How can I report a security vulnerability privately?

[idoamitayping]

I think I have identified a security vulnerability and would like to report it privately. Could someone please provide guidance on how to securely disclose this issue?

[amaitland]

That depends on where the vulnerability is.

Is it in CefSharp directly? Is it in the Chromium Embedded Framework? Or in Chromium?

Remember that CefSharp is just a wrapper around the Chromium Embedded Framework

[idoamitayping]

I believe the vulnerability is in cefsharp itself

[amaitland]

In what feature exactly?

[amaitland]

https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing-information-about-vulnerabilities/privately-reporting-a-security-vulnerability#privately-reporting-a-security-vulnerability

You should now be able to submit a vulnerability report. Please make sure to include sufficient information to reproduce the problem.