Google CVEs
9,027 CVEs and advisories name Google as an affected vendor, 82 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-13027Use after free in FileSystem in Google Chrome prior to 149.0.7827.197 allowed a remote attacker to potentially exploit heap corruption via a
- CVE-2026-13026Use after free in Digital Credentials in Google Chrome on Mac prior to 149.0.7827.197 allowed a remote attacker to potentially exploit heap
- CVE-2026-13025Race in DevTools in Google Chrome prior to 149.0.7827.197 allowed a remote attacker who had compromised the renderer process to potentially
- CVE-2026-13024Insufficient validation of untrusted input in Navigation in Google Chrome prior to 149.0.7827.197 allowed a remote attacker who had compromi
- CVE-2026-13023Uninitialized Use in GPU in Google Chrome prior to 149.0.7827.197 allowed a remote attacker who had compromised the renderer process to obta
- CVE-2026-13022Inappropriate implementation in Autofill in Google Chrome prior to 149.0.7827.197 allowed a remote attacker who had compromised the renderer
- CVE-2026-13021Inappropriate implementation in DeviceBoundSessionCredentials in Google Chrome prior to 149.0.7827.197 allowed a remote attacker to bypass s
- CVE-2026-13038Use after free in Autofill in Google Chrome on Windows prior to 149.0.7827.197 allowed a remote attacker to execute arbitrary code via a cra
- CVE-2026-13033Out of bounds read and write in Blink>InterestGroups in Google Chrome prior to 149.0.7827.197 allowed a remote attacker to execute arbitrary
- CVE-2026-13032Use after free in WebGL in Google Chrome on Android prior to 149.0.7827.197 allowed a remote attacker to potentially perform a sandbox escap
- CVE-2026-13028Use after free in WebGL in Google Chrome on Android prior to 149.0.7827.197 allowed a remote attacker to potentially perform a sandbox escap
- CVE-2026-12681Improper Validation of Specified Index, Position, or Offset in Input vulnerability in Google go-attestation.
- CVE-2026-11719An authenticated authorization bypass vulnerability exists in MCP Toolbox for Databases due to missing scope enforcement across older protoc
- CVE-2026-11718An authentication bypass vulnerability exists in the generic opaque token validation path (validateOpaqueToken) of googleapis/mcp-toolbox.
- CVE-2026-11717An authentication bypass vulnerability exists in the generic opaque token validation path (validateOpaqueToken) of googleapis/mcp-toolbox.
- CVE-2026-28573In AndroidManifest.xml, there is a possible persistent denial of service due to a missing permission check.
- CVE-2026-0063In setAllowedCarriers of PhoneInterfaceManager.java, there is a possible way to disable carrier restrictions due to a logic error in the cod
- CVE-2026-28587In MmsSmsProvider of MmsSmsProvider.java, there is a possible way to retrieve sensitive information due to a missing permission check.
- CVE-2026-28615In Telecomm, there is a possible way to initiate an unauthorized phone call due to a permissions bypass.
- CVE-2026-0083In Nfc::eventCallback() of Nfc.h, there is a possible use after free due to a race condition.
- CVE-2026-0082In tryStartActivity of NfcDispatcher.java, there is a possible automatic special app access permission assignment due to an insecure default
- CVE-2026-0081In NFC, there is a possible way to spoof an NFC event due to a missing permission check.
- CVE-2026-0071In SettingsLib, there is a possible missing permission check due to a logic error in the code.
- CVE-2026-28575In PackageInstaller.Session#transfer of frameworks/base/services/core/java/com/android/server/pm/PackageInstallerSession.java, there is a po
- CVE-2026-0064In multiple places, there is a possible persistent denial of service due to resource exhaustion.
- CVE-2026-0092In Package Manager, there is a possible device lock controller bypass due to a missing permission check.
- CVE-2026-0068In createSessionInternal of PackageInstallerService.java, there is a possible method to remove a DPC app from a managed device without DO co
- CVE-2026-0057In Contacts Provider, there is a possible way to access an incoming call's phone number and associated metadata due to a missing permission
- CVE-2026-0019In SettingsLib, there is a possible way to disable system components due to a logic error in the code.
- CVE-2025-48643In multiple locations there is a possible provisioning bypass due to improper input validation.