Could I report an Code-injection bug to Google?

I have been doing some research and I have discovered that I can inject code into Google Chromium browser.

This code injection method is programmed in C++ and it uses Code-cave injection in order to inject into Google Chromium browser, and I could see this being used by malwares to steal data from Google-Chromes users.

Is this an report-able bug to Google or is it not worthy?