Google has 2,255 CVEs on record between 2011 and 2026. Disclosure cadence is accelerating: 1836 in the last 90 days against 114 in the 90 before. The busiest recent month was October 2026 with 781. The median CVSS is 7.8 (high), with 240 rated critical. 1% have been exploited in the wild, in line with the corpus average. When CISA adds a Google CVE to KEV it happens fast: a median of 2 days after publication (12 cases). The dominant weakness classes are CWE-416 (457) and CWE-863 (223). Most affected products: Chrome (1648), Android (547), mcp_toolbox_for_databases (7).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 1% vs 1% corpus
- Median CVSS
- 7.8
- Publish → KEV
- 2 d median(12)
- Last 90 days
- 1836 prev 114
Weakness classes
Products
- Chrome 1648
- Android 547
- mcp_toolbox_for_databases 7
- Application Integration 5
- github.com/google/sam 3
- Guava 2
Worst active — by depth score
CVE-2022-2294High· 8.8Heap buffer overflow in WebRTC in Google Chrome prior to 103.0.5060.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.93CVE-2026-111497Critical· 9.2Out-of-Bounds Write in Google Brotli Decoder92CVE-2026-2441High· 8.8Use after free in CSS in Google Chrome prior to 145.0.7632.75 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page84CVE-2025-14174High· 8.8Out of bounds memory access in ANGLE in Google Chrome on Mac prior to 143.0.7499.110 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page84CVE-2025-10585Critical· 9.8Type confusion in V8 in Google Chrome prior to 140.0.7339.185 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page81
Google vulnerabilities
CVEs affecting Google, newest first. Open any entry for full detail, references, and exploit status.
2255 CVEsRSS
CVE-2025-20781High· 7.8In display, there is a possible memory corruption due to use after free
In display, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Pa…
CVE-2025-20780High· 7.8In display, there is a possible memory corruption due to use after free
In display, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Pa…
CVE-2025-20779High· 7.0In display, there is a possible use after free due to a race condition
In display, there is a possible use after free due to a race condition. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Pat…
CVE-2025-20778High· 7.8In display, there is a possible out of bounds write due to a missing bounds check
In display, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploi…
CVE-2025-14766High· 8.8Out of bounds read and write in V8 in Google Chrome prior to 143.0.7499.147 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page
Out of bounds read and write in V8 in Google Chrome prior to 143.0.7499.147 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVE-2025-14765High· 8.8PoCUse after free in WebGPU in Google Chrome prior to 143.0.7499.147 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page
Use after free in WebGPU in Google Chrome prior to 143.0.7499.147 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVE-2025-14373Medium· 4.3Inappropriate implementation in Toolbar in Google Chrome on Android prior to 143.0.7499.110 allowed a remote attacker to perform domain spoofing via a crafted HTML page
Inappropriate implementation in Toolbar in Google Chrome on Android prior to 143.0.7499.110 allowed a remote attacker to perform domain spoofing via a crafted HTML page. (Chromium security severity: Medium)
CVE-2025-14372Medium· 6.1Use after free in Password Manager in Google Chrome prior to 143.0.7499.110 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page
Use after free in Password Manager in Google Chrome prior to 143.0.7499.110 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)
CVE-2025-14174High· 8.8CISA KEV0dayPoCOut of bounds memory access in ANGLE in Google Chrome on Mac prior to 143.0.7499.110 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page
Out of bounds memory access in ANGLE in Google Chrome on Mac prior to 143.0.7499.110 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)
CVE-2025-36938Medium· 6.8In U-Boot of append_uint32_le(), there is a possible fault injection due to a logic error in the code
In U-Boot of append_uint32_le(), there is a possible fault injection due to a logic error in the code. This could lead to physical escalation of privilege with no additional execution privileges needed. User interaction is not needed for…
CVE-2025-36937Critical· 9.8In AudioDecoder::HandleProduceRequest of audio_decoder.cc, there is a possible out of bounds write due to an incorrect bounds check
In AudioDecoder::HandleProduceRequest of audio_decoder.cc, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote code execution with no additional execution privileges needed. User interactio…
CVE-2025-36936High· 7.8In GetTachyonCommand of tachyon_server_common.h, there is a possible out of bounds write due to an integer overflow
In GetTachyonCommand of tachyon_server_common.h, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not…
CVE-2025-36935High· 7.8In trusty_ffa_mem_reclaim of shared-mem-smcall.c, there is a possible memory corruption due to uninitialized data
In trusty_ffa_mem_reclaim of shared-mem-smcall.c, there is a possible memory corruption due to uninitialized data. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not n…
CVE-2025-36934High· 7.4In bigo_worker_thread of private/google-modules/video/gchips/bigo.c, there is a possible use after free due to a race condition
In bigo_worker_thread of private/google-modules/video/gchips/bigo.c, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User intera…
CVE-2025-36932High· 7.8In tracepoint_msg_handler of cpm/google/lib/tracepoint/tracepoint_ipc.c, there is a possible memory overwrite due to improper input validation
In tracepoint_msg_handler of cpm/google/lib/tracepoint/tracepoint_ipc.c, there is a possible memory overwrite due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges need…
CVE-2025-36931High· 7.8In GetHostAddress of gxp_buffer.h, there is a possible out of bounds write due to a missing bounds check
In GetHostAddress of gxp_buffer.h, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for…
CVE-2025-36930High· 7.8In GetHostAddress of gxp_buffer.h, there is a possible out of bounds write due to a missing bounds check
In GetHostAddress of gxp_buffer.h, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for…
CVE-2025-36929Medium· 5.5In AreFencesRegistered of gxp_fence_manager.cc, there is a possible information leak due to improper input validation
In AreFencesRegistered of gxp_fence_manager.cc, there is a possible information leak due to improper input validation. This could lead to local information disclosure with no additional execution privileges needed. User interaction is no…
CVE-2025-36928High· 7.8In GetHostAddress of gxp_buffer.h, there is a possible out of bounds write due to an incorrect bounds check
In GetHostAddress of gxp_buffer.h, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed …
CVE-2025-36927High· 7.8In GetTachyonCommand of tachyon_server_common.h, there is a possible out of bounds write due to a missing bounds check
In GetTachyonCommand of tachyon_server_common.h, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is …
CVE-2025-36925High· 7.8In WAVES_send_data_to_dsp of libaoc_waves.c, there is a possible out of bounds write due to a missing bounds check
In WAVES_send_data_to_dsp of libaoc_waves.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not …
CVE-2025-36924High· 8.0In ss_DecodeLcsAssistDataReqMsg(void) of ss_LcsManagement.c, there is a possible out of bounds write due to an incorrect bounds check
In ss_DecodeLcsAssistDataReqMsg(void) of ss_LcsManagement.c, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote (proximal/adjacent) escalation of privilege with no additional execution pri…
CVE-2025-36923High· 8.0In NrmmDecoder::DecodeSORTransparentContext of cn_NrmmDecoder.cpp, there is a possible out of bounds write due to a heap buffer overflow
In NrmmDecoder::DecodeSORTransparentContext of cn_NrmmDecoder.cpp, there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote (proximal/adjacent) escalation of privilege with no additional execution …
CVE-2025-36922Medium· 6.7In bigo_map of bigo_iommu.c, there is a possible information disclosure due to a use after free
In bigo_map of bigo_iommu.c, there is a possible information disclosure due to a use after free. This could lead to local escalation of privilege in the OS Kernel level with System execution privileges needed. User interaction is not ne…
CVE-2025-36921Medium· 5.5In ProtocolPsUnthrottleApn() of protocolpsadapter.cpp, there is a possible out of bounds read due to a missing bounds check
In ProtocolPsUnthrottleApn() of protocolpsadapter.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with baseband firmware compromise required. User interaction is …
CVE-2025-36919High· 7.8In aocc_read of aoc_channel_dev.c, there is a possible double free due to improper locking
In aocc_read of aoc_channel_dev.c, there is a possible double free due to improper locking. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2025-36918High· 7.8In aoc_service_read_message of aoc_ipc_core.c, there is a possible out of bounds read due to improper input validation
In aoc_service_read_message of aoc_ipc_core.c, there is a possible out of bounds read due to improper input validation. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not nee…
CVE-2025-36917Medium· 6.5In SwDcpItg of up_L2commonPdcpSecurity.cpp, there is a possible denial of service due to an incorrect bounds check
In SwDcpItg of up_L2commonPdcpSecurity.cpp, there is a possible denial of service due to an incorrect bounds check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not neede…
CVE-2025-36916High· 7.0In PrepareWorkloadBuffers of gxp_main_actor.cc, there is a possible double fetch due to a race condition
In PrepareWorkloadBuffers of gxp_main_actor.cc, there is a possible double fetch due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for…
CVE-2025-36912Medium· 6.5In cellular modem, there is a possible denial of service due to a logic error in the code
In cellular modem, there is a possible denial of service due to a logic error in the code. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.