Use GitHub private vulnerability reporting. Sandbox escapes, unauthorized profile access, extension integrity bypass and child-data disclosure are high severity. Do not disclose exploitable details publicly before a fix is available.