This is a good exercise in learning why counting CVEs doesn't give you anything. If you look closer at the pdfium vulns (I reported some of those) they include

This is a good exercise in learning why counting CVEs doesn't give you anything. If you look closer at the pdfium vulns (I reported some of those) they include all kinds of "safety violations" with unclear impact. E.g. integer overflows, invalid memory reads etc. Many of those are simply undetectable without source-level check tools (mostly the C sanitizers). The Chrome team has a policy of counting a lot of stuff as vulns if it "could" cause a security issue. This is good - better safe than sorry. But it blows up their CVE count and makes them look bad for people doing bad statistics.