Google has 2,255 CVEs on record between 2011 and 2026. Disclosure cadence is accelerating: 1836 in the last 90 days against 114 in the 90 before. The busiest recent month was October 2026 with 781. The median CVSS is 7.8 (high), with 240 rated critical. 1% have been exploited in the wild, in line with the corpus average. When CISA adds a Google CVE to KEV it happens fast: a median of 2 days after publication (12 cases). The dominant weakness classes are CWE-416 (457) and CWE-863 (223). Most affected products: Chrome (1648), Android (547), mcp_toolbox_for_databases (7).

CVEs per month

Last 12 months, by publish date

1225/120126/010226/020326/030426/040526/050626/060726/070826/080926/091026/101126/11

Exploited share: 1% vs 1% corpus
Median CVSS: 7.8
Publish → KEV: 2 d median(12)
Last 90 days: 1836 prev 114

Weakness classes

Products

Chrome 1648
Android 547
mcp_toolbox_for_databases 7
Application Integration 5
github.com/google/sam 3
Guava 2

Follow Google:RSS feed Save a search →Embed badge ↗

2255

Total CVEs

240

Critical

CISA KEV

Exploited

Worst active — by depth score

Google vulnerabilities

CVEs affecting Google, newest first. Open any entry for full detail, references, and exploit status.

2255 CVEsRSS

CVEs per month

Weakness classes

Products

Worst active — by depth score

Google vulnerabilities

In onCreateTasks of CameraActivity.java, there is a possible permission bypass due to a confused deputy

A vulnerability exists in the SecOps SOAR server

In multiple locations of UsbDataAdvancedProtectionHook.java, there is a possible way to access USB data when the screen is off due to a race condition

In isValidMediaUri of SettingsProvider.java, there is a possible cross user media read due to a missing permission check

In preparePackage of InstallPackageHelper.java, there is a possible way for an app to appear hidden upon installation without a mechanism to uninstall it due to a logic error in the code

In DefaultTransitionHandler.java, there is a possible way to unknowingly grant permissions to an app due to a tapjacking/overlay attack

In __pkvm_load_tracing of trace.c, there is a possible out-of-bounds write due to improper input validation

In multiple locations, there is a possible permanent denial of service due to resource exhaustion

In multiple functions of mem_protect.c, there is a possible out of bounds write due to an integer overflow

In hasAccountsOnAnyUser of DevicePolicyManagerService.java, there is a possible way to add a Device Owner after provisioning due to a logic error in the code

In setDisplayName of AssociationRequest.java, there is a possible way to cause CDM associations to persist after the user has disassociated them due to improper input validation

In onHeaderDecoded of LocalImageResolver.java, there is a possible persistent denial of service due to resource exhaustion

In findAvailRecognizer of VoiceInteractionManagerService.java, there is a possible way to become the default speech recognizer app due to an insecure default value

In validateIconUserBoundary of PrintManagerService.java, there is a possible cross-user image leak due to a confused deputy

In startNextMatchingActivity of ActivityTaskManagerService.java, there is a possible way to launch an activity from the background due to a logic error in the code

In multiple locations, there is a possible way to launch an application from the background due to a precondition check failure

In multiple functions of arm-smmu-v3.c, there is a possible out-of-bounds write due to improper input validation

In init_pkvm_hyp_vcpu of pkvm.c, there is a possible out of bounds write due to improper input validation

In ProcessArea of dng_misc_opcodes.cpp, there is a possible out of bounds read due to a buffer overflow

In DefaultTransitionHandler.java, there is a possible way to enable a tapjacking attack due to a insecure default

In onSomePackagesChanged of VoiceInteractionManagerService.java, there is a possible way for a third party application's component name to persist even after uninstalling due to a logic error in the code

In processLaunchBrowser of CommandParamsFactory.java, there is a possible browser interaction from the lockscreen due to improper locking

In getComponentName of MediaButtonReceiverHolder.java, there is a possible desync in persistence due to resource exhaustion

In rebootWipeUserData of RecoverySystem.java, there is a possible way to factory reset the device while in DSU mode due to a missing permission check

In setDefaultKey of DefaultPaymentSettings.java, there is a possible way for an application to set the main user's default NFC payment setting due to improper input validation

In __pkvm_guest_relinquish_to_host of mem_protect.c, there is a possible configuration data leak due to a logic error in the code

In multiple locations, there is a possible way to create a large amount of app ops due to a logic error in the code

In multiple locations, there is a possible way to read files from another user due to a missing permission check

In InputMethodInfo of InputMethodInfo.java, there is a possible permanent denial of service due to resource exhaustion

In multiple locations, there is a possible permanent denial of service due to improper input validation