Chrome directly credits Big Sleep on eleven additional 2025 CVEs

Chrome release notes name Google Big Sleep on eleven previously omitted V8 and ANGLE vulnerabilities published from August through November 2025.

Bug class: Out-of-bounds write, heap overflow, integer overflow, use-after-free, and type confusion
Affected codebase: Google Chrome V8 and ANGLE
Credited system: Google Big Sleep
Disclosed: November 17, 2025
Attribution: Direct source attribution
Severity: high

Source status: Chrome's official stable-channel release notes explicitly name Google Big Sleep on all eleven CVEs and supply per-issue severity.

Summary

The backfill adds eleven direct Chrome credits across V8 and ANGLE. The set includes High-severity memory-safety and type-confusion issues, alongside Medium and Low variants found during the same sustained campaign.

These are historical omissions rather than new 2026 discoveries. Together with the existing SQLite, Chrome, and Apple entries, they bring Big Sleep’s public CVE count represented by Bugflation to 21.

References

Catalogued in the Bugflation public ledger. Disagree with the attribution or severity label? Email the desk.