507 | rtcp_receiver_fuzzer: Heap-buffer-overflow in webrtc::ByteReader<unsigned int, 4u, false>::Get | - | 2019-11-01 |
| 964938 | Use-of-uninitialized-value in ui::SolveLeastSquares | - | 2019-10-31 |
| 987381 | Use-of-uninitialized-value in media_session::MediaPosition::operator== | - | 2019-10-31 |
| 939108 | Isolate chrome.google.com from *.google.com | $500 | 2019-10-30 |
| 973228 | Heap-use-after-free in dawn_wire::server::Server::DoBufferUpdateMappedData | - | 2019-10-30 |
| 986754 | UAP in IsEmptyValue | - | 2019-10-30 |
| 987106 | Use-of-uninitialized-value in net::HostResolverManager::RecordTotalTime | - | 2019-10-30 |
| 968451 | Security: http authentication spoof (repro issue 928974) | - | 2019-10-29 |
| 984536 | sqlite3_lpm_fuzzer: Heap-buffer-overflow in sqlite3VdbeExec | - | 2019-10-29 |
| 984650 | sqlite3_lpm_fuzzer: Use-of-uninitialized-value in sqlite3VdbeRecordCompareWithSkip | - | 2019-10-29 |
| 985546 | sqlite3_lpm_fuzzer: Use-of-uninitialized-value in sqlite3CompareAffinity | - | 2019-10-29 |
| 985646 | Heap-use-after-free in blink::PaintLayerScrollableArea::InvalidateAllStickyConstraints | - | 2019-10-29 |
| 985781 | pdfium_xfa_fuzzer: Heap-buffer-overflow in fxcrt::RetainPtr<fxcrt::StringDataTemplate<wchar_t> >::RetainPtr | $5,000 | 2019-10-29 |
| 986008 | Bad-cast to blink::PaintLayer from invalid vptr in blink::PaintLayerScrollableArea::InvalidateAllStickyConstraints | - | 2019-10-29 |
| 986064 | Security: pdfium XFA CJX_Object::SetContent Use After Free | $5,000 | 2019-10-29 |
| 986262 | CVE-2019-13233 CrOS: Vulnerability reported in Linux kernel | - | 2019-10-29 |
| 548273 | Type confusion in ObjectBackedNativeHandler::Router | $5,000 | 2019-10-28 |
| 981873 | Security: UAF in ~LevelDBIteratorImpl | - | 2019-10-27 |
| 984475 | sqlite3_lpm_fuzzer: Crash in estimateIndexWidth | - | 2019-10-27 |
| 925269 | Use-of-uninitialized-value in TIFFYCbCrtoRGB | - | 2019-10-26 |
| 981608 | spvtools_opt_performance_fuzzer: Heap-use-after-free in spvtools::opt::InlinePass::IsInlinableFunctionCall | - | 2019-10-26 |
| 981609 | spvtools_opt_performance_fuzzer: Bad-cast to spvtools::opt::Instruction from invalid vptr in spvtools::opt::BasicBlock::id | - | 2019-10-26 |
| 983938 | Heap-use-after-free in gpu::gles2::Texture::ClearRenderableLevels | - | 2019-10-26 |
| 984868 | Use-after-poison in mojo::InterfaceEndpointClient::HandleValidatedMessage | - | 2019-10-26 |
| 984890 | Bad-cast to blink::GarbageCollectedMixin from invalid vptr in void blink::Visitor::TraceRoot<blink::ImageDownloaderBase> | - | 2019-10-26 |
| 985302 | Bad-cast to blink::ImageDownloaderBase from blink::ResponseBodyLoader in blink::MultiResolutionImageResourceFetcher::OnURLFetchComplete | - | 2019-10-26 |
| 847035 | Security: Chrome for iOS (CVE-2017-5385) HTML documents sent with multipart/x-mixed-replace ignores Referrer-Policy response header | - | 2019-10-25 |
| 981569 | spvtools_opt_legalization_fuzzer: Heap-use-after-free in spvtools::opt::BasicBlock::id | - | 2019-10-25 |
| 983867 | Security: Use-after-free in CPDFSDK_ActionHandler::ExecuteFieldAction | $5,000 | 2019-10-25 |
| 984809 | dawn_wire_server_and_frontend_fuzzer: Crash in dawn_native::IsArrayLayerValidForTextureViewDimension | - | 2019-10-25 |
| 985337 | CVE-2019-10639 CrOS: Vulnerability reported in Linux kernel | - | 2019-10-25 |
| 896533 | Security: IDN URL Spoofing with Georgian Letter Jil "á«" | $500 | 2019-10-24 |
| 984521 | Security: UAF due to double call to IndexedDBConnection::Close | - | 2019-10-24 |
| 984917 | CVE-2019-10638 CrOS: Vulnerability reported in Linux kernel | - | 2019-10-24 |
| 882363 | Security: fullscreen notification overlap | $1,000 | 2019-10-23 |
| 950027 | Incorrect-function-pointer-type in google::protobuf::internal::AddDescriptorsImpl | - | 2019-10-23 |
| 971408 | Have secure context checks in browser side code of Native File System API | - | 2019-10-23 |
| 974354 | GpuMemoryBufferImplIOSurface doesn't validate handle | - | 2019-10-23 |
| 977462 | Security: UAF in OfflinePageAutoFetcher::CancelSchedule | $10,000 | 2019-10-23 |
| 981291 | net_quic_stream_factory_fuzzer: Use-of-uninitialized-value in quic::HttpDecoder::ParsePriorityFrame | - | 2019-10-23 |
| 981785 | UAF in PDFium due to incorrect ref count | $3,000 | 2019-10-23 |
| 982648 | net_quic_stream_factory_fuzzer: Use-of-uninitialized-value in quic::HttpDecoder::ReadFrameType | - | 2019-10-23 |
| 983775 | Security: heap-use-after-free in blink::LayoutBlockFlow::AddChild | - | 2019-10-23 |
| 983785 | Bad-cast to blink::LayoutObject from invalid vptr in blink::LayoutObject::IsAnonymousBlock | - | 2019-10-23 |
| 983850 | Crash in v8::internal::Simulator::LoadStorePairHelper | - | 2019-10-23 |
| 983856 | Heap-use-after-free in blink::LayoutBox::SplitAnonymousBoxesAroundChild | - | 2019-10-23 |
| 983865 | Heap-use-after-free in blink::LayoutBlockFlow::AddChild | - | 2019-10-23 |
| 983970 | Heap-use-after-free in blink::LayoutBoxModelObject::MoveChildTo | - | 2019-10-23 |
| 821194 | Use SHA256 for instance IDs | - | 2019-10-22 |
| 921984 | CrOS: Vulnerability reported in app-text/qpdf | - | 2019-10-22 |
| 949032 | Security: Use-after-free in CXFA_FFWidget::OnKillFocus | $3,000 | 2019-10-22 |
| 968914 | this.print() should required a user gesture | - | 2019-10-22 |
| 980226 | Crash in Builtins_GetPropertyWithReceiver | - | 2019-10-22 |
| 961513 | Heap-buffer-overflow in Json::Reader::readArray | - | 2019-10-20 |
| 983344 | flexfec_receiver_fuzzer: Heap-buffer-overflow in webrtc::ForwardErrorCorrection::XorPayloads | - | 2019-10-20 |
| 983351 | forward_error_correction_fuzzer: Use-of-uninitialized-value in rtc::scoped_refptr<rtc::RefCountedObject<rtc::BufferT<unsigned char, false> > >: | - | 2019-10-20 |
| 983356 | ulpfec_receiver_fuzzer: Heap-buffer-overflow in webrtc::ByteReader<unsigned short, 2u, false>::ReadBigEndian | - | 2019-10-20 |
| 983385 | forward_error_correction_fuzzer: Bad-cast to rtc::RefCountedObject<rtc::BufferT<unsigned char, false> >rtc::CopyOnWriteBuffer::CloneDataIfReferenced in unsigned char* rtc::CopyOnWriteBuffer::data<unsigned char, | - | 2019-10-20 |
| 983400 | flexfec_receiver_fuzzer: Use-of-uninitialized-value in rtc::scoped_refptr<webrtc::ForwardErrorCorrection::Packet>::~scoped_refptr | - | 2019-10-20 |
| 983767 | Use-of-uninitialized-value in media::MediaMetricsProvider::GetUMANameForAVStream | - | 2019-10-20 |
| 983768 | Use-of-uninitialized-value in = | - | 2019-10-20 |
| 983773 | mediasource_WEBM_VP8_pipeline_integration_fuzzer: Use-of-uninitialized-value in media::operator== | - | 2019-10-20 |
| 977107 | UAP in offline audio context | $3,000 | 2019-10-19 |
| 980475 | Security: WebAssembly Table.Copy lead to OOB Write | $7,500 | 2019-10-18 |
| 980672 | ipp_message_parser_fuzzer: Heap-buffer-overflow in libcups.so.2 | - | 2019-10-18 |
| 981234 | Heap-use-after-free in libswiftshader_libGLESv2.dylib | - | 2019-10-18 |
| 981381 | ipp_message_parser_fuzzer: Heap-buffer-overflow in ipp_converter::ConvertIppToMojo | - | 2019-10-18 |
| 981385 | Crash in _platform_memmove$VARIANT$Nehalem | - | 2019-10-18 |
| 981573 | Use-of-uninitialized-value in blink::PaintLayerScrollableArea::InvalidateAllStickyConstraints | - | 2019-10-18 |
| 981585 | heap-use-after-free : blink::CanvasResourceProviderSharedImage::WillDraw | - | 2019-10-18 |
| 981590 | Crash in _platform_memmove$VARIANT$Nehalem | - | 2019-10-18 |
| 982153 | Bad-cast to blink::PaintLayer from invalid vptr in blink::PaintLayerScrollableArea::InvalidateAllStickyConstraints | - | 2019-10-18 |
| 982530 | Incorrect optimization causes memory corruption | - | 2019-10-18 |
| 982805 | Crash in _platform_memmove$VARIANT$Nehalem | - | 2019-10-18 |
| 983137 | Security: PDFium Bad cast in ToNode in cxfa_object.cpp | $5,000 | 2019-10-18 |
| 983293 | Use-of-uninitialized-value in content::RenderWidgetHostInputEventRouter::OnRenderWidgetHostViewBaseDestroyed | - | 2019-10-18 |
| 837936 | Security: Probing JS bytecode cache allows timing attack | - | 2019-10-17 |
| 969285 | CrOS: Vulnerability reported in net-misc/curl | - | 2019-10-17 |
| 979187 | CrOS: Vulnerability reported in dev-libs/expat | - | 2019-10-17 |
| 979373 | Security DCHECK failure: line_layout_item.IsLayoutInline() || line_layout_item.IsEqual(this) in layout_bl | - | 2019-10-17 |
| 980292 | Crash in Builtins_GetPropertyWithReceiver | - | 2019-10-17 |
| 982768 | pdfium_fuzzer: Use-of-uninitialized-value in float const& pdfium::clamp<float> | - | 2019-10-17 |
| 982828 | Security: heap-use-after-free in ~CPDFSDK_XFAWidget() (ProbeForLowSeverityLifetimeIssue) | - | 2019-10-17 |
| 977341 | heap-use-after-free : GrTextBlobCache::purgeStaleBlobs | - | 2019-10-16 |
| 979902 | pdf_codec_tiff_fuzzer: Negative-size-param in _TIFFmemcpy | - | 2019-10-16 |
| 980168 | DCHECK failure in !new_map->has_frozen_or_sealed_elements() in js-objects.cc | - | 2019-10-16 |
| 981232 | Crash in blink::PointerLockController::DidLosePointerLock | - | 2019-10-16 |
| 981459 | Bad-cast to blink::LayoutEmbeddedContent from blink::LayoutNGBlockFlow in blink::ToLayoutEmbeddedContent | - | 2019-10-16 |
| 951487 | Security: Two autocomplete flaws STILL allow stealing credit card numbers | $3,337 | 2019-10-15 |
| 980891 | Security: CSA_ASSERT failed: IsRegularHeapObjectSize(size_in_bytes) | - | 2019-10-15 |
| 981202 | Security: Memory corruption in BrowserList::NotifyBrowserNoLongerActive(Browser*) () | $500 | 2019-10-15 |
| 981528 | Security: PDFium (XFA) Use-after-free in CPDFSDK_Widget::HasXFAAAction | $5,000 | 2019-10-15 |
| 981602 | Heap-use-after-free in blink::InlineFlowBox::DeleteLine | - | 2019-10-15 |
| 971550 | Crash in qos_class_main | - | 2019-10-12 |
| 979923 | Use-of-uninitialized-value in blink::NGOffsetMapping::GetLastPosition | - | 2019-10-12 |
| 979972 | Heap-buffer-overflow in blink::FindBuffer::RangeFromBufferIndex | - | 2019-10-12 |
| 980448 | Heap-buffer-overflow in blink::FindBuffer::RangeFromBufferIndex | - | 2019-10-12 |
| 980450 | Crash in blink::FindBuffer::FindMatchInRange | - | 2019-10-12 |
| 980816 | OOB in SwiftShader textureSize | $2,000 | 2019-10-12 |
| 980843 | Sig11 in wasm | $500 | 2019-10-12 |
| 981412 | Container-overflow in CPDF_DeviceCS::GetRGB | - | 2019-10-12 |
| 977926 | Heap-use-after-free in blink::LargeTextFirst | $3,500 | 2019-10-10 |
| 979023 | DCHECK failure in number_of_own_descriptors > 0 in map-inl.h | - | 2019-10-10 |
| 980422 | DCHECK failure in bytecode->IsBytecodeEqual( *outer_function_job->compilation_info()->bytecode_arr | - | 2019-10-10 |
| 980811 | devtools_protocol_encoding_cbor_fuzzer: Heap-buffer-overflow in inspector_protocol_encoding::json::JSONEncoder<std::__Cr::basic_string<char, std | - | 2019-10-10 |
| 937587 | Heap-buffer-overflow in libcups.so.2 | - | 2019-10-09 |
| 937662 | Use-of-uninitialized-value in ipp_converter::ConvertIppToMojo | - | 2019-10-09 |
| 937664 | Use-of-uninitialized-value in ippReadIO | - | 2019-10-09 |
| 976753 | Security: heap-buffer-overflow in CFDE_TextEditEngine::AdjustGap | - | 2019-10-09 |
| 978180 | Use-After-Free in FT_Stream_ReleaseFrame | - | 2019-10-09 |
| 978575 | Security: PDFium (XFA) Use-after-free in CXFA_FFWidget::OnSetFocus | $3,000 | 2019-10-09 |
| 978382 | Incorrect heap object handling in v8 | $500 | 2019-10-09 |
| 980065 | Crash in v8::internal::SourcePositionTableIterator::Advance | - | 2019-10-08 |
| 979942 | Heap-use-after-free in blink::LayoutObject::UpdateFirstLineImageObservers | - | 2019-10-07 |
| 979951 | Heap-use-after-free in base::subtle::RefCountedBase::AddRefImpl | - | 2019-10-07 |
| 979505 | Bad-cast to net::URLRequestFtpJob from invalid vptr in net::URLRequestFtpJob::OnStartCompleted | $3,500 | 2019-10-06 |
| 976713 | Security: Possible to leak internal objects like arrayBufferConstructor_DoNotInitialize and InternalPackedArray via console utility functions | - | 2019-10-05 |
| 977778 | NGOffsetMappingBuilder::CollapseTrailingSpace() crashes with white-space:pre-wrap | - | 2019-10-05 |
| 953516 | Potential map end() access in MojoMjpegDecodeAcceleratorService | - | 2019-10-04 |
| 973352 | Heap-use-after-free in dawn_native::null::Buffer::CopyFromStaging | - | 2019-10-04 |
| 976573 | Bad-cast to dawn_native::null::Buffer from invalid vptr in dawn_native::null::BufferMapReadOperation::Execute | - | 2019-10-04 |
| 978082 | heap-use-after-free : cc::LayerTreeHostImpl::ImageDecodeFinished | - | 2019-10-04 |
| 979069 | Heap-buffer-overflow in blink::FindBuffer::RangeFromBufferIndex | - | 2019-10-04 |
| 979228 | DCHECK failure in bytecode->IsBytecodeEqual( *outer_function_job->compilation_info()->bytecode_arr | - | 2019-10-04 |
| 971544 | Use-of-uninitialized-value in GrBackendTexture::operator= | - | 2019-10-03 |
| 946260 | AppCache can be registered to arbitrary site with renderer compromise | $1,000 | 2019-10-02 |
| 970378 | Security: Sites can bypass restrictions on multiple downloads by redirecting page to about:srcdoc | $500 | 2019-10-02 |
| 976627 | v8 crash on regexp length check | $3,000 | 2019-10-02 |
| 977012 | DCHECK failure in descriptor_number < number_of_descriptors() in descriptor-array-inl.h | - | 2019-10-02 |
| 977458 | Use-of-uninitialized-value in blink::LayoutTreeBuilderForText::CreateLayoutObject | - | 2019-10-02 |
| 977832 | Heap-buffer-overflow in CFX_ReadOnlyMemoryStream::ReadBlockAtOffset | - | 2019-10-02 |
| 978277 | DCHECK failure in descriptor_number < number_of_descriptors() in descriptor-array-inl.h | - | 2019-10-02 |
| 978335 | Use-of-uninitialized-value in PageInfoUI::GetSecurityDescription | - | 2019-10-02 |
| 888322 | CVE-2018-14610 CrOS: Vulnerability reported in Linux kernel | - | 2019-10-01 |
| 949425 | pdfium (XFA): invalid vptr / uaf in CXFA_FFDocView::RunBindItems | $3,000 | 2019-10-01 |
| 976652 | CVE-2018-20669 CrOS: Vulnerability reported in Linux kernel | - | 2019-10-01 |
| 976939 | DCHECK failure in fresh->bit_field3() & ~IsInRetainedMapListBit::kMask == new_map->bit_field3() & | - | 2019-10-01 |
| 978050 | Use-of-uninitialized-value in v8::internal::GCTracer::CurrentEmbedderAllocationThroughputInBytesPerMillisecond | - | 2019-10-01 |
| 949999 | Bad-cast to MetricsLibraryInterface from MetricsLibrary in p2p::server::HttpServerExternalProcess::OnMessageReceived | - | 2019-09-30 |
| 960106 | ChromeOS Kernel integer overflow | - | 2019-09-30 |
| 966309 | Use-of-uninitialized-value in v8::internal::Simulator::FPCompare | - | 2019-09-29 |
| 977855 | CVE-2019-3896 CrOS: Vulnerability reported in Linux kernel | - | 2019-09-29 |
| 969256 | Int-overflow in CPDF_PSEngine::DoOperator | - | 2019-09-28 |
| 976136 | heap-use-after-free in ContextProvider | $3,000 | 2019-09-28 |
| 977089 | DCHECK failure in fresh->bit_field3() & ~IsInRetainedMapListBit::kMask == new_map->bit_field3() & | - | 2019-09-28 |
| 977467 | Crash in blink::MojoHandle::writeMessage | - | 2019-09-28 |
| 768526 | Cast should not use a web iframe inside a WebUI page | - | 2019-09-27 |
| 950328 | v8 crash on map-check | $3,000 | 2019-09-27 |
| 961674 | DCHECK failure in __isolate__->has_scheduled_exception() in isolate.cc | - | 2019-09-27 |
| 971293 | heap-use-after-free in Cancel::wasm-engine.cc | $1,000 | 2019-09-27 |
| 971702 | UAF in chrome!content::Portal::Activate | $8,000 | 2019-09-27 |
| 972354 | CVE-2019-3846 CrOS: Vulnerability reported in Linux kernel | - | 2019-09-27 |
| 973137 | Crash in quic::QuicDataReader::PeekVarInt62Length | - | 2019-09-27 |
| 973893 | Potential bad cast with non-string values | - | 2019-09-27 |
| 976859 | Security: heap-use-after-free in blink::NGPaintFragment::AssociateWithLayoutObject | $3,000 | 2019-09-27 |
| 976922 | DCHECK failure in fixed_array.IsNumberDictionary() in js-objects-inl.h | - | 2019-09-27 |
| 976923 | DCHECK failure in 0 == memcmp(reinterpret_cast<void*>(fresh->address()), reinterpret_cast<void*>(n | - | 2019-09-27 |
| 976932 | DCHECK failure in bytecode->IsBytecodeEqual( *outer_function_job->compilation_info()->bytecode_arr | - | 2019-09-27 |
| 976935 | Heap-use-after-free in CFX_Font::LoadSubst | - | 2019-09-27 |
| 976940 | Crash in ReadUnalignedValue<double> | - | 2019-09-27 |
| 976944 | Crash in v8::internal::Object::Number | - | 2019-09-27 |
| 964639 | CVE-2019-11833 CrOS: Vulnerability reported in Linux kernel | - | 2019-09-26 |
| 967993 | Crash in base::ObserverListThreadSafe<base::PowerObserver>::RemoveObserver | - | 2019-09-26 |
| 972921 | Security: v8 dcheck failure and fatal error | $3,000 | 2019-09-26 |
| 974760 | Security: heap-use-after-free in blink::NGBlockNode::SaveStaticOffsetForLegacy | $3,000 | 2019-09-26 |
| 976231 | Heap-use-after-free in CFX_Font::LoadSubst | - | 2019-09-26 |
| 976429 | Security: Use-of-uninitialized-value in CFWL_WidgetMgr::NextTab if Ctrl-Tab is pressed while editing an XFA form. | - | 2019-09-26 |
| 976924 | Crash in v8::internal::DictionaryElementsAccessor::CollectElementIndicesImpl | - | 2019-09-26 |
| 962572 | Use-after-poison in mojo::BindingSetBase<blink::mojom::blink::NavigationInitiator, mojo::Binding<bli | - | 2019-09-25 |
| 971740 | Security: URL bar spoofing on iOS with history.back() | $3,000 | 2019-09-25 |
| 972031 | CrOS: Vulnerability reported in app-editors/vim | - | 2019-09-25 |
| 974627 | DCHECK failure in index >= 0 && index < this->length() in fixed-array-inl.h | - | 2019-09-25 |
| 958002 | cros-machine-id-regen should quote file path when computing timestamp path | $1,000 | 2019-09-24 |
| 969368 | CHECK failure: (location_) != nullptr in maybe-handles.h | - | 2019-09-24 |
| 974091 | Security: PDFium Font Parsing Heap Use After Free Vulnerability | $3,000 | 2019-09-24 |
| 968081 | Use-of-uninitialized-value in v8::internal::Factory::NewNumber | - | 2019-09-23 |
| 964872 | Security: signed-integer-overflow in FX_RECT::Height | - | 2019-09-22 |
| 965067 | URL is updated incorrectly after navigating to an invalid URL | - | 2019-09-22 |
| 973103 | Security: site isolation bypass: request headers overwrite via URLLoader::FollowRedirect | - | 2019-09-22 |
| 973628 | Don't rewrite about:srcdoc into chrome://srcdoc (just as we make an exception for about:blank) | - | 2019-09-21 |
| 961237 | Security: jit difference on comparison in d8 | - | 2019-09-20 |
| 971904 | Heap-use-after-free in content::GpuChildThread::QuitMainMessageLoop | - | 2019-09-20 |
| 972239 | Heap-use-after-free in base::internal::WeakReference::IsValid | - | 2019-09-20 |
| 972413 | Use-of-uninitialized-value in blink::NGPaintFragment::ClearAssociationWithLayoutObject | - | 2019-09-20 |
| 972657 | Potential UAF in TRACE_EVENT call in FontLoader::openStream | - | 2019-09-20 |
| 973363 | Integer overflow in FastGetOwnValuesOrEntries | - | 2019-09-20 |
| 971761 | Use-of-uninitialized-value in spirv_cross::Compiler::CombinedImageSamplerUsageHandler::begin_function_scope | - | 2019-09-19 |
| 972623 | Bad parameters to --sanitizer-annotate-contiguous-container in shaderc_spvc_compile_options::~shaderc_spvc_compile_options | - | 2019-09-19 |
| 972627 | Bad parameters to --sanitizer-annotate-contiguous-container in shaderc_spvc_compile_options_release | - | 2019-09-19 |
| 973121 | Crash in v8::Value::ToString | - | 2019-09-19 |
| 973132 | Crash in v8::internal::ConcurrentMarkingVisitor::MarkObject | - | 2019-09-19 |
| 973136 | Crash in _platform_memmove$VARIANT$Nehalem | - | 2019-09-19 |
| 973138 | Crash in v8::internal::LookupIterator::State v8::internal::LookupIterator::LookupInRegula | - | 2019-09-19 |
| 973146 | Crash in v8::internal::String::GetFlatContent | - | 2019-09-19 |
| 973151 | Bad-cast to v8::String::ExternalStringResource from invalid vptr in v8::internal::ExternalTwoByteString::GetChars | - | 2019-09-19 |
| 972390 | Heap-use-after-free in quic::QuicDataReader::PeekVarInt62Length | - | 2019-09-18 |
| 972394 | Crash in AtomicallySetQuarantineFlagIfAllocated | - | 2019-09-18 |
| 973056 | URL is updated incorrectly when navigating to external app urls | $500 | 2019-09-18 |
| 973122 | Use-of-uninitialized-value in v8::internal::FixStaleLeftTrimmedHandlesVisitor::VisitRootPointers | - | 2019-09-18 |
| 964245 | Site Isolation breaking bug in filesystem | $5,000 | 2019-09-17 |
| 968988 | CVE-2019-12381 CrOS: Vulnerability reported in Linux kernel | - | 2019-09-17 |
| 968994 | CrOS: Vulnerability reported in dev-db/sqlite | - | 2019-09-17 |
| 968870 | Crash in blink::RemoteFrame::SetCcLayer | - | 2019-09-16 |
| 971752 | Heap-use-after-free in blink::LayoutBlockFlow::AddOverhangingFloats | - | 2019-09-16 |
| 972295 | Bad-cast to v8::internal::wasm::(anonymous namespace)::WasmGCForegroundTask from invalid vptr in v8::internal::wasm::WasmEngine::RemoveIsolateFromCurrentGC | - | 2019-09-16 |
| 968006 | Heap-buffer-overflow in mojo::SyncHandleRegistry::Wait | - | 2019-09-15 |
| 968007 | Heap-use-after-free in quic::QuicDataReader::ReadBytes | - | 2019-09-15 |
| 969321 | Use-of-uninitialized-value in quic::HttpDecoder::ReadFrameType | - | 2019-09-15 |
| 970644 | Bad-free in shaderc_spvc_compile_options_release | - | 2019-09-15 |
| 970909 | Crash in AtomicallySetQuarantineFlagIfAllocated | - | 2019-09-15 |
| 971551 | Use-of-uninitialized-value in spirv_cross::SPIRFunction& spirv_cross::Variant::get<spirv_cross::SPIRFunction> | - | 2019-09-15 |
| 971746 | Crash in AddressIsPoisoned | - | 2019-09-15 |
| 971757 | Crash in shaderc_spvc_compile_options::~shaderc_spvc_compile_options | - | 2019-09-15 |
| 929578 | Any extension can be disbled by simply adding a trailing slash | $500 | 2019-09-14 |
| 968985 | CVE-2019-12378 CrOS: Vulnerability reported in Linux kernel | - | 2019-09-14 |
| 968987 | CVE-2019-12380 CrOS: Vulnerability reported in Linux kernel | - | 2019-09-14 |
| 969333 | Use-of-uninitialized-value in gpu::gles2::GLES2Implementation::BindTexture | - | 2019-09-14 |
| 969525 | Crash in v8::internal::Heap::GcSafeFindCodeForInnerPointer | - | 2019-09-14 |
| 971606 | Use-of-uninitialized-value in gpu::gles2::GLES2Implementation::PackStringsToBucket | - | 2019-09-14 |
| 969083 | Heap-use-after-free in content::IndexedDBOriginState::AbortAllTransactions | - | 2019-09-13 |
| 969363 | Use-of-uninitialized-value in blink::GraphicsLayerUpdater::UpdateContext::CompositingContainer | - | 2019-09-13 |
| 971538 | Use-of-uninitialized-value in GrBackendTexture::operator= | - | 2019-09-13 |
| 971545 | Use-of-uninitialized-value in GrBackendTexture::operator= | - | 2019-09-13 |
| 901306 | CrOS: Vulnerability reported in media-libs/tiff | - | 2019-09-12 |
| 923647 | CrOS: Vulnerability reported in media-libs/tiff | - | 2019-09-12 |
| 959640 | Multiple file download protection bypass | $500 | 2019-09-12 |
| 960785 | Security: Heap-use-after-free in blink::PresentationAvailabilityState::UpdateAvailability | - | 2019-09-12 |
| 962947 | Use-of-uninitialized-value in vfnprintf | - | 2019-09-12 |
| 969055 | URL doesn't update correctly when tapped on Stop icon to stop page loading | - | 2019-09-12 |
| 969261 | Heap-buffer-overflow in CFF::CFF2FDSelect::sanitize | - | 2019-09-12 |
| 971537 | Use-of-uninitialized-value in GrBackendTexture::operator= | - | 2019-09-12 |
| 951974 | Crash in shaderc_spvc_compile_options::shaderc_spvc_compile_options | - | 2019-09-11 |
| 952081 | Crash in AtomicallySetQuarantineFlagIfAllocated | - | 2019-09-11 |
| 953985 | Crash in AddressIsPoisoned | - | 2019-09-11 |
| 954955 | Crash in shaderc_spvc_compile_options_release | - | 2019-09-11 |
| 955949 | Security: Chronos user can delete files as root at boot (cleanup-shutdown-logs.conf) | - | 2019-09-11 |
| 961413 | Use-after-poison in blink::xpath::Expression::AddSubExpression | - | 2019-09-11 |
| 967592 | Crash in shaderc_spvc_compile_options_clone | - | 2019-09-11 |
| 969520 | Crash in spirv_cross::Variant::empty | - | 2019-09-11 |
| 969521 | Heap-buffer-overflow in spirv_cross::Variant::Variant | - | 2019-09-11 |
| 957516 | Security: Heap-use-after-free in ProjectionFromFieldOfView | - | 2019-09-10 |
| 958318 | CVE-2019-11487 CrOS: Vulnerability reported in Linux kernel | - | 2019-09-10 |
| 959508 | Crash in blink::PersistentBase<blink::DummyGCBase, | - | 2019-09-10 |
| 962916 | CVE-2019-11884 CrOS: Vulnerability reported in Linux kernel | - | 2019-09-10 |
| 966263 | Security: signed integer overflow in CPDF_RenderStatus::ProcessType3Text | - | 2019-09-10 |
| 968984 | CVE-2019-11190 CrOS: Vulnerability reported in Linux kernel | - | 2019-09-10 |
| 969444 | Crash in blink::Deprecation::GenerateReport | - | 2019-09-10 |
| 969286 | Chromium: Vulnerability reported in sqlite | - | 2019-09-08 |
| 831725 | SameSite cookie bypass via prerender | $2,000 | 2019-09-07 |
| 907344 | Heap-buffer-overflow in spirv_cross::Compiler::parse | - | 2019-09-07 |
| 907718 | Crash in spirv_cross::Variant::get_type | - | 2019-09-07 |
| 943494 | Security: UAF on WebUSB (Windows, windows_usb.c) | - | 2019-09-07 |
| 950256 | Use-of-uninitialized-value in spirv_cross::SPIRConstant::SPIRConstant | - | 2019-09-07 |
| 951525 | Security: IntersectionObserver V2 fails for CSS property scale transform | $500 | 2019-09-07 |
| 951902 | Crash in spirv_cross::Variant::empty | - | 2019-09-07 |
| 952050 | Crash in spirv_cross::SPIRFunction& spirv_cross::Variant::get<spirv_cross::SPIRFunction> | - | 2019-09-07 |
| 952156 | Heap-buffer-overflow in spirv_cross::Variant::Variant | - | 2019-09-07 |
| 952505 | Crash in spirv_cross::VectorView<unsigned int>::begin | - | 2019-09-07 |
| 953094 | Heap-buffer-overflow in shaderc_spvc_compile_into_glsl | - | 2019-09-07 |
| 953935 | Heap-buffer-overflow in spirv_cross::Meta::Decoration::Decoration | - | 2019-09-07 |
| 954785 | Use-of-uninitialized-value in spirv_cross::SPIRFunction& spirv_cross::Variant::get<spirv_cross::SPIRFunction> | - | 2019-09-07 |
| 954969 | Heap-buffer-overflow in ??$allocate@AEBIAEBI_N@?$ObjectPool@USPIRConstant@spirv_cross@@@spirv_cross@@QEA | - | 2019-09-07 |
| 962956 | Crash in spirv_cross::ParsedIR::remove_typed_id | - | 2019-09-07 |
| 964768 | heap-use-after-free : strlen | - | 2019-09-07 |
| 965918 | Crash in spirv_cross::SPIRType& spirv_cross::Variant::get<spirv_cross::SPIRType> | - | 2019-09-07 |
| 967152 | Crash in spirv_cross::SPIRFunction const& spirv_cross::Variant::get<spirv_cross::SPIRFunc | - | 2019-09-07 |
| 967926 | Security: [Non-Exploitable] Crosh sandbox escape via command injection | - | 2019-09-07 |
| 967933 | Security: [Not Exploitable] seconds_compare method in network_diag does not quote parameters | - | 2019-09-07 |
| 967943 | Security: Command Injection in periodic_scheduler | - | 2019-09-07 |
| 968075 | Crash in spirv_cross::SPIRType& spirv_cross::Variant::get<spirv_cross::SPIRType> | - | 2019-09-07 |
| 964667 | Use-after-poison in mojo::BindingSetBase<blink::mojom::blink::NavigationInitiator, mojo::Binding<bli | - | 2019-09-06 |
| 966460 | DCHECK failure in object->HasSmiOrObjectElements() || object->HasDoubleElements() || object->HasFa | - | 2019-09-06 |
| 967978 | Heap-use-after-free in quic::QuicDataReader::PeekVarInt62Length | - | 2019-09-06 |
| 967996 | Use-of-uninitialized-value in blink::PerformanceResourceTiming::secureConnectionStart | - | 2019-09-06 |
| 968080 | Use-of-uninitialized-value in quic::HttpDecoder::ReadFrameType | - | 2019-09-06 |
| 929300 | BrowserPlugin architecture causes PDFs to be fetched into a cross-origin web renderer | - | 2019-09-05 |
| 966557 | Heap-use-after-free in content::IndexedDBDatabase::DeleteRequest::Perform | - | 2019-09-05 |
| 966960 | Heap-use-after-free in blink::TaskBase::TaskCompleted | - | 2019-09-05 |
| 967196 | Heap-use-after-free in ash::OverviewWindowDragController::StartNormalDragMode | - | 2019-09-05 |
| 967361 | Heap-use-after-free in blink::NGPaintFragment::RecalcContentsInkOverflow | - | 2019-09-05 |
| 964002 | Security: Latin KRA homograph | - | 2019-09-04 |
| 966784 | UAF in content::IndexedDBOriginState::AbortAllTransactions | $5,000 | 2019-09-04 |
| 967167 | Use-of-uninitialized-value in int blink::LazyLineBreakIterator::NextBreakablePosition<unsigned short, | - | 2019-09-04 |
| 967938 | Security: Command Injection in cr50-verify-ro.sh | - | 2019-09-04 |
| 665766 | Change on the credentials mode on redirect specified by the CORS algorithm should be propagated to net/ | $1,000 | 2019-09-03 |
| 953294 | Omnibox spoofing with data urls | - | 2019-09-03 |
| 962500 | Security: Security: Same Origin Policy bypass and local file disclosure via <portal> element | $10,000 | 2019-09-03 |
| 966762 | UAF in content::IndexedDBDatabase::ProcessRequestQueueAndMaybeRelease | $15,500 | 2019-09-03 |
| 967151 | CHECK failure: !v8::internal::FLAG_enable_slow_asserts || (IsExternalOneByteString()) in string | - | 2019-09-03 |
| 967118 | Heap-buffer-overflow in dawn_native::DeviceBase::CreateBufferMapped | - | 2019-09-01 |
| 958717 | DCHECK failure in IrOpcode::kPhi == callee->opcode() in js-inlining-heuristic.cc | - | 2019-08-31 |
| 966454 | Container-overflow in content::IndexedDBFactoryImpl::ContextDestroyed | - | 2019-08-31 |
| 966572 | Container-overflow in base::TaskAnnotator::RunTask | - | 2019-08-31 |
| 966812 | Crash in blink::WorkletPendingTasks::Abort | - | 2019-08-31 |
| 936900 | Security: CORS issue with Chrome Extensions | $500 | 2019-08-30 |
| 950000 | Incorrect-function-pointer-type in base::internal::CallbackBase< | - | 2019-08-30 |
| 964607 | Security: WebAssembly duplicate indirect_function_table lead to OOB Write | $3,000 | 2019-08-30 |
| 965633 | Heap-use-after-free in dawn_native::SamplerBase::EqualityFunc::operator | - | 2019-08-30 |
| 966224 | Use-of-uninitialized-value in v8::internal::wasm::CompilationStateImpl::GetNextCompilationUnit | - | 2019-08-30 |
| 966555 | Use-of-uninitialized-value in extensions::MimeHandlerViewContainerManager::DestroyFrameContainer | - | 2019-08-30 |
| 961597 | Bad-cast to blink::LocalFrameView from blink::WebPluginContainerImpl in blink::RootScrollerController::ApplyRootScrollerProperties | - | 2019-08-29 |
| 964818 | Integer-overflow in inspector_protocol_encoding::cbor::CBORTokenizer::ReadNextToken | - | 2019-08-29 |
| 964928 | Security: JS execution inside ScriptForbiddenScope leading to UAF | - | 2019-08-29 |
| 964924 | Bad-cast to blink::LayoutObject from invalid vptr in blink::LayoutBlockFlow* blink::DynamicTo<blink::LayoutBlockFlow, blink::LayoutOb | - | 2019-08-28 |
| 965630 | Use-of-uninitialized-value in v8::internal::Factory::NewStringFromTwoByte | - | 2019-08-28 |
| 957324 | CrOS: Vulnerability reported in app-text/ghostscript-gpl | - | 2019-08-27 |
| 963346 | CHECK failure: (map()->has_fast_smi_or_object_elements() || map()->has_frozen_or_sealed_element | - | 2019-08-27 |
| 964762 | Heap-use-after-free in AppListClientImpl::OpenSearchResult | - | 2019-08-27 |
| 964813 | Bad-cast to blink::NGPaintFragment from invalid vptr in blink::LayoutBox::ResolvedDirection | - | 2019-08-27 |
| 965299 | DCHECK failure in trap_handler::IsTrapHandlerEnabled() == trap_handler::IsThreadInWasm() in runtim | - | 2019-08-27 |
| 958532 | Use-of-uninitialized-value in p2p::server::HttpServerExternalProcess::OnMessageReceived | - | 2019-08-26 |
| 960111 | ChromeOS privilege escalation | - | 2019-08-26 |
| 964619 | Bad-cast to blink::NGPaintFragment from invalid vptr in blink::LayoutText::FirstLineBoxTopLeft | - | 2019-08-26 |
| 963341 | Use-of-uninitialized-value in blink::LayoutObject::DestroyAndCleanupAnonymousWrappers | - | 2019-08-25 |
| 964171 | Use-of-uninitialized-value in blink::ListItemOrdinal::NextListItem | - | 2019-08-25 |
| 964675 | Heap-use-after-free in scoped_refptr<base::SingleThreadTaskRunner>::scoped_refptr | - | 2019-08-25 |
| 962083 | Use-of-uninitialized-value in sqlite3IntFloatCompare | - | 2019-08-24 |
| 963831 | Bad-cast to blink::LayoutInline from invalid vptr in blink::ToLayoutInline | - | 2019-08-24 |
| 963579 | Use-of-uninitialized-value in blink::LayoutTreeBuilderTraversal::NextSiblingLayoutObject | - | 2019-08-24 |
| 960109 | ChromeOS persistence bug | - | 2019-08-24 |
| 961998 | Crash in inspector_protocol_encoding::cbor::CBORTokenizer::ReadNextToken | - | 2019-08-24 |
| 963409 | Use-of-uninitialized-value in base::UTF16ToUTF8 | - | 2019-08-24 |
| 964218 | Heap-buffer-overflow in void inspector_protocol_encoding::cbor::EncodeBinaryTmpl<std::__Cr::vector<unsig | - | 2019-08-24 |
| 964178 | DCHECK failure in TypeOf(node->InputAt(0)).IsNone() in simplified-lowering.cc | - | 2019-08-23 |
| 952073 | Heap-use-after-free in scoped_refptr<base::SingleThreadTaskRunner>::scoped_refptr | - | 2019-08-23 |
| 958689 | UaF in SharedWorkerClient::OnScriptLoadFailed | - | 2019-08-23 |
| 958963 | Security: Sign in to Chrome OS using Smart Lock without entering PIN on Android device | $6,337 | 2019-08-23 |
| 959193 | Heap-buffer-overflow in u_strlen_64 | - | 2019-08-23 |
| 962368 | Security: Wrong url in omnibox on iOS (URL spoof) | - | 2019-08-23 |
| 963060 | Bad-cast to blink::DisplayItemClient from invalid vptr in blink::DisplayItemRasterInvalidator::Generate | - | 2019-08-23 |
| 963076 | Use-of-uninitialized-value in handle_vdm_request | - | 2019-08-23 |
| 963463 | Crash in v8::internal::FullMaybeObjectSlot::Relaxed_Store | - | 2019-08-23 |
| 963464 | Crash in ptr | - | 2019-08-23 |
| 963466 | Crash in v8::internal::FeedbackVector::SetOptimizationMarker | - | 2019-08-23 |
| 963681 | Crash in chrome | - | 2019-08-23 |
| 963687 | Crash in v8::internal::Simulator::LoadStoreHelper | - | 2019-08-23 |
| 963890 | Bad-cast to blink::LayoutObject from invalid vptr in blink::NGPhysicalFragment::HasLayer | - | 2019-08-23 |
| 964109 | Use-of-uninitialized-value in pd_update_pdo_flags | - | 2019-08-23 |
| 951880 | URL spoofing with post urls | - | 2019-08-22 |
| 960209 | Chrome CORS Causes Unauthorized File Download and Arbitrary File Execution on macOS | $500 | 2019-08-22 |
| 963278 | Heap-use-after-free in SlowLastChild | - | 2019-08-22 |
| 963461 | DCHECK failure in has_feedback_vector() in js-objects-inl.h | - | 2019-08-22 |
| 963568 | DCHECK failure in descriptor_number < number_of_descriptors() in descriptor-array-inl.h | - | 2019-08-22 |
| 622974 | Another case where incorrect origin is sent with message event | - | 2019-08-21 |
| 952709 | Heap-use-after-free in SerialChooserController::OnGetDevices | - | 2019-08-21 |
| 958718 | DCHECK failure in RegionObservability::kObservable == region_observability_ in effect-control-line | - | 2019-08-21 |
| 960331 | Heap-buffer-overflow in BEInt<unsigned short, 2>::operator unsigned short | - | 2019-08-21 |
| 961972 | Use-of-uninitialized-value in blink::LayoutInline::ContinuationBefore | - | 2019-08-21 |
| 961973 | Bad-cast to blink::LayoutObject from invalid vptr in blink::LayoutInline::WillBeDestroyed | - | 2019-08-21 |
| 961977 | Use-of-uninitialized-value in blink::FloatRoundedRect::IncludeLogicalEdges | - | 2019-08-21 |
| 961989 | Crash in blink::LayoutBlockFlow::WillBeDestroyed | - | 2019-08-21 |
| 961990 | Use-of-uninitialized-value in blink::BoxPainterBase::FillLayerInfo::FillLayerInfo | - | 2019-08-21 |
| 962008 | Heap-use-after-free in blink::NGPaintFragment::TryMarkLastLineBoxDirtyFor | - | 2019-08-21 |
| 962027 | Bad-cast to blink::LayoutObject from invalid vptr in blink::HTMLFrameOwnerElement::GetLayoutEmbeddedContent | - | 2019-08-21 |
| 962086 | [LayoutNG] Bad-cast to blink::LayoutObject from invalid vptr in blink::Node::DetachLayoutTree | - | 2019-08-21 |
| 962088 | Bad-cast to blink::LayoutObject from invalid vptr in blink::EndsOfNodeAreVisuallyDistinctPositions | - | 2019-08-21 |
| 962141 | Heap-use-after-free in GetDocument | - | 2019-08-21 |
| 962273 | Heap-use-after-free in IsInline | - | 2019-08-21 |
| 962338 | Use-of-uninitialized-value in blink::NGBoxFragmentPainter::PaintObject | - | 2019-08-21 |
| 962841 | Heap-use-after-free in blink::LayoutObject::PreviousInPreOrder | - | 2019-08-21 |
| 961979 | Crash in blink::Document::View | - | 2019-08-20 |
| 961985 | Bad-cast to blink::LayoutObject from invalid vptr in blink::LayoutBlockFlow::InlineElementContinuation | - | 2019-08-20 |
| 962065 | Heap-use-after-free in blink::LayoutBlockFlow::InlineElementContinuation | - | 2019-08-20 |
| 962172 | Bad-cast to blink::LayoutInline from invalid vptr in blink::ToLayoutInline | - | 2019-08-20 |
| 962197 | Heap-use-after-free in blink::LayoutBlockFlow::NodeForHitTest | - | 2019-08-20 |
| 962275 | Security DCHECK failure: !object || (object->IsText()) in layout_text.h | $3,500 | 2019-08-20 |
| 962468 | Use-of-uninitialized-value in v8::internal::compiler::Schedule::block | - | 2019-08-20 |
| 962474 | DCHECK failure in effect_edges > 0 in verifier.cc | - | 2019-08-20 |
| 957160 | Use-after-poison in blink::UpdatePlaceholderImage | - | 2019-08-19 |
| 958510 | Use-of-uninitialized-value in pd_partner_port_reset | - | 2019-08-19 |
| 961943 | Use-of-uninitialized-value in blink::NGInlineLayoutStateStack::UpdateAfterReorder | - | 2019-08-19 |
| 961773 | DCHECK failure in !ExpectedTransitionKey().is_null() in transitions-inl.h | - | 2019-08-18 |
| 950230 | Heap-buffer-overflow in materialize | - | 2019-08-17 |
| 959390 | Security: Access-Control-Expose-Headers is not honored for redirects | $500 | 2019-08-17 |
| 949413 | pdfium (XFA): wrong object type / uaf in SyncContainer | $3,000 | 2019-08-16 |
| 957521 | Security: Heap-use-after-free in XRView::UpdateProjectionMatrixFromAspect | - | 2019-08-16 |
| 958072 | Heap-buffer-overflow in libGLESv2_swiftshader | - | 2019-08-16 |
| 959747 | Unknown signal in Builtins_StoreFastElementIC_GrowNoTransitionHandleCOW | - | 2019-08-16 |
| 954818 | Security: Crosh privilege escalation / sandbox escape via command injection in set_arpgw | $5,500 | 2019-08-15 |
| 957405 | DCHECK failure in trap_handler::IsTrapHandlerEnabled() == trap_handler::IsThreadInWasm() in runtim | - | 2019-08-15 |
| 957522 | Security: Heap-use-after-free in ShapeDetector::DetectShapesOnImageData | - | 2019-08-15 |
| 959727 | DCHECK failure in !IsElement() in lookup.h | - | 2019-08-15 |
| 960520 | Use-of-uninitialized-value in BN_bin2bn | - | 2019-08-15 |
| 960680 | Bad-cast to v8::String::ExternalOneByteStringResource from v8::internal::SimpleStringResource<unsigned short, v8::String::ExternalStringResource> in v8::internal::ExternalOneByteString::GetChars | - | 2019-08-15 |
| 960735 | Heap-use-after-free in blink::SnapCoordinator::UpdateSnapContainerData | - | 2019-08-15 |
| 960753 | CVE-2019-11811 CrOS: Vulnerability reported in Linux kernel | - | 2019-08-15 |
| 960775 | Use-after-poison in blink::PersistentBase<blink::Document, | - | 2019-08-15 |
| 949418 | Heap-buffer-overflow in courgette::DisassemblerElf32::ExtractAbs32Locations | - | 2019-08-14 |
| 959066 | Use-of-uninitialized-value in courgette::DisassemblerElf32ARM::RelToRVA | - | 2019-08-14 |
| 959264 | Use-of-uninitialized-value in setvar_ | - | 2019-08-14 |
| 959534 | CVE-2019-11599 CrOS: Vulnerability reported in Linux kernel | - | 2019-08-14 |
| 959538 | CVE-2019-7222 CrOS: Vulnerability reported in Linux kernel | - | 2019-08-14 |
| 959563 | Heap-use-after-free in headless::HeadlessShell::Shutdown | - | 2019-08-14 |
| 959745 | Crash in blink::FrameLoader::StartNavigation | - | 2019-08-14 |
| 951795 | Security: Use-after-free in WasmMemoryObject::Grow | - | 2019-08-13 |
| 957092 | Use-of-uninitialized-value in gpu::gles2::GLES2Implementation::BindTexture | - | 2019-08-13 |
| 957285 | Bad-cast to base::sequence_manager::TaskQueue from invalid vptr in base::sequence_manager::ThreadManager::PostDelayedTask | - | 2019-08-13 |
| 958528 | Use-of-uninitialized-value in BN_div | - | 2019-08-13 |
| 958525 | Use-of-uninitialized-value in bn_mul_comba8 | - | 2019-08-13 |
| 958755 | Bad-cast to headless::HeadlessWebContents from invalid vptr in headless::HeadlessShell::Shutdown | - | 2019-08-13 |
| 959192 | Heap-use-after-free in content::FileSystemManagerImpl::Open | - | 2019-08-13 |
| 959518 | Security DCHECK failure: !NeedsLayout() || LayoutBlockedByDisplayLock(DisplayLockContext::kChildren) in l | - | 2019-08-13 |
| 959645 | DCHECK failure in value->IsSmi() in objects-debug.cc | - | 2019-08-13 |
| 959835 | Security DCHECK failure: !object || (object->IsLayoutEmbeddedContent()) in layout_embedded_content.h | - | 2019-08-13 |
| 956851 | Heap-use-after-free in fts3DisconnectMethod | - | 2019-08-11 |
| 958787 | Bad-cast to blink::LayoutEmbeddedContent from blink::LayoutImage in blink::HTMLFrameOwnerElement::SetEmbeddedContentView | - | 2019-08-11 |
| 959387 | Bad-cast to v8::internal::compiler::GapResolver::Assembler from invalid vptr in v8::internal::compiler::GapResolver::Resolve | - | 2019-08-11 |
| 959381 | Crash in v8::internal::OwnedVector<unsigned char>::New | - | 2019-08-11 |
| 959541 | Heap-buffer-overflow in v8::internal::Assembler::jmp | - | 2019-08-11 |
| 952682 | DCHECK failure in value->IsSmi() in objects-debug.cc | - | 2019-08-10 |
| 956391 | CrOS: Vulnerability reported in dev-db/sqlite | - | 2019-08-10 |
| 958307 | Heap-use-after-free in net::MDnsClientImpl::Core::DoCleanup | - | 2019-08-10 |
| 958531 | Use-of-uninitialized-value in setvar | - | 2019-08-10 |
| 958759 | CHECK failure: (location_) != nullptr in maybe-handles.h | - | 2019-08-10 |
| 958872 | Use-of-uninitialized-value in v8::internal::JsonParser<unsigned char>::ParseJsonNumber | - | 2019-08-10 |
| 959024 | Incorrect-function-pointer-type in blink::InputType::Create | - | 2019-08-10 |
| 959014 | Crash in v8::internal::wasm::NativeModule::AddCodeWithCodeSpace | - | 2019-08-10 |
| 959031 | Crash in v8::internal::wasm::NativeModule::runtime_stub_entry | - | 2019-08-10 |
| 959064 | Crash in apply | - | 2019-08-10 |
| 959107 | Crash in v8::internal::OwnedVector<unsigned char>::New | - | 2019-08-10 |
| 959190 | Bad-cast to v8::internal::AssemblerBuffer from invalid vptr in v8::internal::Assembler::GrowBuffer | - | 2019-08-10 |
| 959197 | Heap-buffer-overflow in WriteUnalignedValue<unsigned | - | 2019-08-10 |
| 959199 | Bad-cast to v8::internal::compiler::CodeGeneratorv8::internal::compiler::CodeGenerator::AssembleCode in void v8::internal::compiler::PipelineImpl::Run<v8::internal::compiler::AssembleC | - | 2019-08-10 |
| 959263 | Heap-buffer-overflow in emit | - | 2019-08-10 |
| 959275 | Bad-cast to v8::internal::AssemblerBufferv8::internal::Assembler::GrowBuffer in v8::internal::Assembler::emit_mov | - | 2019-08-10 |
| 959271 | Crash in ReadUnalignedValue<unsigned | - | 2019-08-10 |
| 959386 | Crash in apply | - | 2019-08-10 |
| 959472 | Bad-cast to v8::internal::AssemblerBuffer from invalid vptr in v8::internal::Assembler::GrowBuffer | - | 2019-08-10 |
| 959484 | Crash in v8::internal::compiler::InstructionSequence::InstructionBlockAt | - | 2019-08-10 |
| 954891 | Security: OOB Read in ReflexHash::checkTriangle | - | 2019-08-09 |
| 957323 | CVE-2019-8980 CrOS: Vulnerability reported in Linux kernel | - | 2019-08-09 |
| 947858 | Crash in Builtins_InterpreterEntryTrampoline | - | 2019-08-08 |
| 956531 | CrOS: Vulnerability reported in app-arch/tar | - | 2019-08-08 |
| 957335 | Bad-cast to content::RenderFrameImpl from invalid vptr in content::RenderFrameImpl::CommitFailedNavigationInternal | - | 2019-08-08 |
| 957436 | Security: heap-use-after-free in content::RenderFrameImpl::CommitFailedNavigationInternal | $3,000 | 2019-08-08 |
| 957830 | Use-of-uninitialized-value in inspector_protocol_encoding::json::JsonParser<unsigned char>::Parse | - | 2019-08-08 |
| 958151 | Use-of-uninitialized-value in v8::internal::JsonParser<unsigned char>::ParseJsonNumber | - | 2019-08-08 |
| 958457 | Use after free in PresentationAvailabilityState | - | 2019-08-08 |
| 875546 | Use-of-uninitialized-value in gfx::Tween::IntValueBetween | - | 2019-08-07 |
| 893087 | Security: pageCapture permission allows access to arbitrary local files and chrome:// pages | $500 | 2019-08-07 |
| 951322 | Crash in v8::internal::Simulator::LoadStorePairHelper | - | 2019-08-07 |
| 954762 | Heap-buffer-overflow in webrtc::MouseCursorMonitorX11::CaptureCursor | - | 2019-08-07 |
| 956414 | CVE-2019-10125 CrOS: Vulnerability reported in Linux kernel | - | 2019-08-07 |
| 956597 | Security: UAF in ServiceWorkerPaymentInstrument | $5,000 | 2019-08-07 |
| 956947 | Heap-use-after-free in CPDF_ShadingPattern::Load() | $6,000 | 2019-08-07 |
| 957321 | CVE-2013-7470 CrOS: Vulnerability reported in Linux kernel | - | 2019-08-07 |
| 956389 | CrOS: Vulnerability reported in net-misc/curl | - | 2019-08-06 |
| 957814 | Heap-use-after-free in CPDF_RenderStatus::RenderObjectList | - | 2019-08-06 |
| 956416 | CVE-2019-7221 CrOS: Vulnerability reported in Linux kernel | - | 2019-08-05 |
| 956426 | DCHECK failure in old_descriptors_->GetDetails(modified_descriptor_) .representation() .Equals(new | - | 2019-08-05 |
| 949887 | Bad-cast to blink::PaintLayer from invalid vptr in blink::PaintLayerScrollableArea::InvalidateAllStickyConstraints | - | 2019-08-04 |
| 956418 | CVE-2019-9213 CrOS: Vulnerability reported in Linux kernel | - | 2019-08-04 |
| 928551 | HTTPS proxies can redirect CONNECT | - | 2019-08-03 |
| 956415 | CVE-2019-6974 CrOS: Vulnerability reported in Linux kernel | - | 2019-08-03 |
| 956428 | Crash in v8::Isolate::GetCurrentContext | - | 2019-08-03 |
| 946395 | Bad-cast to content::RenderFrameImpl from invalid vptr in content::RenderFrameImpl::CommitFailedNavigationInternal | - | 2019-08-02 |
| 955047 | Use-of-uninitialized-value in blink::AddressCache::Lookup | - | 2019-08-02 |
| 956427 | Bad-cast to blink::LocalFrameView from blink::WebPluginContainerImpl in blink::HTMLFrameOwnerElement::OnViewportIntersectionChanged | - | 2019-08-02 |
| 893258 | WebAuthN dialog elides long RP ID (hostnames) on the right | - | 2019-08-01 |
| 948564 | Parameter passing error and Integer overflow in media_stream.mojom which could be used through ipc | - | 2019-08-01 |
| 956393 | CVE-2019-10124 CrOS: Vulnerability reported in Linux kernel | - | 2019-08-01 |
| 951712 | Security: pdfium SEGV on unknown address in CXFA_Graphics::FillPathWithShading | $1,000 | 2019-07-31 |
| 952301 | pdfium (XFA): oob array read in CXFA_Graphics::FillPathWithShading | $1,000 | 2019-07-31 |
| 952581 | Use-of-uninitialized-value in quic::QuicFramer::DecryptPayload | - | 2019-07-31 |
| 952849 | Security: Use-after-free in AudioWorkletGlobalScope::Process | - | 2019-07-31 |
| 953659 | v8 engine element kind type logic panic | - | 2019-07-31 |
| 952406 | Security: Possible OOB related to chrome_sqlite3_malloc | $500 | 2019-07-30 |
| 954703 | Heap-buffer-overflow in DirectiveHeaderValueParser::DirectiveHeaderValueParser | - | 2019-07-30 |
| 954760 | Heap-buffer-overflow in domain_reliability::DomainReliabilityHeader::Parse | - | 2019-07-30 |
| 951262 | Crash in rr::optimize | - | 2019-07-28 |
| 952041 | Heap-buffer-overflow in shaderc_spvc_compile_options_clone | - | 2019-07-28 |
| 951218 | Heap-use-after-free in blink::NGOffsetMappingUnit::AssociatedNode | - | 2019-07-27 |
| 932610 | Roll libxslt to downstream a security fix | - | 2019-07-25 |
| 940285 | Heap-use-after-free in content::UtilityServiceFactory::RunNetworkServiceOnIOThread | - | 2019-07-25 |
| 951988 | DCHECK failure in 0u == length in builtins-array.cc | - | 2019-07-25 |
| 952749 | CHECK failure: !v8::internal::FLAG_enable_slow_asserts || (IsJSGlobalProxy()) in js-objects-inl | - | 2019-07-25 |
| 953157 | DCHECK failure in (current_scope) != nullptr in wasm-code-manager.cc | - | 2019-07-25 |
| 953179 | DCHECK failure in (current_scope) != nullptr in wasm-code-manager.cc | - | 2019-07-25 |
| 919300 | Use-of-uninitialized-value in avx::store_bgra | $1,500 | 2019-07-24 |
| 926219 | Use-of-uninitialized-value in sse41::blit_row_s32a_opaque | - | 2019-07-24 |
| 934161 | Use-of-uninitialized-value in avx::store_NUMBER | $1,500 | 2019-07-24 |
| 950531 | Security: LoadComBaseFunction susceptible to dll preloading | - | 2019-07-24 |
| 952340 | Use-of-uninitialized-value in blink::UserMediaRequest::Create | - | 2019-07-24 |
| 952658 | VP9 deadlock with change in tile count | - | 2019-07-24 |
| 952722 | DCHECK failure in is_resolved() in ast.h | - | 2019-07-24 |
| 953233 | Use-of-uninitialized-value in v8::internal::interpreter::ConstantArrayBuilder::ToFixedArray | - | 2019-07-24 |
| 947029 | Security: heap-use-after-free in SMILTimeContainer::UpdateAnimations() | $3,000 | 2019-07-23 |
| 949417 | Use-of-uninitialized-value in disk_cache::BackendImpl::NewEntry | - | 2019-07-23 |
| 952594 | Security: SEGV with canvas strokeText | - | 2019-07-23 |
| 952389 | Bad-cast to blink::LayoutBlockFlow from blink::LayoutInline in blink::CompositeEditCommand::AddBlockPlaceholderIfNeeded | - | 2019-07-22 |
| 952384 | Bad-cast to blink::LayoutBlockFlow from blink::LayoutTable in blink::LayoutBlockFlow& blink::To<blink::LayoutBlockFlow, blink::LayoutObject> | - | 2019-07-22 |
| 952564 | Crash in avx::lowp::scale_u8 | - | 2019-07-22 |
| 952565 | Crash in ssse3::blit_mask_d32_a8 | - | 2019-07-22 |
| 952566 | Crash in _ZN3avx4lowpL7lerp_u8EmPPvmmDv8_tS3_S3_S3_S3_S3_S3_S3_$dc6b7024eef44a823ed47e292 | - | 2019-07-22 |
| 952568 | Crash in Sk4px::Load4Alphas | - | 2019-07-22 |
| 952574 | Crash in void mergeT<unsigned char> | - | 2019-07-22 |
| 952575 | Crash in blend_row_A8 | - | 2019-07-22 |
| 952582 | Crash in load<unsigned char __attribute__ | - | 2019-07-22 |
| 952590 | Crash in SkARGB32_Opaque_Blitter::blitMask | - | 2019-07-22 |
| 952595 | Crash in load<unsigned char __attribute__ | - | 2019-07-22 |
| 952598 | Crash in _platform_memmove$VARIANT$Nehalem | - | 2019-07-22 |
| 952603 | Crash in SkBlitter::blitMask | - | 2019-07-22 |
| 952615 | Crash in bits_to_runs | - | 2019-07-22 |
| 952626 | Crash in MapDstAlpha< | - | 2019-07-22 |
| 952629 | Crash in void Sk4px::MapDstAlpha<ssse3::blit_mask_d32_a8_black | - | 2019-07-22 |
| 952666 | Crash in sse2::lerp_u8 | - | 2019-07-22 |
| 952649 | Crash in void Sk4px::MapDstSrcAlpha<Sk4px | - | 2019-07-22 |
| 948499 | Use-of-uninitialized-value in gpu::gles2::GLES2Implementation::BufferDataHelper | - | 2019-07-21 |
| 951438 | DCHECK failure in GetReadOnlyRoots().fixed_cow_array_map() != map() in fixed-array-inl.h | $3,500 | 2019-07-21 |
| 924227 | Heap-buffer-overflow in spirv_cross::SPIRConstant& spirv_cross::variant_set<spirv_cross::SPIRConstant, u | - | 2019-07-20 |
| 924735 | Security: Marvell Avastar WiFi vulnerability | - | 2019-07-20 |
| 951164 | DCHECK failure in IsFastElementsKind(array->GetElementsKind()) in elements.cc | - | 2019-07-20 |
| 951780 | DCHECK failure in IsDoubleElementsKind(Subclass::kind()) in elements.cc | - | 2019-07-20 |
| 925244 | CHECK failure: node->opcode() == IrOpcode::kParameter || node->opcode() == IrOpcode::kProjectio | - | 2019-07-19 |
| 948575 | Security: Potential UAF in FidoBleDiscovery | - | 2019-07-19 |
| 948944 | CHECK failure: !address.is_initialized() || sizeof(*data_) == address.BlockSize() in storage_bl | - | 2019-07-19 |
| 950318 | Heap-use-after-free in disk_cache::MappedFile::Load | - | 2019-07-19 |
| 951374 | DCHECK failure in to_kind == DICTIONARY_ELEMENTS || to_kind == SLOW_STRING_WRAPPER_ELEMENTS || IsF | - | 2019-07-19 |
| 925788 | Security: PDFium Heap Buffer Overflow in CXFA_TextLayout::DoLayout | $1,000 | 2019-07-18 |
| 932900 | pdfium XFA CXFA_FFDocView::RunSubformIndexChange Use After Free | $3,000 | 2019-07-18 |
| 947342 | Security: heap-buffer-overflow TextureD3D_2DArray::getImage | $1,000 | 2019-07-18 |
| 950848 | Use-of-uninitialized-value in webrtc::AudioDecoderMultiChannelOpusConfig::IsOk | - | 2019-07-18 |
| 950747 | DCHECK: !initializing_store && property_details_.constness() == PropertyConstness::kConst implies IsConstFieldValueEqualTo(*value) | - | 2019-07-18 |
| 951216 | Use-after-poison in blink::ThreadableLoader::Cancel | - | 2019-07-18 |
| 925787 | Security: PDFium Heap Buffer Overflow in CXFA_LayoutPageMgr::FinishPaginatedPageSets | $1,000 | 2019-07-17 |
| 933163 | pdfium XFA CXFA_FFDocView::RunValidate Use After Free | $3,000 | 2019-07-17 |
| 950005 | Security: PDF plugin is allowed to use Pepper TCPServerSocketPrivate API | - | 2019-07-17 |
| 950592 | Use-of-uninitialized-value in mojo::core::ChannelPosix::WriteNoLock | - | 2019-07-17 |
| 944424 | UAF in TaskQueueImpl::CreateTaskRunner | $3,000 | 2019-07-16 |
| 949996 | CHECK failure: !v8::internal::FLAG_enable_slow_asserts || (IsName()) in name-inl.h | - | 2019-07-16 |
| 950275 | Use-of-uninitialized-value in blink::TransformationMatrix::ToSkMatrix44 | - | 2019-07-15 |
| 950254 | Use-of-uninitialized-value in SkMatrix44::recomputeTypeMask | - | 2019-07-15 |
| 935735 | Use-of-uninitialized-value in blink::AddressCache::Lookup | - | 2019-07-14 |
| 901665 | Index-out-of-bounds in vrend_set_single_abo | - | 2019-07-13 |
| 936741 | Heap-buffer-overflow in courgette::DetectDisassembler | - | 2019-07-13 |
| 925614 | protocol property of URL including specific character doesn't return correct value | $500 | 2019-07-12 |
| 934112 | Heap-buffer-overflow in courgette::DisassemblerWin32::ParseHeader | - | 2019-07-12 |
| 943709 | libANGLE heap-buffer-overflow triggered by WebGL2 on Windows 10 | $1,000 | 2019-07-12 |
| 944865 | DCHECK failure in object->FitsRepresentation(representation) in objects.cc | - | 2019-07-12 |
| 948172 | Security: PDF plugin is allowed to use Pepper Socket API | - | 2019-07-12 |
| 948990 | Bad-cast to blink::LayoutBox from blink::LayoutInline in blink::ToLayoutBox | - | 2019-07-12 |
| 949015 | Bad-cast to blink::LayoutObject from invalid vptr in blink::SVGResources::LayoutIfNeeded | - | 2019-07-12 |
| 947410 | Bad-cast to Ice::OperandOptimizer::getUses in rr::optimize | - | 2019-07-11 |
| 947493 | Heap-use-after-free in views::MenuController::OnWillDispatchKeyEvent | - | 2019-07-11 |
| 947784 | Use-of-uninitialized-value in cc::PaintImageBuilder::TakePaintImage | - | 2019-07-11 |
| 881267 | Chrome v69 URL spoofing vulnerability on IOS | $1,000 | 2019-07-10 |
| 943424 | use-after-free in libANGLE triggered by WebGL2 on Windows 10 | $3,000 | 2019-07-10 |
| 943538 | libANGLE use-after-free (gl::State::syncTextures) triggered through WebGL2 in the GPU process | $3,000 | 2019-07-10 |
| 944800 | Use-after-poison in blink::LocalFrameView::ForAllNonThrottledLocalFrameViews<`lambda | - | 2019-07-10 |
| 945246 | DCHECK failure in map_.is_stable() in compilation-dependencies.cc | - | 2019-07-10 |
| 946550 | Use-of-uninitialized-value in gpu::gles2::PassthroughGLDebugMessageCallback | - | 2019-07-10 |
| 947865 | Use-of-uninitialized-value in dawn_native::TextureBase::Destroy | - | 2019-07-10 |
| 948228 | DCHECK failure in *isolate->external_caught_exception_address() in wasm-engine.cc | - | 2019-07-10 |
| 948248 | Security: Debug check failed: name->is_one_byte() src/parsing/parser.cc, line 350 | - | 2019-07-10 |
| 943087 | Integer overflow in libANGLE that results in memory corruption in GPU process | $3,000 | 2019-07-09 |
| 948307 | DCHECK failure in ObjectInYoungGeneration(HeapObjectSlot(slot).ToHeapObject()) in heap.cc | - | 2019-07-09 |
| 944930 | Regenerate chromeos-base/chromeos-ca-certificates with the latest set of pki.goog/roots.pem | - | 2019-07-08 |
| 946889 | v8 debug version crash when CreateGraph phase | - | 2019-07-08 |
| 947240 | use-after-free happening in unittest LayerTreeHostImplTest.ScrollSnapOnY | $3,000 | 2019-07-08 |
| 947949 | CHECK failure: this->first()->length() > 0 in objects-debug.cc | - | 2019-07-08 |
| 946539 | Heap-buffer-overflow in disk_cache::EntryImpl::UserBuffer::Write | - | 2019-07-07 |
| 947378 | Use-of-uninitialized-value in cc::ServiceImageTransferCacheEntry::Deserialize | - | 2019-07-07 |
| 947499 | Use-of-uninitialized-value in cc::ServiceImageTransferCacheEntry::Deserialize | - | 2019-07-07 |
| 892875 | Security: crosvm: integer overflow in read_struct_slice | - | 2019-07-06 |
| 897641 | Security: URL in Omnibox doesn't always match page content | $1,000 | 2019-07-06 |
| 901603 | Index-out-of-bounds in BZ2_decompress | - | 2019-07-06 |
| 916838 | Security: Two autocomplete flaws together allow sites to invisibly read credit card numbers after a single keypress | $3,337 | 2019-07-06 |
| 939644 | Integer overflows in disk caches | - | 2019-07-06 |
| 943387 | Security: Regression : URL bar spoofing with "file:///" URL on iOS | - | 2019-07-06 |
| 946862 | Heap-use-after-free in net::PrioritizedDispatcher::MaybeDispatchJob | - | 2019-07-06 |
| 947323 | Use-of-uninitialized-value in dawn_native::TextureBase::Destroy | - | 2019-07-06 |
| 945644 | Security: Failed Debug Check in src/compiler/verifier.cc, line 121 | $3,000 | 2019-07-05 |
| 945855 | Heap-use-after-free in BEInt<unsigned int, 4>::operator unsigned int | - | 2019-07-05 |
| 946006 | Heap-use-after-free in blink::LocalFrameUkmAggregator::RecordSample | - | 2019-07-05 |
| 946434 | Heap-use-after-free in base::LinkNode<disk_cache::MemEntryImpl>::RemoveFromList | - | 2019-07-05 |
| 946543 | Heap-buffer-overflow in BEInt<short, 2>::operator short | - | 2019-07-05 |
| 946806 | Crash in BEInt<unsigned int, 4>::operator unsigned int | - | 2019-07-05 |
| 947150 | Use-of-uninitialized-value in dawn_native::ValidateTextureViewDescriptor | - | 2019-07-05 |
| 918293 | Security: Cross origin resource size infoleak | $1,000 | 2019-07-04 |
| 927764 | Download Protection: Malicious extensions Mac OS (Safe Browsing) | - | 2019-07-04 |
| 944346 | Crash in BEInt<unsigned int, 4>::operator unsigned int | - | 2019-07-04 |
| 944945 | CHECK failure: !result.failed() in wasm-engine.cc | - | 2019-07-04 |
| 945370 | UAF in IndexedDB | $8,000 | 2019-07-04 |
| 946175 | Crash in v8::internal::Map::instance_type | - | 2019-07-04 |
| 946301 | Heap-use-after-free in ash::CaptionContainerView::SetBackdropVisibility | - | 2019-07-04 |
| 933221 | Wild read within ASAN instrumentation in __sanitizer_cov_trace_pc_guard | - | 2019-07-03 |
| 937773 | CVE-2019-8912: Security: Linux Kernel: Potential priv esc via UAF in sockfs_settattr | - | 2019-07-03 |
| 944391 | Stack-buffer-overflow in sh::TInfoSinkBase::operator<< | - | 2019-07-03 |
| 944971 | Security: OOB memory access in v8 regexp | - | 2019-07-03 |
| 945084 | Crash in vpx_subtract_block_sse2 | - | 2019-07-03 |
| 945341 | CHECK failure: !v8::internal::FLAG_enable_slow_asserts || (IsFixedArrayBase()) in fixed-array-i | - | 2019-07-03 |
| 946310 | CHECK failure: isolate->heap()->Contains(ho) in objects-debug.cc | - | 2019-07-03 |
| 946350 | Crash in v8::internal::Object::Number | - | 2019-07-03 |
| 944435 | CHECK failure: (value & uint64_t{ADDRESS}) != unexpected || (value & uint64_t{ADDRESS}) == uint | - | 2019-07-02 |
| 945124 | Heap-use-after-free in disk_cache::SimpleEntryImpl::CreationOperationComplete | - | 2019-07-02 |
| 945152 | Heap-use-after-free in blink::PaintController::FinishCycle | - | 2019-07-01 |
| 941340 | CSP bypass with import maps | $1,000 | 2019-06-30 |
| 940205 | Heap-use-after-free in renameTokenCheckAll | - | 2019-06-29 |
| 943913 | Stack-buffer-overflow in quic::QuicDataReader::ReadConnectionId | - | 2019-06-29 |
| 944013 | Stack-buffer-overflow in quic::QuicDataReader::ReadBytes | - | 2019-06-29 |
| 944062 | Security: v8: turbofan: JSCallReducer::ReduceArrayIndexOfIncludes fails to insert Map checks | - | 2019-06-28 |
| 937663 | Use-of-uninitialized-value in mov_read_dfla | - | 2019-06-27 |
| 942699 | Security: Google V8 Array.prototype Memory Corruption Vulnerability (TALOS-2019-0791) | $2,000 | 2019-06-27 |
| 942898 | UAF in indexeddb IndexedDBDatabase::RequestComplete | $10,000 | 2019-06-27 |
| 942671 | URL spoofing using invalid urls (invalid prototype) | - | 2019-06-26 |
| 939316 | V8: Turbofan may read a Map pointer out-of-bounds when optimizing Reflect.construct | - | 2019-06-25 |
| 941952 | DCHECK failure in 0 <= index && index < node->op()->ValueInputCount() in node-properties.cc | $1,500 | 2019-06-25 |
| 941743 | Security: OOB write in v8::internal::(anonymous namespace)::ElementsAccessorBase | - | 2019-06-24 |
| 941746 | Security: UAF in content::IndexedDBDatabase | - | 2019-06-22 |
| 940283 | Use-of-uninitialized-value in content::PowerMonitorTestImpl::~PowerMonitorTestImpl | - | 2019-06-21 |
| 941360 | Use-of-uninitialized-value in void base::Pickle::WriteBytesStatic<4ul> | - | 2019-06-21 |
| 941542 | Use-of-uninitialized-value in Deserializer::readDescriptor | - | 2019-06-21 |
| 941991 | Chromium: Vulnerability reported in libxml | - | 2019-06-21 |
| 936531 | heap-use-after-free : base::sequence_manager::internal::WorkQueue::RemoveAllCanceledTasksFromFront | - | 2019-06-20 |
| 939689 | Security: Android : http authentication spoof | $1,000 | 2019-06-20 |
| 939746 | CHECK failure: TypeError: node #171:StringCharCodeAt(input @1 = PoisonIndex:PoisonIndex) type ( | - | 2019-06-20 |
| 940284 | Stack-buffer-overflow in auto_descriptor_from_desc | - | 2019-06-20 |
| 941008 | Security: UAF in FileChooserImpl | - | 2019-06-20 |
| 940296 | Crash in unsigned long v8::base::AsAtomicImpl<long>::Relaxed_Load<unsigned long> | - | 2019-06-19 |
| 940843 | Stack-buffer-overflow in SkDescriptor::findEntry | - | 2019-06-19 |
| 885215 | Security: SiteInstanceImpl::GetSiteForURL ignores hash in Data URL | $500 | 2019-06-18 |
| 937199 | pdfium (XFA): heap-use-after-free in CFX_ReadOnlyMemoryStream::ReadBlockAtOffset | $1,000 | 2019-06-18 |
| 938724 | pdfium (XFA): oob read in CFGAS_FormatString::FormatStrNum | $1,000 | 2019-06-18 |
| 940000 | heap-use-after-free : base::internal::WeakPtrFactoryBase::~WeakPtrFactoryBase | - | 2019-06-18 |
| 940245 | Security: Security: Chrome renderer process persistence bug on android | $1,000 | 2019-06-18 |
| 932908 | Bad-cast to blink::Element from blink::Text in blink::LayoutTreeRebuildRoot::RootElement | - | 2019-06-17 |
| 939239 | Arbitrary Read in swiftshader | $1,000 | 2019-06-15 |
| 938867 | Bad-cast to blink::HTMLInputElement in IsMenulistInput | - | 2019-06-14 |
| 930550 | Heap-buffer-overflow in bn_cmp_part_words | - | 2019-06-13 |
| 937799 | Security: Invalid read. SEGV on CXFA_Radial::Draw. | $3,000 | 2019-06-13 |
| 938311 | heap-use-after-free in AsyncCompileJob | $3,000 | 2019-06-13 |
| 938626 | pdfium (XFA): oob read in CFGAS_FormatString::GetNumericFormat | - | 2019-06-13 |
| 937412 | Crash in update_tricolor_matrix | - | 2019-06-12 |
| 937628 | Crash in dawn_native::TextureFormatPixelSize | - | 2019-06-12 |
| 938251 | Security: Integer overflow in NewFixedDoubleArray | - | 2019-06-12 |
| 913320 | Heap-use-after-free in CPDF_ShadingPattern::Load() | $3,000 | 2019-06-11 |
| 917688 | use-after-poison on blink::CanvasResourceDispatcher::OnBeginFrame | - | 2019-06-11 |
| 925598 | Security: URL bar spoofing on iOS (repro issue 844881) | $2,000 | 2019-06-11 |
| 926160 | CVE-2019-3819 CrOS: Vulnerability reported in Linux kernel | - | 2019-06-11 |
| 937487 | chrome.dashboardPrivate API is exposed to whole origin of https://chrome.google.com | $500 | 2019-06-11 |
| 937649 | Unknown signal in Builtins_JSEntryTrampoline | - | 2019-06-11 |
| 928014 | Crash in base::FilePath::FilePath | - | 2019-06-10 |
| 935209 | Use-after-free in GenerateNetworkErrorLoggingReport | - | 2019-06-10 |
| 915423 | Use-of-uninitialized-value in v8::internal::Factory::NewNumberFromUint | - | 2019-06-08 |
| 935374 | Bad-cast to blink::LayoutImage from invalid vptr in blink::LayoutImage::ImageNotifyFinished | - | 2019-06-08 |
| 937155 | Bad-free in _pthread_tsd_cleanup | - | 2019-06-08 |
| 937206 | Heap-use-after-free in views::MenuController::OnWillDispatchKeyEvent | - | 2019-06-08 |
| 929198 | Crash in _cupsStrFree | - | 2019-06-07 |
| 933743 | Heap-buffer-overflow in media::mp4::ConvertAVCToAnnexBInPlaceForLengthSize4 | - | 2019-06-07 |
| 934166 | Security: other->values_[index] != builder()->jsgraph()->OptimizedOutConstant() (0x563015eb2cf8 vs. 0x563015eb2cf8). | - | 2019-06-07 |
| 935076 | Heap-use-after-free in blink::LayoutImage::ImageNotifyFinished | - | 2019-06-07 |
| 936346 | Crash in Ice::XNUMBER::InstImpl<struct Ice::XNUMBER::TargetX8664Traits>::InstX86Movd::emi | - | 2019-06-07 |
| 936448 | Heap-use-after-free WRITE 4 · v8::internal::ElementsAccessorBase | - | 2019-06-07 |
| 913964 | UAP in blink::UpdatePlaceHolderImage | $3,000 | 2019-06-06 |
| 919046 | use-after-poison in blink::CanvasResourceDispatcher::OnBeginFrame | - | 2019-06-06 |
| 929757 | Use-after-poison in viz::mojom::blink::CompositorFrameSinkClientStubDispatch::Accept | - | 2019-06-06 |
| 930035 | Security: Stack out-of-bounds writes in WebmMuxer::AddAudioTrack | $500 | 2019-06-06 |
| 930057 | Security: CORS policy not applied for bitmap canvases loaded without CORS support | $1,000 | 2019-06-06 |
| 932922 | Heap-use-after-free in aura::EventObserverAdapter::~EventObserverAdapter | $1,500 | 2019-06-06 |
| 934201 | Security: Internal object leak in ReadableStream | - | 2019-06-06 |
| 935175 | Security: Address bar spoofing with mishandling canceled requests. | $1,000 | 2019-06-06 |
| 934128 | Heap-buffer-overflow in gpr_murmur_hash3 | - | 2019-06-05 |
| 936302 | CHECK failure: fixed_size_above_fp + in deoptimizer.cc | - | 2019-06-05 |
| 933004 | Security: command line injection in Windows (--user-data-dir) | $500 | 2019-06-04 |
| 933664 | OOB read and write in BigUint64Array | - | 2019-06-04 |
| 935078 | Crash in dawn_native::InputStateBuilder::SetAttribute | - | 2019-06-04 |
| 935026 | Global-buffer-overflow in dawn_native::VertexFormatComponentSize | - | 2019-06-04 |
| 935138 | Use-of-uninitialized-value in v8::internal::compiler::TurbofanWasmCompilationUnit::BuildGraphForWasmFunction | - | 2019-06-04 |
| 931949 | Security: Type confusion in JSPromise::TriggerPromiseReactions | - | 2019-06-03 |
| 935101 | CHECK failure: isolate->heap()->Contains(ho) in objects-debug.cc | - | 2019-06-03 |
| 894933 | Heap-buffer-overflow in xmlParseAttValueInternal | - | 2019-06-02 |
| 927982 | Heap-use-after-free in egl::Surface::deleteResources | - | 2019-06-02 |
| 929088 | Heap-use-after-free in egl::Display::terminate | - | 2019-06-02 |
| 929962 | Code review: ReadBits may return uninitialized value due to unchecked return status. | $500 | 2019-06-01 |
| 930663 | Security: READ heap-buffer-overflow in libxslt (type confusion?) | $1,000 | 2019-06-01 |
| 933418 | ptrace syscall on Android can bypass seccomp on Linux <4.8 | - | 2019-06-01 |
| 934869 | Crash in Ice::CfgNode::appendInst | - | 2019-06-01 |
| 924209 | Use-of-uninitialized-value in sw::Shader::analyzeIndirectAddressing | - | 2019-05-31 |
| 933851 | Bad-cast to (anonymous namespace)::WebrtcTaskQueue from invalid vptr in base::internal::Invoker<base::internal::BindState<void | - | 2019-05-31 |
| 933977 | Heap-buffer-overflow in sw::PixelProgram::CALL | - | 2019-05-31 |
| 934085 | Crash in llvm::ilist_base<true>::insertBeforeImpl | - | 2019-05-31 |
| 352465 | Security: terminalPrivate API should use an unforgeable process reference | - | 2019-05-30 |
| 490720 | Security: ping utility includes process id in echo requests | - | 2019-05-30 |
| 920169 | CrOS: Vulnerability reported in dev-libs/elfutils | - | 2019-05-30 |
| 921983 | CrOS: Vulnerability reported in dev-libs/libtasn1 | - | 2019-05-30 |
| 929652 | DOMParser APIs send DNS request via preconnect link tag | - | 2019-05-30 |
| 932034 | Size calculation overflow can lead to heap buffer overflow | $5,000 | 2019-05-30 |
| 932867 | Stack-buffer-overflow in sw::Shader::analyzeCallSites | - | 2019-05-30 |
| 932953 | CHECK failure: transitions.SearchSpecial(roots.nonextensible_symbol()) == *old_map_ in map-upda | - | 2019-05-30 |
| 933179 | DCHECK failure in old_map_->is_stable() in map-updater.cc | - | 2019-05-30 |
| 933212 | Heap-use-after-free in CFX_ReadOnlyMemoryStream::~CFX_ReadOnlyMemoryStream | - | 2019-05-30 |
| 933341 | Heap-use-after-free in dawn_native::CommandEncoderBase::HandleBuilderError | - | 2019-05-30 |
| 933760 | Use-of-uninitialized-value in = | - | 2019-05-30 |
| 927432 | Use-after-poison in base::internal::Invoker<base::internal::BindState<void | - | 2019-05-29 |
| 930154 | Security: Possible to override browser-initiated navigation using WindowClient.navigate | $500 | 2019-05-29 |
| 932895 | Crash in HandleDynamicTypeCacheMiss | - | 2019-05-29 |
| 933135 | Heap-use-after-free in content::IndexedDBBackingStore::Transaction::ChainedBlobWriterImpl::WriteNextFil | - | 2019-05-29 |
| 933211 | mXSS: Potential XSS via noembed tags parsed by DOMParser APIs | $500 | 2019-05-29 |
| 933521 | DCHECK failure in length_ < capacity() in string-builder.cc | - | 2019-05-29 |
| 928051 | Crash in base::Thread::ThreadMain | - | 2019-05-28 |
| 929521 | Crash in metrics::CallStackProfile_Location* google::protobuf::Arena::CreateMaybeMessage< | - | 2019-05-27 |
| 928863 | Crash in sw::Thread::Thread | - | 2019-05-26 |
| 908669 | Bad-free in base::internal::BindState<void | - | 2019-05-24 |
| 923654 | Heap-use-after-free in media_router::WebContentsDisplayObserverView::OnBrowserSetLastActive | - | 2019-05-24 |
| 924972 | Security: site isolation bypass: websockets leak cross-origin cookies | - | 2019-05-24 |
| 926651 | Security: [v8] Type Confusion in Builtins_CallUndefinedReceiver1Handler | $6,000 | 2019-05-24 |
| 927646 | Security: heap-use-after-free in blink::LayoutObject::SetShouldCheckForPaintInvalidationWithoutGeometryChange | $3,000 | 2019-05-24 |
| 928974 | Security: http authentication spoof (repro issue 884179) | $1,000 | 2019-05-24 |
| 930948 | CHECK failure: (value & uint64_t{ADDRESS}) != unexpected || (value & uint64_t{ADDRESS}) == uint | - | 2019-05-24 |
| 931175 | Security: Invalid read. SEGV on CXFA_Graphics::FillPathWithShading | $500 | 2019-05-24 |
| 920580 | CrOS: Vulnerability reported in dev-libs/libzip | - | 2019-05-23 |
| 928138 | Crash in base::CreateThread | - | 2019-05-23 |
| 928223 | Crash in base::RunLoop::Run | - | 2019-05-23 |
| 878805 | Weird crash in V8 javascript engine | - | 2019-05-22 |
| 921581 | Security: UAF in MidiManagerWin | - | 2019-05-22 |
| 906342 | CVE-2018-14625 CrOS: Vulnerability reported in Linux kernel | - | 2019-05-21 |
| 913561 | Security: pdfium heap BOF in RelocateTableRowCells | $1,000 | 2019-05-21 |
| 926853 | CrOS: Vulnerability reported in dev-libs/openssl | - | 2019-05-21 |
| 927438 | Heap-use-after-free in blink::LayoutBlockFlow::DetermineStartPosition | - | 2019-05-21 |
| 928044 | Crash in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run | - | 2019-05-21 |
| 929624 | CVE-2018-16880 CrOS: Vulnerability reported in Linux kernel | - | 2019-05-21 |
| 930474 | Bad-cast to blink::LayoutText from invalid vptr in blink::ToLayoutText | - | 2019-05-21 |
| 930580 | DCHECK failure in !var->has_forced_context_allocation() || var->is_used() in scopes.cc | - | 2019-05-20 |
| 930045 | CHECK failure: transitions.SearchSpecial(roots.nonextensible_symbol()) == *old_map_ in map-upda | - | 2019-05-19 |
| 927307 | Github Wiki Pages for GoogleChrome are publicly editable. | $500 | 2019-05-18 |
| 927471 | AppCache may be used to bypass CORB (URLs covered by manifest) | - | 2019-05-18 |
| 927849 | is_corb_enabled=false for requests from shared workers | - | 2019-05-18 |
| 929711 | Security: Idn-spoof with using U+00F0 (ð) | $500 | 2019-05-18 |
| 930026 | Heap-buffer-overflow in base::WideToUTF8 | - | 2019-05-18 |
| 914983 | pdfium: signed-integer-overflow in AdjustGlyphSpace / CFX_DIBBase::GetOverlapRect | $500 | 2019-05-17 |
| 919635 | pdfium: signed-integer-overflow in CFX_RenderDevice::DrawNormalText | - | 2019-05-17 |
| 919640 | pdfium: signed-integer-overflow in CFX_AggDeviceDriver::StretchDIBits | - | 2019-05-17 |
| 922446 | crash_sender: invalid crash report names can trigger arbitrary file deletion as root | $500 | 2019-05-17 |
| 928720 | Security: Type confusion in V8TrustedTypePolicyOptions::ToImpl | - | 2019-05-17 |
| 929217 | Heap-buffer-overflow in blink::FindBuffer::RangeFromBufferIndex | $1,500 | 2019-05-17 |
| 929623 | CVE-2018-16862 CrOS: Vulnerability reported in Linux kernel | - | 2019-05-17 |
| 929625 | CVE-2018-18397 CrOS: Vulnerability reported in Linux kernel | - | 2019-05-17 |
| 929626 | CVE-2018-19854 CrOS: Vulnerability reported in Linux kernel | - | 2019-05-17 |
| 919643 | pdfium: signed-integer-overflow in FX_RECT::Width | - | 2019-05-16 |
| 921351 | Crash in _cupsStrFree | - | 2019-05-16 |
| 926854 | CrOS: Vulnerability reported in app-admin/rsyslog | - | 2019-05-16 |
| 928640 | Use-of-uninitialized-value in bool base::internal::CheckedAddOp<long, long, void>::Do<long> | - | 2019-05-16 |
| 928755 | Heap-use-after-free in v8::internal::wasm::CompilationStateImpl::OnFinishedUnit | - | 2019-05-16 |
| 929020 | Crash in base::WaitableEvent::TimedWaitUntil | - | 2019-05-16 |
| 926105 | Framebusting protection bypass because a download redirected cross-origin gets processed as a main frame navigation | $500 | 2019-05-15 |
| 927396 | Use-after-poison in viz::mojom::blink::CompositorFrameSinkClientStubDispatch::Accept | - | 2019-05-15 |
| 928061 | Heap-use-after-free in v8::internal::wasm::BackgroundCompileTask::RunInternal | - | 2019-05-15 |
| 927555 | Security DCHECK failure: RotateTransformOperation::IsMatchingOperationType(transform.GetType()) in rotate | $1,500 | 2019-05-14 |
| 927644 | PDFium Use After Free on CXFA_FFNotify::OpenDropDownList (XFA enable) | $3,500 | 2019-05-14 |
| 925232 | CHECK failure: (value & uint64_t{ADDRESS}) != unexpected || (value & uint64_t{ADDRESS}) == uint | - | 2019-05-13 |
| 928062 | Crash in base::debug::ScopedLockAcquireActivity::ScopedLockAcquireActivity | - | 2019-05-13 |
| 928239 | CVE-2018-16884 CrOS: Vulnerability reported in Linux kernel | - | 2019-05-13 |
| 826030 | webRequest extensions can see other extensions' requests. | - | 2019-05-11 |
| 925050 | CHECK failure: size <= kMaxRegularHeapObjectSize in runtime-internal.cc | - | 2019-05-11 |
| 915455 | Crash in spirv_cross::Compiler::traverse_all_reachable_opcodes | - | 2019-05-10 |
| 919176 | Heap-buffer-overflow in spirv_cross::CompilerGLSL::emit_instruction | - | 2019-05-10 |
| 925641 | Crash in gldRenderFillPolygonPtr | - | 2019-05-10 |
| 925790 | Security: PDFium Use After Free in CXFA_ItemLayoutProcessor::ExtractLayoutItem | $3,000 | 2019-05-10 |
| 926640 | pdfium: use-after-dtor in CPDF_GeneralState::StateData::~StateData() | $1,000 | 2019-05-10 |
| 913564 | Security: pdfium heap use after free in cxfa_layoutitem | $3,000 | 2019-05-09 |
| 919813 | CrOS: Vulnerability reported in media-libs/lcms | - | 2019-05-09 |
| 924450 | Security: heap-use-after-free in blink::CSSToLengthConversionData::FontSizes::FontSizes | $3,000 | 2019-05-09 |
| 926852 | CVE-2018-16882 CrOS: Vulnerability reported in Linux kernel | - | 2019-05-09 |
| 926964 | Security DCHECK failure: node.IsElementNode() in element.h | - | 2019-05-09 |
| 867509 | Security: Chrome OS: almost-exploitable AVFS behavior: argument injection; subdir/bind bypass | - | 2019-05-08 |
| 906601 | Use-of-uninitialized-value in sse41::blit_row_s32a_opaque | - | 2019-05-08 |
| 915197 | OOB write in sw::VertexProgram::Program | $3,000 | 2019-05-08 |
| 915206 | OOB write in sw::VertexProgram::WHILE | $3,000 | 2019-05-08 |
| 915218 | OOB operation in SwiftShader JIT code. | $1,000 | 2019-05-08 |
| 923695 | Security: URL bar spoofing on iOS | - | 2019-05-08 |
| 923951 | Security: heap-use-after-free in blink::ImageResourceContent::UpdateImageAnimationPolicy | $3,000 | 2019-05-08 |
| 924843 | DCHECK failure in IsAligned(DistanceTo(target), kInstrSize) in instructions-arm64.cc | - | 2019-05-08 |
| 925864 | Security: UAF in FileSystemOperationRunner | - | 2019-05-08 |
| 926027 | Bad-cast to blink::Element from blink::Text in blink::LayoutTreeRebuildRoot::RootElement | - | 2019-05-08 |
| 926036 | DCHECK failure in (decl.pattern) != nullptr in parser.cc | - | 2019-05-08 |
| 921390 | Security: Hostname not elided securely (URL spoofing on iOS) | $500 | 2019-05-07 |
| 925671 | DCHECK failure in 0 < outstanding_tiering_units_ in module-compiler.cc | - | 2019-05-07 |
| 919356 | Security: RCE via "copy as curl" on mac | - | 2019-05-05 |
| 924133 | Security: V8: Fatal error in ../../src/runtime/runtime-array.cc, line 167 | - | 2019-05-05 |
| 913314 | Security: Permission request UI spoof | $500 | 2019-05-04 |
| 922864 | pdfium (XFA): wrong object type in CFXJSE_FormCalcContext::ParseResolveResult | $3,000 | 2019-05-04 |
| 924388 | Use-of-uninitialized-value in views::View::GetWidget | - | 2019-05-04 |
| 924457 | Bad-cast to blink::ImageResourceObserver from invalid vptr in blink::ImageResourceContent::PriorityFromObservers | - | 2019-05-04 |
| 925146 | CHECK failure: 2 == total_number_of_control_uses in verifier.cc | - | 2019-05-04 |
| 903233 | Heap-buffer-overflow in quipper::PerfSerializer::SerializeMMap2Event | - | 2019-05-03 |
| 903237 | Heap-buffer-overflow in quipper::PerfReader::ReadPipedData | - | 2019-05-03 |
| 904382 | Heap-buffer-overflow in quipper::PerfReader::ReadBuildIDMetadataWithoutHeader | - | 2019-05-03 |
| 915975 | V8 HeapObject pointing to JIT memory | $3,000 | 2019-05-03 |
| 923205 | Bad-cast to cc::ContentLayerClient from invalid vptr in cc::PictureLayer::Update | - | 2019-05-03 |
| 924375 | Heap-buffer-overflow in sh::OutputVariable::~OutputVariable | - | 2019-05-03 |
| 924411 | Bad parameters to --sanitizer-annotate-contiguous-container in sh::TCompiler::~TCompiler | - | 2019-05-03 |
| 924382 | Crash in sh::ShaderVariable::~ShaderVariable | - | 2019-05-03 |
| 924537 | Crash in sh::Attribute::~Attribute | - | 2019-05-03 |
| 924905 | DCHECK failure in lsb == base::bits::CountTrailingZeros32(value) in instruction-selector-arm.cc | - | 2019-05-03 |
| 924928 | pdfium (XFA): double-free in CJX_Node::saveXML | $3,000 | 2019-05-03 |
| 924950 | Heap-use-after-free in views::View::~View | - | 2019-05-03 |
| 923913 | Heap-buffer-overflow in AAT::KerxSubTableFormat4<AAT::KerxSubTableHeader>::driver_context_t::transition | - | 2019-05-02 |
| 924418 | Heap-use-after-free in ui::PropertyHandler::SetPropertyInternal | - | 2019-05-02 |
| 915541 | Security: ChromeOS Persistent root Command Execution | $75,000 | 2019-05-01 |
| 922627 | Chromium - Exposed GPU profiler allows to dump all URLs and headers from requested pages | $4,000 | 2019-05-01 |
| 922844 | Use-of-uninitialized-value in sqlite3BtreeMovetoUnpacked | - | 2019-05-01 |
| 923630 | Heap-use-after-free in ScopedObserver<ash::TabletModeController, ash::TabletModeObserver>::~ScopedObser | - | 2019-05-01 |
| 923646 | CrOS: Vulnerability reported in net-misc/curl | - | 2019-05-01 |
| 923675 | DCHECK failure in candidate->location.IsValid() in modules.cc | - | 2019-05-01 |
| 920120 | CHECK failure: #14 ADDRESS (/mnt/scratch0/clusterfuzz/bot/builds/v8-asan_linux-debug_ddc8d9b4e | - | 2019-04-30 |
| 920276 | Heap-use-after-free in gpu::gles2::GLES2DecoderPassthroughImpl::OnDebugMessage | - | 2019-04-30 |
| 920421 | Use-of-uninitialized-value in gpu::gles2::PassthroughGLDebugMessageCallback | - | 2019-04-30 |
| 923264 | CHECK failure: object->IsAbstractCode() || object->IsSeqString() || object->IsExternalString() | - | 2019-04-30 |
| 922933 | DCHECK failure in *available != 0 in assembler-arm.cc | - | 2019-04-29 |
| 912602 | Crash in sw::Thread::Thread | - | 2019-04-28 |
| 914925 | Crash in libX11.so.6 | - | 2019-04-28 |
| 921393 | Crash in cc::SaveOp::Serialize | - | 2019-04-28 |
| 922303 | Heap-buffer-overflow in AAT::KerxSubTableFormat4<AAT::KerxSubTableHeader>::driver_context_t::transition | - | 2019-04-28 |
| 910305 | Security: Make JIT payment Service Worker registrations same-origin only | - | 2019-04-27 |
| 918022 | Heap-buffer-overflow in scan_bos_continue | - | 2019-04-27 |
| 918232 | Security: chromedriver LCE | - | 2019-04-27 |
| 918311 | Heap-buffer-overflow in spvtools::opt::Instruction::GetSingleWordOperand | - | 2019-04-27 |
| 919181 | Container-overflow in spvtools::utils::SmallVector<unsigned int, 2ul>::operator | - | 2019-04-27 |
| 920995 | CrOS: Vulnerability reported in media-gfx/imagemagick | - | 2019-04-27 |
| 921380 | CrOS: Vulnerability reported in media-gfx/imagemagick | - | 2019-04-27 |
| 922077 | Bad-cast to content::(anonymous namespace)::WebServiceWorkerNetworkProviderImplForFrame from content::WebServiceWorkerNetworkProviderImplForWorker in content::ServiceWorkerNetworkProvider::FromWebServiceWorkerNetworkProvider | - | 2019-04-27 |
| 922668 | Heap-use-after-free in base::BasicStringPiece<std::__Cr::basic_string<char, std::__Cr::char_traits<char | - | 2019-04-27 |
| 888311 | CrOS: Vulnerability reported in app-crypt/mit-krb5 | - | 2019-04-26 |
| 916523 | Security: Double-destruction race in StoragePartitionService | - | 2019-04-26 |
| 916152 | Security: symlinks in /var/log can be abused to create messy arbitrary file write primitives | - | 2019-04-25 |
| 916870 | CrossCallParamsEx::GetParameterStr causes Heap-buffer-overflow | - | 2019-04-25 |
| 919486 | Clean up extended attributes inadvertently being set on user data files | - | 2019-04-25 |
| 920115 | Bad-cast to blink::ImageResourceObserver from invalid vptr in blink::PriorityFromObserver | - | 2019-04-25 |
| 921074 | Heap-use-after-free in base::BasicStringPiece<std::__Cr::basic_string<char, std::__Cr::char_traits<char | - | 2019-04-25 |
| 922432 | Heap-buffer-overflow in unsigned int v8::internal::wasm::Decoder::read_leb_tail<unsigned int, | - | 2019-04-25 |
| 922677 | Security: UAF in FileWriterImpl | - | 2019-04-25 |
| 910906 | Upgrade SQLite to 3.26.0 | - | 2019-04-24 |
| 912074 | heap-use-after-free on RTCPeerConnectionHandler | $3,000 | 2019-04-24 |
| 912983 | Heap-buffer-overflow in BEInt<unsigned short, 2>::operator unsigned short | - | 2019-04-24 |
| 916874 | Heap-buffer-overflow in bool base::UTFConversion<base::BasicStringPiece<std::__1::basic_string<wchar_t, | - | 2019-04-24 |
| 917702 | Heap-buffer-overflow in BEInt<unsigned int, 4>::operator unsigned int | - | 2019-04-24 |
| 917936 | Heap-buffer-overflow in AAT::KerxSubTableFormat4<struct AAT::KerxSubTableHeader>::driver_context_t::tran | - | 2019-04-24 |
| 918340 | Use-of-uninitialized-value in AAT::ankr::get_anchor | - | 2019-04-24 |
| 920579 | CrOS: Vulnerability reported in net-dns/avahi | - | 2019-04-24 |
| 920990 | CrOS: Vulnerability reported in media-gfx/imagemagick | - | 2019-04-24 |
| 920991 | CrOS: Vulnerability reported in media-gfx/imagemagick | - | 2019-04-24 |
| 920992 | CrOS: Vulnerability reported in media-gfx/imagemagick | - | 2019-04-24 |
| 920993 | CrOS: Vulnerability reported in media-gfx/imagemagick | - | 2019-04-24 |
| 920994 | CrOS: Vulnerability reported in media-gfx/imagemagick | - | 2019-04-24 |
| 921376 | CrOS: Vulnerability reported in media-gfx/imagemagick | - | 2019-04-24 |
| 921377 | CrOS: Vulnerability reported in media-gfx/imagemagick | - | 2019-04-24 |
| 921378 | CrOS: Vulnerability reported in media-gfx/imagemagick | - | 2019-04-24 |
| 921379 | CrOS: Vulnerability reported in media-gfx/imagemagick | - | 2019-04-24 |
| 921382 | Security: Debug check failed: nary->op() == Token::COMMA in V8 parsing | - | 2019-04-24 |
| 921563 | CrOS: Vulnerability reported in dev-libs/nettle | - | 2019-04-24 |
| 921935 | Crash in webrtc::video_coding::DecodedFramesHistory::InsertDecoded | - | 2019-04-24 |
| 921838 | Heap-buffer-overflow in blink::PropertyTreeManager::CreateCompositorScrollNode | - | 2019-04-24 |
| 921951 | Use-of-uninitialized-value in webrtc::video_coding::DecodedFramesHistory::WasDecoded | - | 2019-04-24 |
| 921952 | Heap-use-after-free in base::MessageLoopCurrent::GetWorkId | - | 2019-04-24 |
| 914507 | Use-of-uninitialized-value in sqlite3BtreeDelete | - | 2019-04-23 |
| 916140 | Security: /run/ipsec and /run/l2tpipsec_vpn should ideally not be group-writable | - | 2019-04-23 |
| 920733 | getDisplayMedia() prompts from background tab, not obvious who's asking. | $500 | 2019-04-23 |
| 920859 | Use-of-uninitialized-value in blink::AddressCache::Lookup | - | 2019-04-22 |
| 921299 | Use-of-uninitialized-value in SkPerlinNoiseShaderImpl::PaintingData::stitch | - | 2019-04-22 |
| 921341 | Security DCHECK failure: it != clients_.end() in css_image_generator_value.cc | - | 2019-04-22 |
| 902650 | Heap-use-after-free in vp8dx_bool_decoder_fill | - | 2019-04-21 |
| 921076 | CHECK failure: !v8::internal::FLAG_enable_slow_asserts || (IsPreparseData()) in shared-function | - | 2019-04-21 |
| 911253 | SQLite3 exprCodeBetween heap-buffer overflow | - | 2019-04-20 |
| 911255 | sqlite3ExprCompare Assertion Failure: (combinedFlags & EP_Reduced)==0 | - | 2019-04-20 |
| 917588 | DCHECK failure in is_fp() in liftoff-register.h | - | 2019-04-20 |
| 918284 | DCHECK failure in *available != 0 in assembler-arm.cc | - | 2019-04-20 |
| 918861 | Security: Data race in ExtensionsGuestViewMessageFilter | - | 2019-04-20 |
| 919717 | CVE-2017-0553 libnl | - | 2019-04-20 |
| 919754 | DCHECK failure in !std::isnan(value) in js-operator.h | - | 2019-04-20 |
| 920164 | CHECK failure: value->IsSmi() || value->IsTheHole(isolate) in objects-debug.cc | - | 2019-04-20 |
| 920491 | CHECK failure: Type cast failed in CAST(elements) at ../../src/ic/accessor-assembler.cc:1830 in | - | 2019-04-20 |
| 920769 | DCHECK failure in !load_dst_regs_.has(dst) in liftoff-assembler.cc | - | 2019-04-20 |
| 780039 | kmod: kill support for /run/modprobe.d | - | 2019-04-19 |
| 905509 | Audit (and remove as appropriate) use of size_t in command buffer code | - | 2019-04-19 |
| 914736 | Security: Heap buffer overflow in the V8 language parser | $7,500 | 2019-04-19 |
| 918470 | Security: Extensions can add host permissions for chrome:// pages | $500 | 2019-04-19 |
| 919533 | DCHECK failure in !load_dst_regs_.has(dst) in liftoff-assembler.cc | - | 2019-04-19 |
| 919649 | pdfium (XFA): oob array read in CFX_TxtBreak::GetBreakPos | - | 2019-04-19 |
| 920048 | Security: http authentication spoof on chrome iOS (repro issue 884179) | $500 | 2019-04-19 |
| 920566 | Heap-use-after-free in PriorityFromObserver | - | 2019-04-19 |
| 884122 | Security: Use-after-free in CPDFSDK_Widget::GetMixXFAWidget | $3,000 | 2019-04-18 |
| 892574 | Security: Use-after-free in CPDFXFA_Page::GetDisplayMatrix | $3,000 | 2019-04-18 |
| 915819 | sqlite3 allows arbitrary binary extension loading | - | 2019-04-18 |
| 918771 | Heap-use-after-free in http2::HpackDecoderStringBuffer::BufferStringIfUnbuffered | - | 2019-04-18 |
| 919800 | Heap-use-after-free in SelectFileDialogExtension::ExtensionDialogClosing | $2,500 | 2019-04-18 |
| 916080 | Security: UAF in RenderProcessHostImpl binding for P2PSocketDispatcherHost | - | 2019-04-17 |
| 916960 | CrOS: Vulnerability reported in net-vpn/strongswan | - | 2019-04-17 |
| 918273 | Security DCHECK failure: !object || (object->IsBox()) in layout_box.h | - | 2019-04-17 |
| 918917 | DCHECK failure in HasRegisterMove(dst, src, type) in liftoff-assembler.cc | - | 2019-04-17 |
| 919200 | Use-of-uninitialized-value in gpu::gles2::GLES2DecoderImpl::DoMultiDrawEndCHROMIUM | - | 2019-04-17 |
| 919340 | CHECK failure: TypeError: node #169:DeadValue[kRepTagged](input @0 = CheckString:CheckString) t | - | 2019-04-17 |
| 911822 | Heap-use-after-free in gpu::gles2::GLES2DecoderPassthroughImpl::OnDebugMessage | - | 2019-04-16 |
| 913836 | Use-of-uninitialized-value in gpu::gles2::PassthroughGLDebugMessageCallback | - | 2019-04-16 |
| 915857 | vpn-manager must sanitize ipsec certificate fields | - | 2019-04-16 |
| 919572 | DCHECK failure in src.is_reg_only() implies src.reg().is_byte_register() in assembler-ia32.cc | - | 2019-04-16 |
| 918149 | DCHECK failure in src.is_reg_only() implies src.reg().is_byte_register() in assembler-ia32.cc | - | 2019-04-14 |
| 919014 | Heap-use-after-free in quic::QuicStreamSequencerBuffer::FirstMissingByte | - | 2019-04-14 |
| 919073 | Heap-use-after-free in net::IntervalSet<unsigned long long>::Empty | - | 2019-04-14 |
| 888323 | CVE-2018-14611 CrOS: Vulnerability reported in Linux kernel | - | 2019-04-13 |
| 888324 | CVE-2018-14612 CrOS: Vulnerability reported in Linux kernel | - | 2019-04-13 |
| 888325 | CVE-2018-14613 CrOS: Vulnerability reported in Linux kernel | - | 2019-04-13 |
| 918260 | Heap-buffer-overflow in dawn_wire::QueueSubmitDeserialize | - | 2019-04-13 |
| 918094 | Heap-buffer-overflow in dawn_wire::dawnShaderModuleDescriptorDeserialize | - | 2019-04-13 |
| 918323 | Heap-buffer-overflow in BEInt<unsigned int, 4>::operator unsigned int | - | 2019-04-13 |
| 918348 | Heap-buffer-overflow in dawn_wire::dawnRenderPassColorAttachmentDescriptorDeserialize | - | 2019-04-13 |
| 918849 | Heap-use-after-free in base::small_map<class std::unordered_map<unsigned int,class std::unique_ptr<clas | - | 2019-04-13 |
| 906252 | Security: LUCI - Best practice in html escaping content before rendering not followed | - | 2019-04-12 |
| 910222 | Use-of-uninitialized-value in avx::store_bgra | - | 2019-04-12 |
| 914731 | Security: The serialized data is corrupted because the return value is always true. | $1,000 | 2019-04-12 |
| 917151 | CHECK failure: U_SUCCESS(status) in intl-objects.cc | - | 2019-04-12 |
| 917412 | DCHECK failure in !move_dst_regs_.has(dst) in liftoff-assembler.cc | - | 2019-04-12 |
| 917450 | DCHECK failure in 0 != kLiftoffAssemblerGpCacheRegs & reg.bit() in liftoff-register.h | - | 2019-04-12 |
| 917785 | Heap-buffer-overflow in spvtools::utils::SmallVector<unsigned int, 2u>::operator | - | 2019-04-12 |
| 917589 | Heap-use-after-free in gfx::ToEnclosingRect | - | 2019-04-12 |
| 917980 | Security: Heap-use-after-free in TypedArray.join | $5,000 | 2019-04-12 |
| 917988 | DCHECK failure in outer_scope_ == scope->outer_scope() in bytecode-generator.cc | - | 2019-04-12 |
| 918222 | Heap-buffer-overflow in BEInt<unsigned char, 1>::operator unsigned char | - | 2019-04-12 |
| 918450 | Heap-use-after-free in cc::Layer::SetOffsetToTransformParent | - | 2019-04-12 |
| 905975 | Security: use-after-poison in mojo::SimpleWatcher::OnHandleReady | $3,000 | 2019-04-11 |
| 914756 | Bad-cast to spvtools::utils::SmallVector<unsigned int, 2> from invalid vptr in spvtools::opt::Instruction::GetSingleWordOperand | - | 2019-04-11 |
| 918454 | Security: World Editable GitHub Repository Wikis for chromium | $500 | 2019-04-11 |
| 856973 | Security: Type confusion bypasses Spectre mitigation | - | 2019-04-10 |
| 917021 | Crash in AddressIsPoisoned | - | 2019-04-10 |
| 917025 | Heap-buffer-overflow in (std::is_function<std::__1::remove_pointer<unsigned | - | 2019-04-10 |
| 915636 | CVE-2018-20169: Security: Linux kernel: BOF in drivers/usb/core/hub.c allowing read, maybe write | - | 2019-04-09 |
| 917032 | Heap-use-after-free in cc::Layer::SetOffsetToTransformParent | - | 2019-04-08 |
| 916558 | Heap-use-after-free in ui::MenuModel::GetModelAndIndexForCommandId | - | 2019-04-07 |
| 905815 | DCHECK failure in pc <= end_ in decoder.h | - | 2019-04-06 |
| 916861 | Crash in media::Vp9Parser::ParseSuperframe | - | 2019-04-06 |
| 917036 | Crash in media::IvfParser::ParseNextFrame | - | 2019-04-06 |
| 917608 | Crash in AddressIsPoisoned | - | 2019-04-06 |
| 917645 | DCHECK failure in !AreAliased(dst_high, src_low) in macro-assembler-arm.cc | - | 2019-04-06 |
| 918027 | Heap-use-after-free in blink::LayoutTableCell::CompareInDOMOrder | - | 2019-04-06 |
| 931640 | Security: Type confusion in JSPromise::TriggerPromiseReactions | - | 2019-04-05 |
| 749852 | Page still eats the page until the next `'` | $500 | 2019-04-05 |
| 910824 | DCHECK failure in *available != 0 in assembler-arm.cc | - | 2019-04-05 |
| 914511 | IsolatedOrigins should ignore port numbers | - | 2019-04-05 |
| 916871 | Heap-buffer-overflow in dawn_wire::dawnBindGroupLayoutBindingDeserialize | - | 2019-04-05 |
| 916916 | Heap-buffer-overflow in dawn_wire::ComputePassEncoderSetPushConstantsDeserialize | - | 2019-04-05 |
| 881024 | Use-of-uninitialized-value in gtk_widget_destroy | - | 2019-04-04 |
| 917668 | Security: Cross Domain Bug of Indexeddb Database | - | 2019-04-04 |
| 913270 | Heap-use-after-free in midi::MidiManager::~MidiManager | - | 2019-04-03 |
| 900145 | Crash in _platform_memmove$VARIANT$Nehalem | - | 2019-03-31 |
| 908191 | Crash in SkBinaryWriteBuffer::writePad32 | - | 2019-03-31 |
| 916873 | Heap-buffer-overflow in hunspell::BDict::Verify | - | 2019-03-31 |
| 912508 | Heap-buffer-overflow in sh::SetUnionArrayFromMatrix | - | 2019-03-30 |
| 912592 | DCHECK failure in !AreAliased(dst_high, src_low) in macro-assembler-arm.cc | - | 2019-03-30 |
| 913805 | Crash in es2::Shader::compile | - | 2019-03-30 |
| 916897 | Crash in blink::FindBuffer::PositionAtStartOfCharacterAtIndex | - | 2019-03-30 |
| 917147 | Crash in FromHeapObject | - | 2019-03-30 |
| 917545 | abort in pdfium_test (copied from PDFium tracker) | - | 2019-03-30 |
| 733943 | Do not store URLs in xattr | - | 2019-03-29 |
| 901768 | Need a reliable mechanism to make the login profile inaccessible after login completes | - | 2019-03-29 |
| 912211 | Security: a use-after-free in RenderFrameImple can lead to an RCE | $3,000 | 2019-03-29 |
| 910916 | Heap-use-after-free in baseline::run_program | - | 2019-03-28 |
| 916428 | Heap-buffer-overflow in spvtools::opt::IRContext::ReplaceAllUsesWith | - | 2019-03-28 |
| 916525 | DCHECK failure in HasSimpleParameters() || is_block_scope() || is_being_lazily_parsed_ in scopes.c | - | 2019-03-28 |
| 916869 | Ill in v8::internal::wasm::fuzzer::WasmExecutionFuzzer::FuzzWasmModule | - | 2019-03-28 |
| 901677 | Heap-use-after-free in baseline::exec_ops | - | 2019-03-27 |
| 906437 | Use-of-uninitialized-value in av_tolower | - | 2019-03-27 |
| 914240 | Crash in dawn_native::null::Buffer::SetSubDataImpl | - | 2019-03-27 |
| 915205 | Crash in dawn_native::BufferBase::SetSubData | - | 2019-03-27 |
| 915446 | Security: Background fetch leaks cross-origin response size | $1,000 | 2019-03-27 |
| 915469 | Security: Type Confusion in LayoutBlockFlow::CreateLineBoxes | $3,000 | 2019-03-27 |
| 915492 | Crash in dawn_wire::server::Server::OnMapReadAsyncCallback | - | 2019-03-27 |
| 915550 | Heap-use-after-free in content::BackgroundFetchContext::StartFetch | - | 2019-03-27 |
| 915587 | Use-of-uninitialized-value in blink::MarkingVisitor::ConservativelyMarkAddress | - | 2019-03-27 |
| 915783 | Security: Heap-use-after-free in TypedArray.toLocaleString | $5,000 | 2019-03-27 |
| 916288 | DCHECK failure in IsAssignmentContext() in pattern-rewriter.cc | - | 2019-03-27 |
| 899689 | Security: Incorrect convexity assumptions in Skia leading to buffer overflows | - | 2019-03-26 |
| 906333 | Use-of-uninitialized-value in mz_zip_entry_read_header | - | 2019-03-26 |
| 912947 | Security: UAFs in PaymentRequest service | - | 2019-03-26 |
| 912997 | Heap-use-after-free in media::AudioThreadHangMonitor::StartTimer | - | 2019-03-26 |
| 913246 | WebRTC: Potential Use-after-free in VP8 Block Decoding (MFQE feature) | $1,000 | 2019-03-26 |
| 914615 | Bad-cast to dawn_wire::server::Serverdawn_wire::server::ForwardBufferMapReadAsync in dawn_native::BufferBase::~BufferBase | - | 2019-03-24 |
| 914562 | Heap-use-after-free in gcm::GCMDriver::Shutdown | - | 2019-03-24 |
| 914620 | Heap-use-after-free in dawn_wire::server::Server::GetCmdSpace | - | 2019-03-24 |
| 915299 | Crash in net_http_server_fuzzer | - | 2019-03-24 |
| 905940 | OOB Write in ValueDeserializer::ReadDenseJSArray (Tian Fu Cup exploit) | - | 2019-03-23 |
| 908358 | Heap-buffer-overflow in mov_read_trun | - | 2019-03-23 |
| 913970 | UAP in blink::FileReaderLoader::OnStartLoading | $3,000 | 2019-03-23 |
| 912520 | Security: UAF in RenderFrameHostImpl::CreateMediaStreamDispatcherHost | - | 2019-03-23 |
| 914020 | Heap-buffer-overflow in spvtools::opt::IRContext::ReplaceAllUsesWith | - | 2019-03-23 |
| 914262 | Use-of-uninitialized-value in content::RenderFrameImpl::CommitNavigation | - | 2019-03-23 |
| 915293 | Heap-use-after-free in content::RenderFrameImpl::CommitNavigation | - | 2019-03-23 |
| 896838 | Heap-buffer-overflow in libX11.so.6 | - | 2019-03-22 |
| 904105 | quipper_perf_reader_read_fuzzer Crash in _fini | - | 2019-03-22 |
| 906379 | Use-of-uninitialized-value in WebRtcIsacfix_PitchFilterCore | - | 2019-03-22 |
| 910014 | Heap-use-after-free in aura::Env::last_mouse_location | - | 2019-03-22 |
| 913807 | Heap-use-after-free in BadgeServiceImpl::ClearBadge | - | 2019-03-22 |
| 913975 | Chrome tab crashes when a pattern containing a Hebrew character followed by 2 horizontal tabs and then another character is clicked. | $1,000 | 2019-03-22 |
| 914216 | Incorrect-function-pointer-type in base::OnceCallback<void | - | 2019-03-22 |
| 914251 | Bad-cast to std::__1::__function::__base<void ()> from std::__1::__function::__func<void (*)(), std::__1::allocator<void (*)()>, void ()> in v8::base::CallOnceImpl | - | 2019-03-22 |
| 914325 | Bad-cast to gl::Object from es2::Context in egl::Display::createContext | - | 2019-03-22 |
| 914497 | QUIC proxying breaks end-to-end encryption | $7,500 | 2019-03-22 |
| 914697 | Heap-buffer-overflow in av_reallocp | - | 2019-03-22 |
| 914699 | Heap-buffer-overflow in av_realloc_f | - | 2019-03-22 |
| 914701 | Heap-buffer-overflow in ff_hNUMBER_packet_split | - | 2019-03-22 |
| 914812 | Heap-use-after-free in base::internal::ObserverListThreadSafeBase::Dispatcher<base::PowerObserver, void | - | 2019-03-22 |
| 914820 | Use-of-uninitialized-value in v8::internal::compiler::Node::AppendUse | - | 2019-03-22 |
| 901206 | Memcpy-param-overlap in av1_convolve_2d_copy_sr_sse2 | - | 2019-03-21 |
| 902427 | Permissions request clickjacking flaw report: | $2,000 | 2019-03-21 |
| 913232 | DCHECK failure in HasIncomingBackEdges(block) implies block_effects.For(block->PredecessorAt(0), b | - | 2019-03-21 |
| 912504 | CHECK failure: fixed_size_above_fp + in deoptimizer.cc | - | 2019-03-21 |
| 913822 | DCHECK failure in !failed_ in asm-parser.cc | - | 2019-03-21 |
| 914388 | CHECK failure: fixed_size_above_fp + in deoptimizer.cc | - | 2019-03-21 |
| 888310 | CrOS: Vulnerability reported in dev-libs/libxml2 | - | 2019-03-20 |
| 893395 | ASSERT: failed: expected exception __c_0, got RangeError: Array buffer allocation | - | 2019-03-20 |
| 910098 | Heap-use-after-free in blink::AudioNodeOutput::RemoveInput | - | 2019-03-20 |
| 912887 | CVE-2018-17972 CrOS: Vulnerability reported in Linux kernel | - | 2019-03-20 |
| 912922 | Heap-use-after-free in base::internal::ObserverListThreadSafeBase::Dispatcher<base::PowerObserver, void | - | 2019-03-20 |
| 913212 | DCHECK failure in index >= 0 && index < this->length() in fixed-array-inl.h | - | 2019-03-20 |
| 883596 | Security: Skia missing reset fLastMoveToIndex in SkPath::transform() lead to out-of-bound | - | 2019-03-19 |
| 896538 | Security: Skia fLastMoveToIndex wrong state | - | 2019-03-19 |
| 902516 | Security: Lock Screen allows pasting of contents from locked session | - | 2019-03-19 |
| 913296 | Security: V8: Incorrect type information on SpeculativeSafeIntegerSubtract | $5,000 | 2019-03-19 |
| 767635 | CSP inheritance to cross-origin navigated data URL allows cross-origin info leak | $500 | 2019-03-18 |
| 907937 | DCHECK failure in (pending_foreground_task_) == nullptr in module-compiler.cc | - | 2019-03-18 |
| 912980 | Use-of-uninitialized-value in v8::internal::Decoder<v8::internal::Simulator>::DecodeBranchSystemException | - | 2019-03-17 |
| 911416 | Security: SEGV_ACCERR in Symbol.prototype.description hash calc | - | 2019-03-16 |
| 912600 | Heap-use-after-free in dawn_native::DeviceBase::Release | - | 2019-03-16 |
| 912596 | Use-of-uninitialized-value in v8::internal::Simulator::FPCompare | - | 2019-03-16 |
| 912601 | Heap-use-after-free in dawn_native::DeviceBase::Release | - | 2019-03-16 |
| 912693 | Global-buffer-overflow in CreateECCBlock | - | 2019-03-16 |
| 912646 | Use-of-uninitialized-value in dawn_native::DeviceBase::Release | - | 2019-03-16 |
| 883265 | CrOS: Vulnerability reported in net-misc/curl | - | 2019-03-15 |
| 904182 | Downloaded .desktop file execution in Linux | - | 2019-03-15 |
| 907211 | Heap-use-after-free in viz::HostFrameSinkManager::InvalidateFrameSinkId | - | 2019-03-15 |
| 909865 | Security: iframe.contentWindow.location.href can bypass CSP for javascript URLs | $1,000 | 2019-03-15 |
| 910663 | Crash in Builtins_PromiseRejectReactionJob | - | 2019-03-15 |
| 911907 | DCHECK failure in !is_running_microtasks_ in isolate.cc | - | 2019-03-15 |
| 89453 | UXSS with empty SecurityOrigin | $1,000 | 2019-03-15 |
| 456518 | HTML parser may leave frame element in an incorrect state | $7,500 | 2019-03-15 |
| 906383 | Use-of-uninitialized-value in quic::QuicFramer::ProcessIetfFrameData | - | 2019-03-14 |
| 906652 | Use-of-uninitialized-value in gpu::gles2::ContextState::InitState | - | 2019-03-14 |
| 908829 | Crash in dawn_native::BufferBase::SetSubData | - | 2019-03-14 |
| 910210 | In presence of NetworkService, AppCache may be used to bypass CORB | - | 2019-03-14 |
| 911827 | Bad-cast to dawn_native::DeviceBase from invalid vptr in dawn_native::ValidatingDeviceRelease | - | 2019-03-14 |
| 912125 | Heap-buffer-overflow in fxcrt::WideString::SetAt | - | 2019-03-14 |
| 884511 | Security: ChromeOS root Command Execution | $11,337 | 2019-03-13 |
| 900386 | Use-of-uninitialized-value in SuperBlitter::blitH | - | 2019-03-13 |
| 905542 | Heap-use-after-free in base::internal::Invoker<base::internal::BindState<void | - | 2019-03-13 |
| 906427 | Heap-buffer-overflow in spvtools::utils::SmallVector<unsigned int, 2ul>::operator | - | 2019-03-13 |
| 906837 | User can open browser in sign-in profile from captive profile dialog | - | 2019-03-13 |
| 907278 | Heap-use-after-free in dawn_native::DeviceBase::Release | - | 2019-03-13 |
| 907345 | Use-of-uninitialized-value in dawn_native::DeviceBase::Release | - | 2019-03-13 |
| 907386 | Heap-use-after-free in dawn_native::DeviceBase::Release | - | 2019-03-13 |
| 910223 | DCHECK failure in left != right in macro-assembler-arm.cc | - | 2019-03-13 |
| 910903 | DCHECK failure in !AreAliased(dst_high, src_low) in macro-assembler-arm.cc | - | 2019-03-13 |
| 910852 | Heap-use-after-free in spvtools::opt::VectorDCE::HasScalarResult | - | 2019-03-13 |
| 911155 | Heap-use-after-free in dawn_native::DeviceBase::Release | - | 2019-03-13 |
| 911686 | Heap-buffer-overflow in SuperBlitter::blitH | - | 2019-03-13 |
| 831112 | CrOS: Vulnerability reported in net-misc/curl | - | 2019-03-12 |
| 836148 | CSP should always inherit same-origin opener's CSP | $500 | 2019-03-12 |
| 894228 | CSP bypass with blob URL | $1,000 | 2019-03-12 |
| 901605 | CrOS: Vulnerability reported in media-libs/tiff | - | 2019-03-12 |
| 905301 | Security: CSP does not propagate to blob: URIs | $1,000 | 2019-03-12 |
| 908207 | Security: CSP(Content-security-policy) vulnerabilities are not completely repaired in Chrome 70.0.3538.110 and can still be bypassed | - | 2019-03-12 |
| 909990 | unknow memory write in v8 | - | 2019-03-12 |
| 905571 | Use-of-uninitialized-value in extensions::ChromeExtensionsBrowserClient::GetOriginalContext | - | 2019-03-10 |
| 910480 | Heap-buffer-overflow in safe_browsing::PeImageReader::EnumCertificates | - | 2019-03-10 |
| 910850 | CHECK failure: size <= elements()->length() || elements() == ReadOnlyRoots(isolate).empty_fixed | - | 2019-03-10 |
| 867807 | Security: Symlinks on user-supplied file systems allow are risky | - | 2019-03-09 |
| 898306 | Raw cookies are disclosed to cross-site renderer (in presence of DevTools and NetworkService) | - | 2019-03-09 |
| 910593 | Crash in VisitPointersImpl<v8::internal::ObjectSlot> | - | 2019-03-09 |
| 910632 | Crash in FromHeapObject | - | 2019-03-09 |
| 910634 | Crash in MemCopy | - | 2019-03-09 |
| 910662 | Crash in void v8::internal::EvacuateVisitorBase::RawMigrateObject< | - | 2019-03-09 |
| 904265 | OOB operation in swiftshader's JIT | $1,000 | 2019-03-08 |
| 908834 | Use-of-uninitialized-value in void base::Pickle::WriteBytesStatic<4ul> | - | 2019-03-08 |
| 909678 | CrOS: Vulnerability reported in net-vpn/strongswan | - | 2019-03-08 |
| 909796 | Bad-cast to blink::StringResource8 from blink::ParkableStringResource8 in blink::V8Element::GetElementsByClassNameMethodCallback | - | 2019-03-08 |
| 909976 | Heap-use-after-free in v8::internal::Scope::Snapshot::RestoreEvalFlag | - | 2019-03-08 |
| 910247 | Global-buffer-overflow in blink::Element::HasPart | - | 2019-03-08 |
| 884917 | shill privilege escalation | - | 2019-03-07 |
| 895117 | Heap-use-after-free in hb_buffer_t::replace_glyphs | - | 2019-03-07 |
| 903500 | Potential Use-After-Free in ui/accessibility/ax_tree.cc | - | 2019-03-07 |
| 906436 | Heap-use-after-free in scoped_refptr<base::SingleThreadTaskRunner>::scoped_refptr | - | 2019-03-07 |
| 906465 | Global-buffer-overflow in CBC_PDF417HighLevelEncoder::EncodeText | - | 2019-03-07 |
| 907324 | Heap-buffer-overflow in v8::internal::wasm::WasmDecoder<1>::OpcodeLength | - | 2019-03-07 |
| 907524 | Heap-use-after-free in content::ResolveProxyMsgHelper::OnProxyLookupComplete | - | 2019-03-07 |
| 908749 | Security: WebGL heap-buffer-overflow in clearBufferuiv() | $1,000 | 2019-03-07 |
| 909609 | Use-after-poison in blink::V8Element::PartAttributeGetterCallbackForMainWorld | - | 2019-03-07 |
| 908975 | DCHECK failure in outer_scope_ == scope->outer_scope() in bytecode-generator.cc | - | 2019-03-07 |
| 909613 | Use-after-poison in blink::Element::HasPart | - | 2019-03-07 |
| 909643 | Use-after-poison in blink::PartNames::PartNames | - | 2019-03-07 |
| 909656 | Crash in Builtins_TestEqualHandler | - | 2019-03-07 |
| 909648 | Use-after-poison in blink::V8Element::PartAttributeGetterCallbackForMainWorld | - | 2019-03-07 |
| 909691 | Crash in v8::internal::FunctionCallbackArguments::Call | - | 2019-03-07 |
| 910042 | Use-after-poison in blink::AddToSet | - | 2019-03-07 |
| 900910 | Multiple vulnerabilities in sqlite; Cast is 1 attack vector/target | $10,337 | 2019-03-06 |
| 904057 | Crash in Builtins_PromiseRejectReactionJob | - | 2019-03-06 |
| 904368 | Use-of-uninitialized-value in v8::internal::Simulator::FPRoundInt | - | 2019-03-06 |
| 904772 | Use-of-uninitialized-value in v8::internal::Factory::NewNumber | - | 2019-03-06 |
| 907427 | Security: pdfium heap-use-after-free | - | 2019-03-06 |
| 907430 | Security: pdfium SEGV on unknown address / wild jump | $3,000 | 2019-03-06 |
| 907479 | Use-of-uninitialized-value in v8::internal::CopyDoubleToObjectElements | - | 2019-03-06 |
| 907714 | Debug check failed JSFunction::GetDerivedMap | $1,000 | 2019-03-06 |
| 908877 | DCHECK failure in obj->IsHashTable() || obj->IsPropertyArray() || obj->IsFixedArray() || obj->IsJS | - | 2019-03-06 |
| 909588 | Crash in v8::internal::JSNumberFormat::set_locale | - | 2019-03-06 |
| 805557 | Security: DevTools protocol clients (e.g. extensions) can read arbitrary local files via DOM.setFileInputFiles | $2,000 | 2019-03-05 |
| 873453 | CrOS: Vulnerability reported in dev-libs/openssl | - | 2019-03-05 |
| 904167 | DCHECK failure in !IsSmi() == Internals::HasHeapObjectTag(ptr()) in objects.h | - | 2019-03-05 |
| 906043 | Security: Tianfu CUP RCE | - | 2019-03-05 |
| 907847 | Heap-buffer-overflow in shill::Nl80211Frame::Nl80211Frame | - | 2019-03-05 |
| 908183 | Global-buffer-overflow in v8::internal::KeywordOrIdentifierToken | - | 2019-03-05 |
| 908199 | Global-buffer-overflow in v8::internal::Scanner::ScanIdentifierOrKeywordInnerSlow | - | 2019-03-05 |
| 908202 | Global-buffer-overflow in v8::internal::PerfectKeywordHash::Hash | - | 2019-03-05 |
| 908231 | DCHECK failure in parse_lazily() implies allow_lazy_ in parser.cc | - | 2019-03-05 |
| 908282 | Heap-buffer-overflow in BEInt<unsigned int, 4>::operator unsigned int | - | 2019-03-05 |
| 908292 | Security: heap-use-after-free in __tree_next_iter | $500 | 2019-03-05 |
| 908304 | Security: chrome.wallpaper and chrome.wallpaperPrivate issues | $1,000 | 2019-03-05 |
| 908495 | DCHECK failure in !AllowHeapAllocation::IsAllowed() in string-inl.h | - | 2019-03-05 |
| 904026 | DCHECK failure in !move_dst_regs_.has(dst) in liftoff-assembler.cc | - | 2019-03-04 |
| 904219 | Security: Sites can open extension pages using WindowClient.navigate | $500 | 2019-03-04 |
| 906305 | UAF in Network Service in CorsURLLoaderFactory | - | 2019-03-04 |
| 907047 | Security: Possible to retrieve cross-origin image data from canvas | $4,000 | 2019-03-04 |
| 908234 | Global-buffer-overflow in CBC_ErrorCorrection::createECCBlock | - | 2019-03-04 |
| 908309 | Unknown signal in Builtins_InterpreterEntryTrampoline | - | 2019-03-04 |
| 908196 | DCHECK failure in !has_error() implies FunctionKind::kArrowFunction == next_arrow_function_kind_ i | - | 2019-03-02 |
| 917897 | Security: beaconing users via Google Chrome's pdf viewer | - | 2019-03-01 |
| 901801 | Security: Linux: mremap() TLB flush too late with concurrent ftruncate() | - | 2019-03-01 |
| 903690 | Heap-use-after-free in mz_zip_path_compare | - | 2019-03-01 |
| 904606 | DCHECK failure in 0 != kLiftoffAssemblerFpCacheRegs & reg.bit() in liftoff-register.h | - | 2019-03-01 |
| 907575 | DCHECK failure in binop->op() == Token::COMMA in parser.cc | - | 2019-03-01 |
| 907669 | DCHECK failure in !has_error() implies !next_arrow_formals_parenthesized_ in parser-base.h | - | 2019-03-01 |
| 907813 | Bad-cast to media::DecoderFactory from GoogleURLLoaderThrottle in media::DefaultRendererFactory::CreateAudioDecoders | - | 2019-03-01 |
| 907814 | Heap-use-after-free in media::DefaultRendererFactory::CreateAudioDecoders | - | 2019-03-01 |
| 907815 | Bad-cast to media::DefaultRendererFactory from invalid vptr in base::internal::Invoker<base::internal::BindState<std::__1::vector<std::__1::unique_ptr<media::AudioDecoder, std::__1::default_delete<media::AudioDecoder> >, std::__1::allocator<std::__1::unique_ptr<media::AudioDecoder, std::__1::default_delete<media::AudioDecoder> > > > | - | 2019-03-01 |
| 906457 | Use-of-uninitialized-value in void base::Pickle::WriteBytesStatic<4ul> | - | 2019-02-28 |
| 906313 | redefine unconfiguable length attribute of array object | $3,000 | 2019-02-27 |
| 906349 | Incorrect-function-pointer-type in dawn_wire::server::Server::Server | - | 2019-02-27 |
| 906391 | Crash in dawn_native::SwapChainBuilder::SetImplementation | - | 2019-02-27 |
| 906893 | ASSERT: CSA_ASSERT failed: IsFastRegExpWithOriginalExec(context, regexp) | - | 2019-02-26 |
| 906975 | Global-buffer-overflow in CBC_ErrorCorrection::createECCBlock | - | 2019-02-26 |
| 906220 | DCHECK failure in index >= 0 in escape-analysis.cc | - | 2019-02-25 |
| 906334 | Stack-use-after-scope in blink::ExpandEndToSentenceBoundary | - | 2019-02-24 |
| 896114 | Use-of-uninitialized-value in blink::WorkletAnimation::UpdateCompositingState | - | 2019-02-23 |
| 904093 | Heap-buffer-overflow in spvtools::utils::SmallVector<unsigned int, 2ul>::operator | - | 2019-02-23 |
| 905614 | CVE-2018-16658 CrOS: Vulnerability reported in Linux kernel | - | 2019-02-23 |
| 906280 | Stack-use-after-scope in blink::ExpandEndToSentenceBoundary | - | 2019-02-23 |
| 891521 | Uninitialized-read when constructing DnsResponse from DnsQuery | - | 2019-02-22 |
| 894020 | CrOS: Vulnerability reported in media-libs/tiff | - | 2019-02-22 |
| 899209 | CrOS: Vulnerability reported in media-libs/tiff | - | 2019-02-22 |
| 903566 | DCHECK failure in array->HasFastPackedElements() in js-list-format.cc | - | 2019-02-22 |
| 904241 | Security: Type confusion in blink::GetTypeExtension | $5,000 | 2019-02-22 |
| 904545 | Use-after-poison in v8::internal::BufferedCharacterStream<v8::internal::ExternalStringStream>::ReadB | - | 2019-02-22 |
| 904655 | Crash in mz_stream_mem_read | - | 2019-02-22 |
| 904736 | Bad-cast to std::__1::locale::__imp from std::__1::locale::__imp in ld-linux-x86-64.so.2 | - | 2019-02-22 |
| 904714 | heap-use-after-free on sw::Renderer::finishRendering | $3,000 | 2019-02-22 |
| 905587 | DCHECK failure in token.invalid_template_escape_message == MessageTemplate::kNone in scanner.cc | - | 2019-02-22 |
| 905907 | DCHECK failure in (function_) == nullptr in scopes.cc | - | 2019-02-22 |
| 904027 | Heap-buffer-overflow in spvtools::opt::Instruction::GetSingleWordOperand | - | 2019-02-21 |
| 619166 | Universal XSS with global proxies, interceptors, and synchronous page loads | $7,500 | 2019-02-21 |
| 354123 | UXSS with Object.setPrototypeOf | $5,000 | 2019-02-21 |
| 590275 | Internal object leak in ModuleSystem::RequireForJsInner => Universal XSS | $7,500 | 2019-02-21 |
| 546677 | Universal XSS with SendRequestNatives::GetGlobal | $7,500 | 2019-02-21 |
| 601073 | Security: Universal XSS in extension bindings | $7,500 | 2019-02-21 |
| 504011 | Security: Cross-origin scripting possible via module system leak | $7,500 | 2019-02-20 |
| 901307 | CVE-2018-10902 CrOS: Vulnerability reported in Linux kernel | - | 2019-02-20 |
| 903440 | Bad-cast to blink::LocalFrameView from blink::WebPluginContainerImpl in blink::GetScrollableArea | - | 2019-02-20 |
| 904138 | Heap-use-after-free in viz::HostFrameSinkManager::InvalidateFrameSinkId | - | 2019-02-20 |
| 904272 | Debug check failed in DefineClass | - | 2019-02-20 |
| 904688 | Crash in blink::LocalDOMWindow::document | - | 2019-02-20 |
| 904806 | Bad-cast to blink::DOMTimer from blink::TimerBase in blink::TraceTrait<blink::DOMTimer>::Trace | - | 2019-02-20 |
| 902672 | CSA_ASSERT in Array.p.join | - | 2019-02-19 |
| 902691 | Use-of-uninitialized-value in vp8_signed_char_clamp | - | 2019-02-19 |
| 902621 | Use-of-uninitialized-value in blink::AXObjectCacheImpl::GetOrCreate | - | 2019-02-18 |
| 903697 | CHECK failure: heap_->Contains(object) in heap.cc | - | 2019-02-18 |
| 904036 | Use-of-uninitialized-value in blink::AXObjectCacheImpl::GetOrCreate | - | 2019-02-18 |
| 903701 | Use-of-uninitialized-value in SkColorTypeToGrColorType | - | 2019-02-17 |
| 881252 | Crash in v8::internal::Simulator::LoadStorePairHelper | - | 2019-02-16 |
| 896326 | Crash in MemoryWrite<unsigned | - | 2019-02-16 |
| 903245 | DCHECK failure in index >= 0 && index < this->capacity() in fixed-array-inl.h | - | 2019-02-16 |
| 903586 | Use-after-poison in blink::SetWeakCallbackForGCObservation | - | 2019-02-16 |
| 903790 | Bad-cast to blink::SVGPropertyBase from invalid vptr in blink::MarkingVisitor::Visit | - | 2019-02-16 |
| 645211 | Security: Universal XSS using blink::HTMLMarqueeElement | $7,500 | 2019-02-16 |
| 516377 | UAF/DOM tree corruption in blink::ContainerNode::parserRemoveChild | $7,500 | 2019-02-16 |
| 464552 | Heap-use-after-free in blink::ContainerNode::attach | $7,500 | 2019-02-16 |
| 616225 | Security: Universal XSS in V8Console::memoryGetterCallback | $7,500 | 2019-02-16 |
| 896736 | Security: use-after-poison in blink::AsyncMethodRunner<class blink::MediaRecorder>::RunAsync | $3,000 | 2019-02-15 |
| 902608 | Crash in GetValueByObjectIndex | - | 2019-02-15 |
| 902610 | Crash in Builtins_MovExtraWideHandler | - | 2019-02-15 |
| 903070 | ASSERT: CSA_ASSERT failed: IsStrong(object) | - | 2019-02-15 |
| 903231 | Use-of-uninitialized-value in send_delete_event | - | 2019-02-15 |
| 543292 | Security: Integer type and overflow problems in crazy linker | - | 2019-02-14 |
| 899126 | Security: malicious WPAD server can proxy localhost (leading to XSS in http://localhost:*/*) | - | 2019-02-14 |
| 902395 | Security: bytecode-graph-builder values_[index] != builder()->jsgraph()->OptimizedOutConstant() | - | 2019-02-14 |
| 902552 | DCHECK failure in AllowCodeDependencyChange::IsAllowed() in objects.cc | - | 2019-02-14 |
| 902693 | Heap-use-after-free in mz_zip_entry_is_dir | - | 2019-02-14 |
| 830177 | Presentation API doesn't show initiator info for opaque origin | - | 2019-02-13 |
| 895336 | Security: Release the Kraken: New KRACKs in the 802.11 Standard | - | 2019-02-13 |
| 895942 | CHECK failure: bcp47_length == parsed_length in intl-objects.cc | - | 2019-02-13 |
| 901651 | Use-of-uninitialized-value in content::BlinkTestController::CompositeAllFramesThen | - | 2019-02-13 |
| 901782 | Crash in mz_stream_mem_read | - | 2019-02-13 |
| 902208 | Heap-use-after-free in views::InkDropHostView::OnMouseEvent | - | 2019-02-13 |
| 897263 | Security: potential integer overflow in SkStreamBuffer.cpp | - | 2019-02-12 |
| 900552 | Heap-use-after-free in CPDF_OCContext::CheckOCGVisible | $3,000 | 2019-02-12 |
| 901633 | ASSERT: CSA_ASSERT failed: Torque assert 'srcPos <= GetReceiverLengthProperty(sortState) | - | 2019-02-12 |
| 901598 | Security DCHECK failure: !object || (object->IsLayoutInline()) in layout_inline.h | - | 2019-02-12 |
| 901944 | ASSERT: CSA_ASSERT failed: IntPtrOrSmiLessThanOrEqual( capacity, IntPtrOrSmiConstant(JSA | - | 2019-02-12 |
| 901040 | Unknown signal in libv8.so | - | 2019-02-11 |
| 883666 | Security: Skia integer-overflow in SkPathRef::resetToSize() | - | 2019-02-09 |
| 884473 | Security: Skia heap-buffer-overflow in SkMaskBlurFilter::blur() | - | 2019-02-09 |
| 901030 | Heap-buffer-overflow in bool WTF::TextCodecUTF8::HandlePartialSequence<unsigned short> | $3,000 | 2019-02-09 |
| 520275 | Chromium Prerender page is able to play voice synthesis audio before going to page | - | 2019-02-08 |
| 890576 | heap buffer overflow in skia::SkTDPQueue::insert | $3,000 | 2019-02-08 |
| 898785 | ASSERT: CSA_ASSERT failed: SmiBelow(effective_index, LoadFixedArrayBaseLength(array)) | - | 2019-02-08 |
| 526404 | Security: events can be tracked inside PDF viewer for cross origin PDFs | - | 2019-02-07 |
| 849421 | Security: IDN URL spoofing - "ଠ" can be used to spoof "o2.co.uk" | - | 2019-02-07 |
| 891559 | Use-of-uninitialized-value in blink::AXObjectCacheImpl::ChildrenChanged | - | 2019-02-07 |
| 891697 | Security: macOS: the option to "Allow JavaScript From Apple Events" can easily be activated by malicious apps. | $500 | 2019-02-07 |
| 896717 | Security: IDN URL Spoofing with U+02ec | $500 | 2019-02-07 |
| 896987 | Security: Skia heap-buffer-overflow in SkGenerateDistanceFieldFromA8Image | - | 2019-02-07 |
| 899537 | Crash in v8::internal::interpreter::BytecodeGenerator::BuildVariableAssignment | - | 2019-02-07 |
| 900087 | Bad-cast to content::RenderFrameHost from invalid vptr in content::BlinkTestController::CompositeNodeQueueThen | - | 2019-02-07 |
| 900474 | Unknown signal in libv8.so | - | 2019-02-07 |
| 900451 | Security DCHECK failure: !object || (object->IsLayoutInline()) in layout_inline.h | - | 2019-02-07 |
| 900560 | DCHECK failure in ok == (result != nullptr) in parser.cc | - | 2019-02-07 |
| 892646 | Security: Gujarati digits could lead to idn spoof | - | 2019-02-06 |
| 900133 | Security: assert 'value == Float64SilenceNaN(value)' failed at ../../src/builtins/array-reverse.tq:53: | - | 2019-02-06 |
| 898147 | Security: Imageloader allows mounting of components over almost arbitrary file system paths | - | 2019-02-05 |
| 899495 | DCHECK failure in (expression) != nullptr in parser.h | - | 2019-02-05 |
| 900103 | Use-of-uninitialized-value in mojo::core::ChannelPosix::WriteNoLock | - | 2019-02-05 |
| 900104 | Use-of-uninitialized-value in mojo::core::ChannelPosix::WriteNoLock | - | 2019-02-05 |
| 896776 | Security: Skia: Out-of-bounds Read in src/codec/SkSwizzler | $1,000 | 2019-02-04 |
| 899464 | ASSERT: CSA_ASSERT failed: Word32Or(Word32Equal(var_unicode.value(), zero), Word32Equal( | - | 2019-02-04 |
| 895081 | Security: Markup injection is possible in the Preview feature in the Developer Tools due to mishandling of URI encoded strings | $500 | 2019-02-02 |
| 895084 | CrOS: Vulnerability reported in dev-libs/libxml2 | - | 2019-02-02 |
| 899212 | CrOS: Vulnerability reported in dev-libs/libxml2 | - | 2019-02-02 |
| 899133 | DCHECK failure in success in pattern-rewriter.cc | - | 2019-02-02 |
| 899294 | Heap-use-after-free in ScopedObserver<ash::TabletModeController, ash::TabletModeObserver>::~ScopedObser | - | 2019-02-02 |
| 893176 | Heap-buffer-overflow in translate | - | 2019-02-01 |
| 897491 | ASSERT: mutex->__data.__owner == 0 | - | 2019-02-01 |
| 897510 | Heap-use-after-free in GrCCPathCache::find | - | 2019-02-01 |
| 898343 | Security: Idn spoof checker not checking some domains properly | - | 2019-02-01 |
| 898531 | Security: Use-after-free in CPWL_Wnd::Destroy | $5,000 | 2019-02-01 |
| 898936 | DCHECK failure in is_async implies classifier()->is_valid_async_arrow_formal_parameters() in parse | - | 2019-02-01 |
| 896725 | Security: IDN URL Spoofing with U+0a24 | - | 2019-01-31 |
| 897413 | Heap-use-after-free in GrCCPathCache::purgeAsNeeded | - | 2019-01-31 |
| 897512 | Security: assert 'srcPos <= GetReceiverLengthProperty(sortState) - length' at array-sort.tq:613: | $1,000 | 2019-01-31 |
| 898452 | Crash in SkTHashTable<GrCCPathCache::HashNode, GrCCPathCache::HashKey, GrCCPathCache::Has | - | 2019-01-31 |
| 833847 | SameSite Lax bypass with multiple-nested scenarios | $1,000 | 2019-01-30 |
| 864286 | Stealing cross-origin video pixel with HLS | $4,000 | 2019-01-30 |
| 896722 | Security: IDN URL Spoofing with U+0a67 | - | 2019-01-30 |
| 897366 | DCHECK failure in *p != to_check_ in heap.cc | - | 2019-01-30 |
| 897409 | Use-of-uninitialized-value in gpu::gles2::GLES2Implementation::BufferDataHelper | - | 2019-01-30 |
| 897404 | ASSERT: CSA_ASSERT failed: IntPtrOrSmiGreaterThan(capacity, IntPtrOrSmiConstant(0, mode) | - | 2019-01-30 |
| 897436 | ASSERT: CSA_ASSERT failed: TaggedDoesntHaveInstanceType(value, JS_PROMISE_TYPE) | - | 2019-01-30 |
| 897455 | Heap-buffer-overflow in SimplifyDebug | - | 2019-01-30 |
| 897514 | ASSERT: CSA_ASSERT failed: Word32Equal(DecodeWord32<PropertyDetails::KindField>(details) | - | 2019-01-30 |
| 897766 | DCHECK failure in next().location.beg_pos == static_cast<int>(position) in scanner.cc | - | 2019-01-30 |
| 897815 | CHECK failure: start_position == start_position_from_data in preparsed-scope-data.cc | - | 2019-01-30 |
| 897999 | Heap-use-after-free in Browser::~Browser | - | 2019-01-30 |
| 898031 | Use-of-uninitialized-value in libgtkui::SelectFileDialogImplGTK::~SelectFileDialogImplGTK | - | 2019-01-30 |
| 898455 | DCHECK failure in IrOpcode::kSpeculativeNumberEqual != node->opcode() in simplified-lowering.cc | - | 2019-01-30 |
| 881247 | Fatal error related to field tracking | - | 2019-01-29 |
| 892904 | Security: crosvm: integer overflow in PluginVcpu::handle_request | $5,000 | 2019-01-29 |
| 894399 | Security: window.location update methods don't always restrict access to local resources | $2,000 | 2019-01-29 |
| 897395 | Use-of-uninitialized-value in SkImageGenerator::queryYUVA8 | - | 2019-01-29 |
| 897110 | CSA_ASSERT failed: IsFastElementsKind(LoadElementsKind(array)) | $500 | 2019-01-28 |
| 897439 | Crash in SkTHashTable<GrCCPathCache::HashNode, GrCCPathCache::HashKey, GrCCPathCache::Has | - | 2019-01-28 |
| 882876 | Crash in _platform_memmove$VARIANT$Nehalem | - | 2019-01-26 |
| 896986 | DCHECK failure in Token::ARROW == peek() in parser-base.h | - | 2019-01-26 |
| 891187 | Security: heap-use-after-free in blink::AudioNodeOutput::Pull | $3,000 | 2019-01-25 |
| 896619 | Use-of-uninitialized-value in void base::Pickle::WriteBytesStatic<4ul> | - | 2019-01-25 |
| 695474 | Broken prefetch links can exfiltrate adjacent page text | $500 | 2019-01-24 |
| 856135 | heap-use-after-free in ProfileCompare::operator() | $500 | 2019-01-24 |
| 863663 | Security:IDN url spoofing using U+0517(Ô) | - | 2019-01-24 |
| 895799 | DCHECK failure in isolate->context() == nullptr || isolate->context()->IsContext() in runtime-inte | - | 2019-01-24 |
| 895885 | \u0909, \u0993 may lead to IDN URL Spoof | - | 2019-01-24 |
| 895970 | Update expat to latest stable | - | 2019-01-24 |
| 896117 | Bad-cast to pdfium::base::PartitionRootGeneric from invalid vptr in FPDF_InitLibraryWithConfig | - | 2019-01-24 |
| 896206 | Heap-use-after-free in drivefs::DriveFsHost::MountState::OnMountEvent | - | 2019-01-24 |
| 894812 | Security: Extensions can temporarily persist file access, even after it's been revoked | - | 2019-01-23 |
| 895152 | Security: Heap-use-after-free in CJS_Document::get_info | $5,000 | 2019-01-23 |
| 895207 | Security: IDN URL Spoofing with U+10de | - | 2019-01-23 |
| 721833 | Security: %2e in Set-Cookie domain attribute treated as equivalent to "." | - | 2019-01-22 |
| 888318 | CVE-2018-10880 CrOS: Vulnerability reported in Linux kernel | - | 2019-01-22 |
| 894673 | Heap-buffer-overflow in blink::ImageDecoderWrapper::Decode | - | 2019-01-22 |
| 895009 | Negative-size-param in CFX_CodecMemory::Consume | - | 2019-01-22 |
| 894934 | Stack-buffer-overflow in v8::internal::GenerateSourceString | - | 2019-01-22 |
| 895048 | CHECK failure: marking_state_->IsBlackOrGrey(object) in mark-compact.cc | - | 2019-01-22 |
| 895441 | DCHECK failure in kFullTransitionArray == encoding() in transitions.cc | - | 2019-01-22 |
| 895199 | DCHECK failure in restriction_type.Is(info->restriction_type()) in simplified-lowering.cc | - | 2019-01-21 |
| 895083 | Use-of-uninitialized-value in storage::DatabaseTracker::UpdateOpenDatabaseInfoAndNotify | - | 2019-01-21 |
| 879544 | CVE-2018-13053 CrOS: Vulnerability reported in Linux kernel | - | 2019-01-19 |
| 895026 | Heap-use-after-free in fxcrt::UnownedPtr<unsigned char const>::ProbeForLowSeverityLifetimeIssue | - | 2019-01-19 |
| 851821 | Security: Chrome PDF reader has no restrictions/user confirmation on URI action | - | 2019-01-18 |
| 866426 | Security: debugger extension API is too powerful | - | 2019-01-18 |
| 894374 | [liftoff] [ia32] Debug check failed: !unpinned.is_empty() | - | 2019-01-18 |
| 849942 | ServiceWorker circumvents same-origin restrictions for Audio | $1,000 | 2019-01-17 |
| 879512 | Heap-use-after-free in fxcrt::UnownedPtr<unsigned char>::ProbeForLowSeverityLifetimeIssue | - | 2019-01-17 |
| 892598 | CVE-2018-10883 CrOS: Vulnerability reported in Linux kernel | - | 2019-01-17 |
| 892643 | Stack-use-after-return in gpu::raster::ClientFontManager::Serialize | - | 2019-01-17 |
| 888268 | Security: Open restriction url by google optimize | - | 2019-01-16 |
| 799747 | CSP bypass with blob URL | $1,000 | 2019-01-15 |
| 839250 | Heap-use-after-free in content::ClipboardHostImpl::ReadText | - | 2019-01-15 |
| 889459 | Security: remote code execution attack chain | $1,000 | 2019-01-15 |
| 890558 | Data URLs can be loaded on the top frame using iOS Mobile Chrome | $500 | 2019-01-15 |
| 893096 | [wasm] Code space management broken on windows | - | 2019-01-14 |
| 892858 | Global-buffer-overflow in MemoryRead<unsigned | - | 2019-01-14 |
| 850824 | Self-XSS via modal, window.open, and delayed navigation | $2,000 | 2019-01-12 |
| 870119 | Heap-buffer-overflow in translate | - | 2019-01-12 |
| 843151 | use-after-poison in operator-> (from HTMLImportsController::Dispose) | $500 | 2019-01-11 |
| 878130 | Security: Samba CVEs were missed by Vomit, and an uprev is needed | - | 2019-01-11 |
| 878353 | CVE-2018-13406 CrOS: Vulnerability reported in Linux kernel | - | 2019-01-11 |
| 884932 | Extensions can intercept sensitive browser initiated requests | - | 2019-01-11 |
| 889724 | Upstart variable import filtering doesn't work correctly | - | 2019-01-11 |
| 891210 | Security: Use-after-free in CFFL_FormFiller::KillFocusForAnnot | $3,000 | 2019-01-11 |
| 892026 | Crash in AtomicallySetQuarantineFlagIfAllocated | - | 2019-01-11 |
| 892472 | DCHECK failure in code->kind() == Code::OPTIMIZED_FUNCTION in frames.cc | - | 2019-01-11 |
| 874397 | Heap-use-after-free in net::HttpCache::Transaction::DoCacheWriteResponse | - | 2019-01-10 |
| 877791 | CHECK failure: it->second == vreg in register-allocator-verifier.h | - | 2019-01-10 |
| 881659 | Security: URL Spoofing via Bidirectional Domain Names | $2,000 | 2019-01-10 |
| 888321 | CVE-2018-14609 CrOS: Vulnerability reported in Linux kernel | - | 2019-01-10 |
| 891627 | CHECK failure: NumberModulus of kRepWord32 ((MinusZero | Range(-1, 0))) cannot be changed to kR | - | 2019-01-10 |
| 891668 | CVE-2018-10901 CrOS: Vulnerability reported in Linux kernel | - | 2019-01-10 |
| 848521 | Security: Heap overflow write in SkEdgeBuilder::buildPoly | - | 2019-01-09 |
| 886976 | Security: Site Isolation bypass using Blob URL | $8,000 | 2019-01-08 |
| 888001 | Security: Site Isolation bypass using FileSystem URL | $500 | 2019-01-08 |
| 888319 | CVE-2018-10881 CrOS: Vulnerability reported in Linux kernel | - | 2019-01-08 |
| 888315 | CVE-2018-10877 CrOS: Vulnerability reported in Linux kernel | - | 2019-01-08 |
| 888329 | CVE-2018-14617 CrOS: Vulnerability reported in Linux kernel | - | 2019-01-08 |
| 889448 | Security: Integer overflow in Linux's create_elf_tables() | - | 2019-01-08 |
| 890553 | DCHECK failure in (function_) == nullptr in scopes.cc | - | 2019-01-08 |
| 882270 | Security: url spoofing using 304 status code | $500 | 2019-01-08 |
| 864283 | Stealing cross-origin video pixel with HLS | $4,000 | 2019-01-08 |
| 890609 | CHECK failure: !v8::internal::FLAG_enable_slow_asserts || (object->IsTransitionArray()) in tran | - | 2019-01-07 |
| 888312 | CVE-2017-2618 CrOS: Vulnerability reported in Linux kernel | - | 2019-01-05 |
| 888366 | heap-use-after-free on incontent::RenderFrameHostImpl::AudioContextPlaybackStarted(int) | $5,500 | 2019-01-05 |
| 889450 | Security: potential local priviledge escalation bug in vmacache code | - | 2019-01-05 |
| 877843 | Heap-buffer-overflow in rtc::BitBuffer::PeekBits | - | 2019-01-04 |
| 880665 | Heap-use-after-free in base::debug::TaskAnnotator::RunTask | - | 2019-01-04 |
| 888320 | CVE-2018-10882 CrOS: Vulnerability reported in Linux kernel | - | 2019-01-04 |
| 888678 | Heap-use-after-free in content::KeyboardLockServiceImpl::GetKeyboardLayoutMap | - | 2019-01-04 |
| 888926 | Security: UaF in Appcache | - | 2019-01-04 |
| 606104 | Chrome for Android - Modal dialog being executed after window.open is called allows for URL Spoofing | $2,000 | 2019-01-03 |
| 884778 | dc: add a --sandbox flag | - | 2019-01-03 |
| 888923 | Security: Chrome RCE | - | 2019-01-03 |
| 889441 | Use-of-uninitialized-value in blink::LocalFrameUkmAggregator::RecordPrimarySample | - | 2019-01-03 |
| 817851 | CUPS: eliminate use of symlink in /var/spool/cups | - | 2019-01-02 |
| 887273 | Security:Chrome URL Spoofing in Omnibox | $3,000 | 2019-01-02 |
| 886753 | Security: use-after-poison in MarkSheetListDirty | $3,000 | 2019-01-02 |
| 888299 | CHECK failure: !maybe_skeleton.FromJust().empty() in js-date-time-format.cc | - | 2019-01-02 |
| 888825 | DCHECK failure in byte_data_->size() % ByteData::kSkippableFunctionDataSize == ByteData::kPlacehol | - | 2019-01-02 |
| 882423 | Security: Skia heap use-after-freed in SkPath::addPath | $1,000 | 2019-01-01 |
