Google has 2,254 CVEs on record between 2011 and 2026. Disclosure cadence is accelerating: 1835 in the last 90 days against 115 in the 90 before. The busiest recent month was October 2026 with 781. The median CVSS is 7.8 (high), with 240 rated critical. 1% have been exploited in the wild, in line with the corpus average. When CISA adds a Google CVE to KEV it happens fast: a median of 2 days after publication (12 cases). The dominant weakness classes are CWE-416 (457) and CWE-863 (223). Most affected products: Chrome (1648), Android (547), mcp_toolbox_for_databases (7).

CVEs per month

Last 12 months, by publish date

1225/120126/010226/020326/030426/040526/050626/060726/070826/080926/091026/101126/11

Exploited share: 1% vs 1% corpus
Median CVSS: 7.8
Publish → KEV: 2 d median(12)
Last 90 days: 1835 prev 115

Weakness classes

Products

Chrome 1648
Android 547
mcp_toolbox_for_databases 7
Application Integration 5
github.com/google/sam 3
Guava 2

Follow Google:RSS feed Save a search →Embed badge ↗

2254

Total CVEs

240

Critical

CISA KEV

Exploited

Worst active — by depth score

Google vulnerabilities

CVEs affecting Google, newest first. Open any entry for full detail, references, and exploit status.

2254 CVEsRSS

CVE-2026-121197None

3d ago

Out of bounds read in ANGLE in Google Chrome on on Mac prior to 157.0.8103.38 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page

Out of bounds read in ANGLE in Google Chrome on on Mac prior to 157.0.8103.38 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)

▾ SunlitGoogle · ChromeEPSS 0.18%via CVEORG

CVE-2026-121062None

3d ago

Incorrect authorization in API in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page

Incorrect authorization in API in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)

▾ SunlitGoogle · ChromeEPSS 0.19%via CVEORG

CVE-2026-121051None

3d ago

UI misrepresentation in iOSWeb in Google Chrome on on iOS prior to 157.0.8103.38 allowed a remote attacker to spoof address bar via a crafted HTML page

UI misrepresentation in iOSWeb in Google Chrome on on iOS prior to 157.0.8103.38 allowed a remote attacker to spoof address bar via a crafted HTML page. (Chromium security severity: High)

▾ SunlitGoogle · ChromeEPSS 0.18%via CVEORG

CVE-2026-121032None

3d ago

Out of bounds read in Skia in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page

Out of bounds read in Skia in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)

▾ SunlitGoogle · ChromeEPSS 0.22%via CVEORG

CVE-2026-121095None

3d ago

Uninitialized resource in WebGL in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page

Uninitialized resource in WebGL in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)

CVEs per month

Weakness classes

Products

Worst active — by depth score

Google vulnerabilities

Out of bounds read in ANGLE in Google Chrome on on Mac prior to 157.0.8103.38 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page

Incorrect authorization in API in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page

UI misrepresentation in iOSWeb in Google Chrome on on iOS prior to 157.0.8103.38 allowed a remote attacker to spoof address bar via a crafted HTML page

Out of bounds read in Skia in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page

Uninitialized resource in WebGL in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page

In onOutputReceived of FrameDecoder.cpp, there is a possible out-of-bounds write due to a heap buffer overflow

In decrypt of CryptoHalHidl.cpp, there is a possible use-after-free due to a race condition

In updateInputWindows of InputMonitor.java, there is a possible tapjacking issue due to a logic error in the code

In multiple functions of Helpers.java, there is a possible information disclosure due to improper input validation

In parseContentType of PduParser.java, there is a possible denial of service due to an integer overflow

In rw_ci_data_cback of rw_ci.cc, there is a possible memory safety issue due to integer underflow

In multiple locations, there is a possible way to share files across profiles due to a logic error in the code

In multiple functions of MediaCarouselController.kt, there is a possible way for media to show up after disablement due to a logic error in the code

In parseMetaData of StagefrightMetadataRetriever.cpp, there is a possible denial of service due to a stack buffer overflow

In moveTaskToFrontLocked of ActivityTaskManagerService.java, there is a possible background activity launch due to a logic error in the code

In multiple locations, there is a possible way to trick a user into accepting a permission due to a tapjacking/overlay attack

In oapvd_vlc_metadata of oapv_vlc.c, there is a possible memory corruption due to a double free

In multiple locations, there is a possible memory safety issue due to a use-after-free

In png_set_tRNS of pngset.c, there is a possible memory corruption due to a use-after-free

In multiple locations, there is a possible out-of-bounds write due to an integer overflow

In multiple locations, there is a possible permission bypass due to an uncaught exception

In multiple locations, there is a possible permission bypass due to a missing permission check

In multiple functions of hppsfilter.c, there is a possible out-of-bounds write due to a stack buffer overflow

In notifyPictureProfileHandleSelection of MediaQualityService.java, there is a possible permission bypass due to a missing permission check

In descramble of multiple files, there is a possible out-of-bounds write due to improper casting

In getEntryFileName of ZipFileRO.cpp, there is a possible memory safety issue due to a heap buffer overflow

In setOemUnlockAllowedByUser of OemLockService.java, there is a possible way to bypass FRP due to a missing permission check

In multiple locations, there is a possible out-of-bounds write due to a missing bounds check

In canPresent of PresentationController.java, there is a possible permission bypass due to a logic error in the code

In moveTaskToFrontLocked of ActivityTaskManagerService.java, there is a possible permission bypass due to a missing permission check