security: libmbim | out-of-bounds access on mbim-message.c (reward: $250) crbug.com/1474639

Security: Heap-use-after-free in ReadAnythingUntrustedPageHandler::LogTextStyle (reward: $2000) crbug.com/1493380

Security: readanything render frame UAF fix of crbug.com/1488268 is not robust. (reward: $2000) crbug.com/1492396

Heap-buffer-overflow in v8::internal::Simulator::WriteW crbug.com/1488199

Security: Integer-Overflow in ChapsAdaptor::GenerateRandom crbug.com/1476281

Security: Out-of-Bound Write due to bound check missing (reward: $5000) crbug.com/1474415

Security: Heap buffer overflow write due to bound check missing crbug.com/1474410

Security: UAF in gpu::ClientSharedImageInterface::DestroySharedImage(browser process) (reward: $2000) crbug.com/1453577

lightweight-heap-use-after-free : web_app::WebAppCommandManager::StartCommand crbug.com/1495279

heap-buffer-overflow in ~SingleShotFrameHandler(imagecapture/image_capture_frame_grabber.cc) (reward: $8000) crbug.com/1494573

Security: OOB access in crbug.com/1480661

Use-after-poison in blink::HTMLPlugInElement::DetachLayoutTree crbug.com/1495512

Security: Race Condition UAF in virtio_transport_space_update (reward: $2000) crbug.com/1486350

Security: Chrome OS: Multiple controllable OOB write bugs in Qcom camx drivers may cause sandbox escape to kernel crbug.com/1472961

chrome.inspectedWindow.eval execution on Web Store with trailing URL dot (reward: $5000) crbug.com/1472898

Security: Contextual search selection offsets should be sanitized crbug.com/1343955

Use-after-poison in cppgc::internal::MarkingStateBase::MarkAndPush crbug.com/1496806

Use-after-poison in cppgc::internal::HeapVisitor<cppgc::internal::UnmarkedObjectsPoisoner>::Traverse crbug.com/1496001

Security: arbitrary address access in vrend_renderer_blit_gl (reward: $2000) crbug.com/1483991

Because of the migration of Chromium bug tracker from Monorail to Buganizer, this account won't submit new bugs temporarily (until it's migrated to fetch the data from the new source). Sorry!