Standard operating procedure for both the Chrome [https://chromium.googlesource.com/chromium/src/+/HEAD/docs/security/faq.md https://chromium.googlesource.com/c

Standard operating procedure for both the Chrome [https://chromium.googlesource.com/chromium/src/+/HEAD/docs/security/faq.md https://chromium.googlesource.com/chromium/src/+/HEAD/docs/s...] and Firefox [https://www.mozilla.org/en-US/about/governance/policies/security-group/bugs/ https://www.mozilla.org/en-US/about/governance/policies/secu...] bug tracking systems. But the fix itself is public in both the Chrome [https://chromium.googlesource.com/chromium/src.git/+/36dbbf38697dd1e23ef8944bb9e57f6e0b3d41ec https://chromium.googlesource.com/chromium/src.git/+/36dbbf3...] and Firefox [https://github.com/mozilla/gecko-dev/commit/ac605820636c3b964542a2c0589af04a02235d00 https://github.com/mozilla/gecko-dev/commit/ac605820636c3b96...] source repos, and it makes pretty clear what the bug is.