To file a security issue, if the vulnerability is related to Open Quantum Safe modifications to BoringSSL, please send an email to security@openquantumsafe.org.
Otherwise, if it is related to BoringSSL itself, use the Chromium process and mention in the report that this is for BoringSSL. You can ignore the parts of the process that are specific to Chromium/Chrome.