Google known exploited vulnerabilities
Every Google CVE on CISA's Known Exploited Vulnerabilities catalog, newest addition first: 76 in all, 11 added in the last 12 months.
- CVE-2022-1096Type confusion in V8 in Google Chrome prior to 99.0.4844.84 allowed a remote attacker to potentially exploit heap corruption via a crafted HGoogle Chrome
- CVE-2022-0609Use after free in Animation in Google Chrome prior to 98.0.4758.102 allowed a remote attacker to potentially exploit heap corruption via a cGoogle Chrome · CefSharp.Common +8
- CVE-2020-6572Use after free in Media in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to execute arbitrary code via a crafted HTML page.Google Chrome
- CVE-2021-4102Use after free in V8 in Google Chrome prior to 96.0.4664.110 allowed a remote attacker to potentially exploit heap corruption via a crafted Google Chrome
- CVE-2021-38003Inappropriate implementation in V8 in Google Chrome prior to 95.0.4638.69 allowed a remote attacker to potentially exploit heap corruption vGoogle Chrome
- CVE-2021-38000Insufficient validation of untrusted input in Intents in Google Chrome on Android prior to 95.0.4638.69 allowed a remote attacker to arbitraGoogle Chrome
- CVE-2021-37976Inappropriate implementation in Memory in Google Chrome prior to 94.0.4606.71 allowed a remote attacker to obtain potentially sensitive infoGoogle Chrome
- CVE-2021-37975Use after free in V8 in Google Chrome prior to 94.0.4606.71 allowed a remote attacker to potentially exploit heap corruption via a crafted HGoogle Chrome
- CVE-2021-37973Use after free in Portals in Google Chrome prior to 94.0.4606.61 allowed a remote attacker who had compromised the renderer process to potenGoogle Chrome
- CVE-2021-30633Use after free in Indexed DB API in Google Chrome prior to 93.0.4577.82 allowed a remote attacker who had compromised the renderer process tGoogle Chrome
- CVE-2021-30632Out of bounds write in V8 in Google Chrome prior to 93.0.4577.82 allowed a remote attacker to potentially exploit heap corruption via a crafGoogle Chrome
- CVE-2021-30563Type Confusion in V8 in Google Chrome prior to 91.0.4472.164 allowed a remote attacker to potentially exploit heap corruption via a crafted Google Chrome
- CVE-2021-30554Use after free in WebGL in Google Chrome prior to 91.0.4472.114 allowed a remote attacker to potentially exploit heap corruption via a craftGoogle Chrome
- CVE-2021-30551Type confusion in V8 in Google Chrome prior to 91.0.4472.101 allowed a remote attacker to potentially exploit heap corruption via a crafted Google Chrome
- CVE-2021-21224Type confusion in V8 in Google Chrome prior to 90.0.4430.85 allowed a remote attacker to execute arbitrary code inside a sandbox via a craftGoogle Chrome
- CVE-2021-21220Insufficient validation of untrusted input in V8 in Google Chrome prior to 89.0.4389.128 allowed a remote attacker to potentially exploit heGoogle Chrome
- CVE-2021-21206Use after free in Blink in Google Chrome prior to 89.0.4389.128 allowed a remote attacker to potentially exploit heap corruption via a craftGoogle Chrome
- CVE-2021-21193Use after free in Blink in Google Chrome prior to 89.0.4389.90 allowed a remote attacker to potentially exploit heap corruption via a crafteGoogle Chrome
- CVE-2021-21166Data race in audio in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to potentially exploit heap corruption via a crafted HTMGoogle Chrome
- CVE-2021-21148Heap buffer overflow in V8 in Google Chrome prior to 88.0.4324.150 allowed a remote attacker to potentially exploit heap corruption via a crGoogle Chrome
- CVE-2020-6418Type confusion in V8 in Google Chrome prior to 80.0.3987.122 allowed a remote attacker to potentially exploit heap corruption via a crafted Google Chrome
- CVE-2020-16017Use after free in site isolation in Google Chrome prior to 86.0.4240.198 allowed a remote attacker who had compromised the renderer process Google Chrome · CefSharp.Common +3
- CVE-2020-16013Inappropriate implementation in V8 in Google Chrome prior to 86.0.4240.198 allowed a remote attacker to potentially exploit heap corruption Google Chrome · CefSharp.Common +3
- CVE-2020-16010Heap buffer overflow in UI in Google Chrome on Android prior to 86.0.4240.185 allowed a remote attacker who had compromised the renderer proGoogle Chrome
- CVE-2020-16009Inappropriate implementation in V8 in Google Chrome prior to 86.0.4240.183 allowed a remote attacker to potentially exploit heap corruption Google Chrome · CefSharp.Common +3
- CVE-2020-15999Heap buffer overflow in Freetype in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploit heap corruption viGoogle Chrome · CefSharp.Common +3
FAQ
Google KEV questions.
How many Google vulnerabilities are in CISA KEV?
76 Google vulnerabilities are on CISA's Known Exploited Vulnerabilities catalog, 11 of them added in the last 12 months. The newest is CVE-2026-111497 (Google Brotli Unchecked Return Value Vulnerability), added 2026-10-27.
Which Google products are in CISA KEV?
26 products, including Brotli, Pixel, Chromium V8. Attackers have exploited every one of these entries in the wild, and US federal agencies must patch each by its CISA due date.
Are Google KEV vulnerabilities used by ransomware?
CISA has no known ransomware use on record for Google's KEV entries.