Google vulnerabilities

CVEs per yearBy the year they were published

1. 20194
2. 20202
3. 202013
4. 20201
5. 2023394
6. 2023334
7. 2024613
8. 2024291
9. 2024234
10. 2025633
11. 20264,436
12. 2026521

Known exploitedNewest addition to KEV first

• CVE-2026-111497

  Out-of-Bounds Write in Google Brotli Decoder

  Google · Brotli

  ExploitedCritical9.2
• CVE-2026-58704

  In Cellular Modem, there is a possible permission bypass due to a logic error in the code. This could lead to remote (proximal/adjacent) escalation of…

  Google · Android

  ExploitedHigh8.8
• CVE-2026-87491

  Out of bounds write in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML…

  Google · Chrome

  ExploitedHigh8.8
• CVE-2026-85046

  Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.…

  Google · Chrome

  ExploitedHigh8.8
• CVE-2026-11645

  Out of bounds read and write in V8 in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted…

  Google · Chrome

  ExploitedHigh8.8
• CVE-2025-48595

  In multiple locations, there is a possible way to achieve code execution due to an integer overflow. This could lead to local escalation of privilege with no…

  Google · Android

  ExploitedHigh8.4
• CVE-2026-5281

  Use after free in Dawn in Google Chrome prior to 146.0.7680.178 allowed a remote attacker who had compromised the renderer process to execute arbitrary code…

  Google · Chrome

  ExploitedHigh8.8
• CVE-2026-3910

  Inappropriate implementation in V8 in Google Chrome prior to 146.0.7680.75 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted…

  Google · Chrome

  ExploitedHigh8.8
• CVE-2026-3909

  Out of bounds write in Skia in Google Chrome prior to 146.0.7680.75 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page.…

  Google · Chrome

  ExploitedHigh8.8
• CVE-2026-2441

  Use after free in CSS in Google Chrome prior to 145.0.7632.75 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.…

  Google · Chrome

  ExploitedHigh8.8

Newest CVEs

• CVE-2026-120930

  Incorrect authorization in Blink in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page.…

  Google · Chrome

  Not scored
• CVE-2026-120931

  Out of bounds write in WebGL in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outside the sandbox via…

  Google · Chrome

  Critical9.6
• CVE-2026-121141

  Improper input validation in Editing in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass web origin…

  Google · Chrome

  Not scored
• CVE-2026-121195

  Incorrect authorization in TrustedTypes in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page.…

  Google · Chrome

  Not scored
• CVE-2026-121064

  Improper input validation in Performance in Google Chrome prior to 157.0.8103.38 allowed a local attacker to potentially execute arbitrary code inside the…

  Google · Chrome

  Not scored
• CVE-2026-121169

  Missing authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass web origin policy…

  Google · Chrome

  Not scored
• CVE-2026-121069

  Use after free in Track in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.…

  Google · Chrome

  High8.8
• CVE-2026-121142

  Incorrect authorization in Network in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass web origin policy…

  Google · Chrome

  Not scored
• CVE-2026-121232

  Incorrect authorization in Core in Google Chrome prior to 157.0.8103.38 allowed a local attacker leveraging social engineering to obtain sensitive information…

  Google · Chrome

  Not scored
• CVE-2026-121041

  Missing authorization in Input in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a crafted HTML page.…

  Google · Chrome

  Not scored