Tentatively setting low severity for consistency with  issue 127522 , but I'm a bit torn since it does require that the user accept a permission prompt to download multiple files.

The crash certainly isn't ideal, but we generally don't consider denial of service to be a vulnerability. More information on that at https://chromium.googlesource.com/chromium/src/+/master/docs/security/faq.md#Are-denial-of-service-issues-considered-security-bugs

qinmin, dtrainor: Are either of you the right people to take a look at this? Feel free to close if you don't think there's much that can be done here, or pass it back to me for re-triage if necessary.

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/b7fa845960fcf21001dbd3adf409e5c19046e4eb

commit b7fa845960fcf21001dbd3adf409e5c19046e4eb
Author: Min Qin <qinmin@chromium.org>
Date: Wed Aug 01 21:45:06 2018

Fix an DOS issue using download prompt dialog

This CL changes the behavior to show dialog one by one,
not showing all of them at once.
This CL also fixes an issue that DownloadFilePicker is not
deleted in some cases.

BUG= 868619 

Change-Id: I71958b8c8d1383d95996d00c58c84c5523e08bd1
Reviewed-on: https://chromium-review.googlesource.com/1157141
Commit-Queue: Min Qin <qinmin@chromium.org>
Reviewed-by: Xing Liu <xingliu@chromium.org>
Cr-Commit-Position: refs/heads/master@{#579955}
[modify] https://crrev.com/b7fa845960fcf21001dbd3adf409e5c19046e4eb/chrome/browser/download/chrome_download_manager_delegate.cc
[modify] https://crrev.com/b7fa845960fcf21001dbd3adf409e5c19046e4eb/chrome/browser/download/chrome_download_manager_delegate.h
[modify] https://crrev.com/b7fa845960fcf21001dbd3adf409e5c19046e4eb/chrome/browser/download/download_file_picker.cc
[modify] https://crrev.com/b7fa845960fcf21001dbd3adf409e5c19046e4eb/chrome/browser/download/download_test_file_activity_observer.cc

Changed the implementation to show only 1 file selection dialog at a time, this should solve the issue 

Thanks for the report! I'm afraid, however, that the VRP declined to reward for this bug.

Do the changes get merged into the stable version of Chrome though?

Will this report go on the list of security fixes in the next release as "n/a", while still mentioning what was fixed?

For CVE-2012-2848, you guys decided to reward a low impact security bug with the following comment:

"The panel decided to award $500 for this bug. The bug itself has little security value, but the fix is a good hardening measure. Thanks!"

https://bugs.chromium.org/p/chromium/issues/detail?id=127525

I know that was in the early stages of the rewards program, but is there any possibility for this report to also be reconsidered based on "the fix being a good hardening measure"?

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot