I've filed dozens of bug reports for the Chromium; My research is
mostly focused on Chrome extension APIs and runtime.
My best find is an InfoLeak + XSS that allows Chrome Extensions to
edit local files on ChromeOS and run commands in its Linux container.
The writeup can be found
on my blog.
Times I've been mentioned by Google: