google has 753 CVEs on record between 2021 and 2026. Disclosure cadence is accelerating: 614 in the last 90 days against 97 in the 90 before. The busiest recent month was September 2026 with 501. The median CVSS is 7.5 (high), with 91 rated critical. 1% have been exploited in the wild, in line with the corpus average. When CISA adds a google CVE to KEV it happens fast: a median of 1 day after publication (9 cases). The dominant weakness classes are CWE-416 (91) and CWE-20 (70). Most affected products: chrome (491), android (232), mcp_toolbox_for_databases (7).

CVEs per month

Last 12 months, by publish date

1025/101125/111225/120126/010226/020326/030426/040526/050626/060726/070826/080926/09

Exploited share: 1% vs 1% corpus
Median CVSS: 7.5
Publish → KEV: 1 d median(9)
Last 90 days: 614 prev 97

Weakness classes

Products

chrome 491
android 232
mcp_toolbox_for_databases 7
github.com/google/cel-go 2
github.com/google/exposure-notifications-verification-server 2
github.com/google/go-attestation 2

Follow google:RSS feed Save a search →Embed badge ↗

753

Total CVEs

Critical

CISA KEV

Exploited

Worst active — by depth score

Google vulnerabilities

CVEs affecting Google, newest first. Open any entry for full detail, references, and exploit status.

753 CVEsRSS

CVEs per month

Weakness classes

Products

Worst active — by depth score

Google vulnerabilities

In multiple functions of RemoteViews.java, there is a possible background activity launch bypass due to a logic error in the code

In multiple functions of rw_t3t.cc, there is a possible out of bounds write due to an integer overflow

In multiple functions of RangingServiceImpl.java, there is a possible MITM due to a missing permission check

In setHiddenWhileSuspended of WindowState.java, there is a possible overlay bypass due to a logic error in the code

In startNextMatchingActivity of ActivityTaskManagerService.java, there is a possible permission bypass due to a confused deputy

In executeRequest of ActivityStarter.java, there is a possible background activity launch due to a logic error in the code

In rw_mfc_handle_read_op of rw_mfc.cc, there is a possible out of bounds write due to a logic error in the code

In multiple functions of XmpDataParser.java, there is a possible improper data sanitization due to a logic error in the code

In setupLayout of PickActivity.java, there is a possible bypass of the "Install unknown apps" security restriction due to a confused deputy

In handleUssdRequest of PhoneInterfaceManager.java, there is a possible way to send a USSD request without permission due to a logic error in the code

In initForUserNoTracing of VoiceInteractionManagerService.java, there is a possible persistent denial of service due to resource exhaustion

In buildMiniResolver of IntentForwarderActivity.java, there is a possible consent bypass due to a tapjacking/overlay attack

In onCreate of ContactsPickerActivity.kt, there is a possible misleading UI due to a tapjacking/overlay attack

In btm_sec_encrypt_change of btm_sec.cc, there is a possible downgrade attack due to a logic error in the code

In onCreate of SetupPassthroughActivity.java, there is a possible way to launch arbitrary activity due to Intent redirection

In multiple locations, there is a possible read/write access to files without the proper permissions due to a confused deputy

In writeToParcel of BleRssiRangingCapabilities.java, there is a possible way to obtain the Bluetooth MAC address due to a missing permission check

In getQueryBuilderInternal of MediaProvider.java, there is a possible way to retrieve location metadata due to a permissions bypass

In multiple locations, there is a possible unauthorized URI access due to a permissions bypass

In dec_frm_prepare of oapv.c, there is a possible OOB write due to a heap buffer overflow

In add of WifiNetworkSuggestionsManager.java, there is a possible persistent DOS due to resource exhaustion

In Setup Wizard, there is a possible way to force connection to a malicious network due to confused deputy

In stpropnci_process_std of stpropnci_std.cc, there is a possible memory safety issue due to a missing bounds check

In multiple locations, there is a possible memory safety issue due to integer overflow

In setTo of ResourceTypes.cpp, there is a possible out-of-bounds heap read due to a missing bounds check

In openLogicalChannel of multiple files, there is a possible out-of-bounds write due to a missing bounds check

In checkUiccListenConfigNeeded of RoutingManager.cpp, there is a possible out of bounds write due to a missing bounds check

In parsePartHeaders of multiple files, there is a possible persistent denial of service due to improper input validation

In parseParts of PduParser.java, there is a possible out of bounds read due to a heap buffer overflow

In multiple locations, there is a possible out of bounds write due to an integer overflow