Google CVEs
9,110 CVEs and advisories name Google as an affected vendor, 82 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2025-48619In multiple functions of ContentProvider.java, there is a possible way for an app with read-only access to truncate files due to a logic err
- CVE-2025-48613In VBMeta, there is a possible way to modify and resign VBMeta using a test key, assuming the original image was previously signed with the
- CVE-2025-48609In multiple functions of MmsProvider.java, there is a possible way to arbitrarily delete files which affect telephony, SMS, and MMS function
- CVE-2025-48605In multiple functions of KeyguardViewMediator.java, there is a possible lockscreen bypass due to a logic error in the code.
- CVE-2025-48602In exitKeyguardAndFinishSurfaceBehindRemoteAnimation of KeyguardViewMediator.java, there is a possible lockscreen bypass due to a logic erro
- CVE-2025-48587In multiple functions of ProfilingService.java, there is a possible persistent denial of service due to improper input validation.
- CVE-2025-48585In multiple functions of ProfilingService.java, there is a possible persistent denial of service due to improper input validation.
- CVE-2025-48582In multiple locations, there is a possible way to delete media without the MANAGE_EXTERNAL_STORAGE permission due to an intent redirect.
- CVE-2025-48579In multiple functions of MediaProvider.java, there is a possible external storage write permission bypass due to a confused deputy.
- CVE-2025-48578In multiple functions of MediaProvider.java, there is a possible way to bypass the WRITE_EXTERNAL_STORAGE permission due to a missing permis
- CVE-2025-48577In multiple functions of KeyguardViewMediator.java, there is a possible lockscreen bypass due to a race condition.
- CVE-2025-48574In validateAddingWindowLw of DisplayPolicy.java, there is a possible way for an app to intercept drag-and-drop events due to a missing permi
- CVE-2025-48568In multiple locations, there is a possible lockscreen bypass due to a race condition.
- CVE-2025-48567In multiple locations, there is a possible bypass of a file path filter designed to prevent access to sensitive directories due to incorrec
- CVE-2025-32313In UsageEvents of UsageEvents.java, there is a possible out of bounds write due to an incorrect bounds check.
- CVE-2024-43766In multiple functions of btm_ble_sec.cc, there is a possible unencrypted communication due to Invalid error handling.
- CVE-2026-3223Zip Slip leading to Arbitrary File Write and Privilege Escalation in Google Web Designer
- CVE-2026-3063Inappropriate implementation in DevTools in Google Chrome prior to 145.0.7632.116 allowed an attacker who convinced a user to install a mali
- CVE-2026-3062Out of bounds read and write in Tint in Google Chrome on Mac prior to 145.0.7632.116 allowed a remote attacker to perform out of bounds memo
- CVE-2026-3061Out of bounds read in Media in Google Chrome prior to 145.0.7632.116 allowed a remote attacker to perform an out of bounds memory read via a
- CVE-2026-2650Heap buffer overflow in Media in Google Chrome prior to 145.0.7632.109 allowed a remote attacker to potentially exploit heap corruption via
- CVE-2026-2649Integer overflow in V8 in Google Chrome prior to 145.0.7632.109 allowed a remote attacker to potentially exploit heap corruption via a craft
- CVE-2026-2648Heap buffer overflow in PDFium in Google Chrome prior to 145.0.7632.109 allowed a remote attacker to perform an out of bounds memory write v
- CVE-2026-2441Use after free in CSS in Google Chrome prior to 145.0.7632.75 allowed a remote attacker to execute arbitrary code inside a sandbox via a cra
- CVE-2026-1669Arbitrary File Read in Keras via HDF5 External Datasets
- CVE-2026-2323Inappropriate implementation in Downloads in Google Chrome prior to 145.0.7632.45 allowed a remote attacker to perform UI spoofing via a cra
- CVE-2026-2322Inappropriate implementation in File input in Google Chrome prior to 145.0.7632.45 allowed a remote attacker who convinced a user to engage
- CVE-2026-2321Use after free in Ozone in Google Chrome prior to 145.0.7632.45 allowed a remote attacker who convinced a user to engage in specific UI gest
- CVE-2026-2320Inappropriate implementation in File input in Google Chrome prior to 145.0.7632.45 allowed a remote attacker who convinced a user to engage
- CVE-2026-2319Race in DevTools in Google Chrome prior to 145.0.7632.45 allowed a remote attacker who convinced a user to engage in specific UI gestures an