Google has 2,254 CVEs on record between 2011 and 2026. Disclosure cadence is accelerating: 1835 in the last 90 days against 115 in the 90 before. The busiest recent month was October 2026 with 781. The median CVSS is 7.8 (high), with 240 rated critical. 1% have been exploited in the wild, in line with the corpus average. When CISA adds a Google CVE to KEV it happens fast: a median of 2 days after publication (12 cases). The dominant weakness classes are CWE-416 (457) and CWE-863 (223). Most affected products: Chrome (1648), Android (547), mcp_toolbox_for_databases (7).

CVEs per month

Last 12 months, by publish date

1225/120126/010226/020326/030426/040526/050626/060726/070826/080926/091026/101126/11

Exploited share: 1% vs 1% corpus
Median CVSS: 7.8
Publish → KEV: 2 d median(12)
Last 90 days: 1835 prev 115

Weakness classes

Products

Chrome 1648
Android 547
mcp_toolbox_for_databases 7
Application Integration 5
github.com/google/sam 3
Guava 2

Follow Google:RSS feed Save a search →Embed badge ↗

2254

Total CVEs

240

Critical

CISA KEV

Exploited

Worst active — by depth score

Google vulnerabilities

CVEs affecting Google, newest first. Open any entry for full detail, references, and exploit status.

2254 CVEsRSS

CVEs per month

Weakness classes

Products

Worst active — by depth score

Google vulnerabilities

In __pkvm_guest_relinquish_to_host of mem_protect.c, there is a possible out-of-bounds write due to improper input validation

In multiple functions of SearchRequestDatabaseUtil.java, there is a possible way to access protected data due to SQL injection

In ShortcutInfo of ShortcutInfo.java, there is a possible way to crash the launcher via unauthorized shortcuts due to resource exhaustion

In multiple locations, there is a possible denial of service due to a missing permission check

In updateNotificationChannel of PreferencesHelper.java, there is a possible ui obfuscation issue due to a logic error in the code

In setApplicationRestrictions of DevicePolicyManagerService.java, there is a possible denial of service due to resource exhaustion

In handleConnectInternal of RpcServerTrusty.cpp, there is a possible denial of service due to a logic error in the code

In deserialize of legacy.rs, there is a possible denial of service due to a missing bounds check

In multiple locations, there is a possible denial of service due to a logic error in the code

In InputDispatcher::flushSensor of InputDispatcher.cpp, there is a possible denial of service due to a logic error in the code

In removeUserData of DevicePolicyManagerService.java, there is a possible denial of service due to a race condition

A Use-After-Free (UAF) vulnerability exists in the EVS HAL, allowing a privileged client to free a `buffer_handle_t` while the producer thread is still using it

In validEfCfis of SIMRecords.java, there is a possible way to cause a denial of service due to an uncaught exception

In multiple locations, there is a possible permission bypass due to a logic error in the code

In multiple locations, there is a possible out of bounds read/write due to an incorrect bounds check

In __pkvm_load_tracing of trace.c, there is a possible out-of-bounds write due to an incorrect bounds check

In __pkvm_pages_to_ppages of mmu.c, there is a possible out-of-bounds write due to a race condition

In kvm_vfio_pviommu_attach of vfio.c, there is a possible double free due to a logic error in the code

In arm_lpae_split_blk_unmap of io-pgtable-arm-common.c, there is a possible memory corruption due to a race condition

In multiple locations, there is a possible out of bounds write due to an integer overflow

An unprivileged application can bypass the `android.car.permission.CAR_DISPLAY_IN_CLUSTER` permission by registering an activity with the `android.car.cluster.NAVIGATION` category and requesting navigation app focus

In multiple locations, there is a possible memory corruption due to a race condition

In multiple functions of base.c, there is a possible use-after-free due to a race condition

In setNotificationListenerAccessGrantedForUserInternal of NotificationManagerService.java, there is a possible policy desynchronization due to improper input validation

In multiple functions of fork.c, there is a possible use after free due to a logic error in the code

In multiple locations, there is a possible memory safety issue due to a use-after-free

In multiple locations, there is a possible use-after-free due to a race condition

In fuse_backing_mmap of backing.c, there is a possible memory corruption due to a use after free

In multiple functions of dma-buf.c, there is a possible use after free due to a race condition

In multiple locations, there is a possible memory corruption due to a use-after-free