2 ms·
[I work at Google, but not on anything related to TAG or P0] I feel like you're misreading the timeline here. The Chrome vuln you mention was found in June 202
by joshuamorton 4y ago
[I work at Google, but not on anything related to TAG or P0]
I feel like you're misreading the timeline here. The Chrome vuln you mention was found in June 2021 and fixed in August 2021, not 2022. From the bug, it was found and fixed due to automated regression testing done by the chrome team.
This is the equivalent of asking every buffer overflow in Chrome to be assigned a CVE, which is odd. Further, it's exactly the same behavior as Mozilla follows, as demonstrated by the line
> The sandbox escape is specific to the Windows version of Firefox and was fixed without a CVE in September 2019.
in the blog post. Neither vendor is acting badly by not filing a CVE for vulnerabilities they found and fixed internally. CVEs are usually for communication across organizations, which isn't needed if everything is handled within the chrome or mozilla bug trackers.