Google has 2,254 CVEs on record between 2011 and 2026. Disclosure cadence is accelerating: 1835 in the last 90 days against 115 in the 90 before. The busiest recent month was October 2026 with 781. The median CVSS is 7.8 (high), with 240 rated critical. 1% have been exploited in the wild, in line with the corpus average. When CISA adds a Google CVE to KEV it happens fast: a median of 2 days after publication (12 cases). The dominant weakness classes are CWE-416 (457) and CWE-863 (223). Most affected products: Chrome (1648), Android (547), mcp_toolbox_for_databases (7).

CVEs per month

Last 12 months, by publish date

1225/120126/010226/020326/030426/040526/050626/060726/070826/080926/091026/101126/11

Exploited share: 1% vs 1% corpus
Median CVSS: 7.8
Publish → KEV: 2 d median(12)
Last 90 days: 1835 prev 115

Weakness classes

Products

Chrome 1648
Android 547
mcp_toolbox_for_databases 7
Application Integration 5
github.com/google/sam 3
Guava 2

Follow Google:RSS feed Save a search →Embed badge ↗

2254

Total CVEs

240

Critical

CISA KEV

Exploited

Worst active — by depth score

Google vulnerabilities

CVEs affecting Google, newest first. Open any entry for full detail, references, and exploit status.

2254 CVEsRSS

CVEs per month

Weakness classes

Products

Worst active — by depth score

Google vulnerabilities

In sendAnomalyProfile of ProfilingService.java, there is a possible path traversal issue due to path traversal

In insertInternal of MmsProvider.java, there is a possible multiuser isolation issue due to a missing permission check

In multiple functions of NfcService.java, there is a possible permission bypass due to a missing permission check

In checkDestination of SmsUsageMonitor.java, there is a possible permission bypass due to improper input validation

In modpowF4 of avb_rsa.c, there is a possible signature verification bypass due to a logic error in the code

In is_valid_header of timed_cache_item.c, there is a possible out-of-bounds write due to a missing bounds check

In set_type4_frame_classifier of sta_iface.cpp, there is a possible memory safety issue due to a heap buffer overflow

In getMessenger of WifiP2pServiceImpl.java, there is a possible permission bypass due to a missing permission check

In multiple functions of AllowBindAppWidgetActivity.java, there is a possible misunderstanding of reject/consent actions due to misleading or insufficient UI

In nfa_t4tnfcee_store_rx_buf of nfa_nfcee_act.cc, there is a possible way to achieve code execution due to a missing permission check

In multiple functions of MmiUtils.java, there is a possible risk of USSD/MMI code execution due to improper input validation

In onCreate of SettingsApplication.java, there is a possible cross-profile consent dialog label injection due to improper input validation

In multiple locations, there is a possible method for a primary user to disable secure nfc on other full users due to insufficient isolation between Android users

In multiple locations, there is a possible way to trick a user into disclosing Autofill contents due to a tapjacking/overlay attack

In multiple functions of ipphelper.c, there is a possible stack bugger overflow due to a missing bounds check

In getSubscriptionProperty of SubscriptionManagerService.java, there is a possible information disclosure due to a missing permission check

In getTouchOcclusionMode of WindowState.java, there is a possible tapjacking issue due to a tapjacking/overlay attack

In multiple locations, there is a possible persistent denial of service due to improper input validation

In getXmlFileNameForUser of LocaleManagerService.java, there is a possible permission bypass due to a confusable path traversal

In checkWhetherCallingAppHasAccess of DownloadProvider.java, there is a possible information leak due to a confused deputy

In checkNearbyDevicesPermission of WifiP2pServiceImpl.java, there is a possible permission bypass due to a confused deputy

In multiple locations, there is a possible permission bypass due to a confused deputy

In isValid of ShimConverter.cpp, there is a possible out of bounds read due to a missing bounds check

A physical occupant on an Android Automotive OS (AAOS) Multi-User Multi-Display (MUMD) passenger display can view sensitive Heads-Up Notification (HUN) content and execute actions for a secure passenger user (User N) without authenticati…

In parseKnownActivityEmbeddingCerts of ParsingUtils.java, there is a possible permanent denial of service due to improper input validation

In loadDescription of DeviceAdminAdd.java, there is a possible denial of service due to improper input validation

In multiple locations, there is a possible denial of service due to improper input validation

In multiple locations, there is a possible denial of service due to improper input validation

In decode_packed_entry_number of codebook.c, there is a possible out-of-bounds read due to a logic error in the code

In process of C2SoftApvDec.cpp, there is a possible out-of-bounds read due to a logic error in the code