Submit finding

All findings

CVE-2026-87639 high

Chrome 153 credits Codex Security on a WebPackaging use-after-free

Google directly credits amyb working with OpenAI Codex Security on a high-severity Chrome WebPackaging use-after-free.

Bug class
Use-after-free
Affected codebase
Google Chrome WebPackaging
Credited system
OpenAI Aardvark / Codex Security
Disclosed
September 8, 2026
Attribution
Direct source attribution
Severity
high
Source status: Google's Chrome 153 stable-channel release explicitly names OpenAI Codex Security in the reporter credit and rates the issue high severity.

Summary

CVE-2026-87639 is a high-severity use-after-free in WebPackaging. The Chrome release note credits amyb working with OpenAI Codex Security, providing a direct vendor-to-system attribution chain.

References

Catalogued in the Bugflation public ledger. Disagree with the attribution or severity label? Email the desk.