Google has 2,255 CVEs on record between 2011 and 2026. Disclosure cadence is accelerating: 1836 in the last 90 days against 114 in the 90 before. The busiest recent month was October 2026 with 781. The median CVSS is 7.8 (high), with 241 rated critical. 1% have been exploited in the wild, in line with the corpus average. When CISA adds a Google CVE to KEV it happens fast: a median of 2 days after publication (12 cases). The dominant weakness classes are CWE-416 (457) and CWE-863 (223). Most affected products: Chrome (1648), Android (547), mcp_toolbox_for_databases (7).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 1% vs 1% corpus
- Median CVSS
- 7.8
- Publish → KEV
- 2 d median(12)
- Last 90 days
- 1836 prev 114
Weakness classes
Products
- Chrome 1648
- Android 547
- mcp_toolbox_for_databases 7
- Application Integration 5
- github.com/google/sam 3
- Guava 2
Worst active — by depth score
CVE-2022-2294High· 8.8Heap buffer overflow in WebRTC in Google Chrome prior to 103.0.5060.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.93CVE-2026-111497Critical· 9.2Out-of-Bounds Write in Google Brotli Decoder92CVE-2026-2441High· 8.8Use after free in CSS in Google Chrome prior to 145.0.7632.75 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page84CVE-2025-14174High· 8.8Out of bounds memory access in ANGLE in Google Chrome on Mac prior to 143.0.7499.110 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page84CVE-2025-10585Critical· 9.8Type confusion in V8 in Google Chrome prior to 140.0.7339.185 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page81
Google vulnerabilities
CVEs affecting Google, newest first. Open any entry for full detail, references, and exploit status.
2255 CVEsRSS
CVE-2025-48560Medium· 5.5In AndroidManifest.xml, there is a possible way for an app to monitor motion events due to a confused deputy
In AndroidManifest.xml, there is a possible way for an app to monitor motion events due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed …
CVE-2025-48559Medium· 5.5In multiple functions of AppOpsService.java, there is a possible add a large amount of app ops due to improper input validation
In multiple functions of AppOpsService.java, there is a possible add a large amount of app ops due to improper input validation. This could lead to local denial of service with no additional execution privileges needed. User interaction …
CVE-2025-48549High· 7.8In multiple locations, there is a possible way to record audio via a background app due to a missing permission check
In multiple locations, there is a possible way to record audio via a background app due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is n…
CVE-2025-48544High· 7.8In multiple locations, there is a possible way to read files belonging to other apps due to SQL injection
In multiple locations, there is a possible way to read files belonging to other apps due to SQL injection. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed fo…
CVE-2025-48541High· 7.8In onCreate of FaceSettings.java, there is a possible way to remove biometric unlock across user profiles due to improper input validation
In onCreate of FaceSettings.java, there is a possible way to remove biometric unlock across user profiles due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. …
CVE-2025-48533High· 7.0In multiple locations, there is a possible way to use apps linked from a context menu of a lockscreen app due to a race condition
In multiple locations, there is a possible way to use apps linked from a context menu of a lockscreen app due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User inte…
CVE-2025-48529Medium· 5.5In setRingtoneUri of VoicemailNotificationSettingsUtil.java , there is a possible cross user data leak due to a confused deputy
In setRingtoneUri of VoicemailNotificationSettingsUtil.java , there is a possible cross user data leak due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interac…
CVE-2025-32331High· 7.8In showDismissibleKeyguard of KeyguardService.java, there is a possible way to bypass app pinning due to a logic error in the code
In showDismissibleKeyguard of KeyguardService.java, there is a possible way to bypass app pinning due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User int…
CVE-2025-26444High· 7.8In onHandleForceStop of VoiceInteractionManagerService.java, there is a bug that could cause the system to incorrectly revert to the default assistant application when a user-selected assistant is forcibly stopped due to a logic error in…
In onHandleForceStop of VoiceInteractionManagerService.java, there is a bug that could cause the system to incorrectly revert to the default assistant application when a user-selected assistant is forcibly stopped due to a logic error in…
CVE-2025-26423Medium· 6.2In validateIpConfiguration of WifiConfigurationUtil.java, there is a possible way to trigger a permanent DoS due to a missing bounds check
In validateIpConfiguration of WifiConfigurationUtil.java, there is a possible way to trigger a permanent DoS due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. …
CVE-2025-9866High· 8.8Inappropriate implementation in Extensions in Google Chrome prior to 140.0.7339.80 allowed a remote attacker to bypass content security policy via a crafted HTML page
Inappropriate implementation in Extensions in Google Chrome prior to 140.0.7339.80 allowed a remote attacker to bypass content security policy via a crafted HTML page. (Chromium security severity: Medium)
CVE-2025-22442High· 7.0PoCIn multiple functions of DevicePolicyManagerService.java, there is a possible way to install unauthorized applications into a newly created work profile due to a race condition
In multiple functions of DevicePolicyManagerService.java, there is a possible way to install unauthorized applications into a newly created work profile due to a race condition. This could lead to local escalation of privilege with no ad…
CVE-2025-22438High· 7.8In afterKeyEventLockedInterruptable of InputDispatcher.cpp, there is a possible use after free
In afterKeyEventLockedInterruptable of InputDispatcher.cpp, there is a possible use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitat…
CVE-2025-22437High· 7.8In setMediaButtonReceiver of multiple files, there is a possible way to launch arbitrary activities from background due to a logic error in the code
In setMediaButtonReceiver of multiple files, there is a possible way to launch arbitrary activities from background due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privilege…
CVE-2025-6558High· 8.8CISA KEVPoCInsufficient validation of untrusted input in ANGLE and GPU in Google Chrome prior to 138.0.7204.157 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page
Insufficient validation of untrusted input in ANGLE and GPU in Google Chrome prior to 138.0.7204.157 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
CVE-2024-50302Medium· 5.5CISA KEVPoCIn the Linux kernel, the following vulnerability has been resolved: HID: core: zero-initialize the report buffer Since the report buffer is used by all kinds of drivers in various ways, let's zero-initialize it during allocation to mak…
In the Linux kernel, the following vulnerability has been resolved: HID: core: zero-initialize the report buffer Since the report buffer is used by all kinds of drivers in various ways, let's zero-initialize it during allocation to mak…
CVE-2024-9121High· 8.8Inappropriate implementation in V8 in Google Chrome prior to 129.0.6668.70 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page
Inappropriate implementation in V8 in Google Chrome prior to 129.0.6668.70 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)
CVE-2023-3079High· 8.8CISA KEVPoCType confusion in V8 in Google Chrome prior to 114.0.5735.110 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page
Type confusion in V8 in Google Chrome prior to 114.0.5735.110 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVE-2022-20572Medium· 6.7In verity_target of dm-verity-target.c, there is a possible way to modify read-only files due to a missing permission check
In verity_target of dm-verity-target.c, there is a possible way to modify read-only files due to a missing permission check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is no…
CVE-2022-20566High· 7.8In l2cap_chan_put of l2cap_core, there is a possible use after free due to improper locking
In l2cap_chan_put of l2cap_core, there is a possible use after free due to improper locking. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation…
CVE-2022-20422High· 7.0In emulation_proc_handler of armv8_deprecated.c, there is a possible way to corrupt memory due to a race condition
In emulation_proc_handler of armv8_deprecated.c, there is a possible way to corrupt memory due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not …
CVE-2022-20421High· 7.8PoCIn binder_inc_ref_for_node of binder.c, there is a possible way to corrupt memory due to a use after free
In binder_inc_ref_for_node of binder.c, there is a possible way to corrupt memory due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed fo…
CVE-2022-2294High· 8.8CISA KEV0dayHeap buffer overflow in WebRTC in Google Chrome prior to 103.0.5060.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Heap buffer overflow in WebRTC in Google Chrome prior to 103.0.5060.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVE-2022-20153Medium· 6.7In rcu_cblist_dequeue of rcu_segcblist.c, there is a possible use-after-free due to improper locking
In rcu_cblist_dequeue of rcu_segcblist.c, there is a possible use-after-free due to improper locking. This could lead to local escalation of privilege in the kernel with System execution privileges needed. User interaction is not needed …
CVE-2022-20154Medium· 6.4In lock_sock_nested of sock.c, there is a possible use after free due to a race condition
In lock_sock_nested of sock.c, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product:…
CVE-2015-5237High· 8.8protobuf susceptible to buffer overflow
protobuf susceptible to buffer overflow
CVE-2020-8918High· 7.1TPM 1.2 key authorization values vulnerable to TPM transport eavesdropper in go-tpm
TPM 1.2 key authorization values vulnerable to TPM transport eavesdropper in go-tpm
CVE-2021-22565Medium· 6.5Insufficient Granularity of Access Control in github.com/google/exposure-notifications-verification-server
Insufficient Granularity of Access Control in github.com/google/exposure-notifications-verification-server
CVE-2021-22538High· 8.8Privilege escalation in rbac
Privilege escalation in rbac
CVE-2020-8908Low· 3.3Temp directory permission issue in Guava
A temp directory creation vulnerability exists in all versions of Guava, allowing an attacker with access to the machine to potentially access data in a temporary directory created by the Guava API com.google.common.io.Files.createTempDi…