Google has 2,254 CVEs on record between 2011 and 2026. Disclosure cadence is accelerating: 1835 in the last 90 days against 115 in the 90 before. The busiest recent month was October 2026 with 781. The median CVSS is 7.8 (high), with 240 rated critical. 1% have been exploited in the wild, in line with the corpus average. When CISA adds a Google CVE to KEV it happens fast: a median of 2 days after publication (12 cases). The dominant weakness classes are CWE-416 (457) and CWE-863 (223). Most affected products: Chrome (1648), Android (547), mcp_toolbox_for_databases (7).

CVEs per month

Last 12 months, by publish date

1225/120126/010226/020326/030426/040526/050626/060726/070826/080926/091026/101126/11

Exploited share: 1% vs 1% corpus
Median CVSS: 7.8
Publish → KEV: 2 d median(12)
Last 90 days: 1835 prev 115

Weakness classes

Products

Chrome 1648
Android 547
mcp_toolbox_for_databases 7
Application Integration 5
github.com/google/sam 3
Guava 2

Follow Google:RSS feed Save a search →Embed badge ↗

2254

Total CVEs

240

Critical

CISA KEV

Exploited

Worst active — by depth score

Google vulnerabilities

CVEs affecting Google, newest first. Open any entry for full detail, references, and exploit status.

2254 CVEsRSS

CVEs per month

Weakness classes

Products

Worst active — by depth score

Google vulnerabilities

In do_fault_around of memory.c, there is a possible use after free due to a logic error in the code

In ksys_unshare of fork.c, there is a possible memory corruption due to a use after free

In multiple locations, there is a possible use-after-free due to a logic error in the code

In startTetheredHotspotRequest of WifiServiceImpl.java, there is a possible permission bypass due to a confused deputy

In queryRemoteConnectionServices of ConnectionServiceWrapper.java, there is a possible permission bypass due to a confused deputy

In multiple locations, there is a possible permission bypass due to a confused deputy

In multiple functions in multiple locations, there is a possible execution of sensitive USSD codes due to a confused deputy

In onActivityResult in multiple locations, there is a possible contact leak from protected profile due to a confused deputy

In deliverResult of AppTimeTracker.java, there is a possible background activity launch due to a confused deputy

In handleAudioEffectBroadcast of MusicFxHelper.java, there is a possible permission bypass due to a confused deputy

In run of AddAccountSettings.java, there is a possible background activity launch due to a confused deputy

In multiple locations, there is a possible permission bypass due to a confused deputy

In navigateUpTo of ActivityClientController.java, there is a possible permission bypass due to a logic error in the code

In resolveAidConflictLocked of RegisteredAidCache.java, there is a possible permission bypass due to a confused deputy

In resolveToHeavyWeightSwitcherIfNeeded of ActivityStarter.java, there is a possible background activity launch due to a confused deputy

In moveTaskToFrontLocked of ActivityTaskManagerService.java, there is a possible background application launch (bal) issue due to a confused deputy

In prepareWindowToDisplayDuringRelayout of WindowState.java, there is a possible permission bypass due to a logic error in the code

In multiple locations, there is a possible background activity launch due to a logic error in the code

In handlePackagePostInstall of InstallPackageHelper.java, there is a possible Enhanced Confirmation Mode (ECM) bypass vulnerability that allows a sideloaded application to modify the package source during a self-update due to a logic err…

In onCreate of GrantCredentialsPermissionActivity.java, there is a possible way to trick the user into granting account credentials due to misleading or insufficient UI

In UsbDialogHelper of UsbDialogHelper.java, there is a possible UI confusion due to misleading or insufficient UI

In forwardToPreferredActionPickHandler of ContactsPickerActivity.kt, there is a possible intent redirection due to a confused deputy

In onResult of AccountManagerService.java, there is a possible untrusted/misleading UI issue due to a logic error in the code

In setAccessibilityWindowAttributes of AccessibilityWindowManager.java, there is a possible untrusted/misleading UI issue due to a missing permission check

In multiple functions of SaveUi.java, there is a possible bypass of package installation requirements due to a logic error in the code

In writeGrantedUriPermissions of UriGrantsManagerService.java, there is a possible permission bypass due to improper input validation

In shouldBlockDirectoryFromTree of ExternalStorageProvider.java, there is a possible way to access protected data due to a logic error in the code

In addDragDropListener of WindowManagerService.java, there is a possible permission bypass due to a missing permission check

An unprivileged application can exploit a lack of package/signature validation in SystemUI's `RemoteQCController` when resolving a hardcoded `content://` URI

The vulnerability is a Use-After-Free (UAF) in the EVS AIDL HAL, arising from a data race on an unsynchronized `std::weak_ptr` within `EvsEnumerator::openCamera()`