Google CVEs
9,110 CVEs and advisories name Google as an affected vendor, 82 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2025-48590In verifyAndGetBypass of AppOpsService.java, there is a possible method for a malicious app to prevent dialing emergency services under limi
- CVE-2025-48589In multiple functions of HeaderPrivacyIconsController.kt, there is a possible way to grand permissions across user due to a logic error in
- CVE-2025-48588In startAlwaysOnVpn of Vpn.java, there is a possible way to disable always-on VPN due to a logic error in the code.
- CVE-2025-48586In onActivityResult of EditFdnContactScreen.java, there is a possible way to leak contacts from the work profile due to a confused deputy.
- CVE-2025-48584In multiple functions of NotificationManagerService.java, there is a possible way to bypass the per-package channel limits causing resource
- CVE-2025-48583In multiple functions of BaseBundle.java, there is a possible way to execute arbitrary code due to a logic error in the code.
- CVE-2025-48580In connectInternal of MediaBrowser.java, there is a possible way to access while in use permission while the app is in background due to a l
- CVE-2025-48576In updateNotificationChannelGroupFromPrivilegedListener of NotificationManagerService.java, there is a possible permanent denial of service
- CVE-2025-48575In multiple functions of CertInstaller.java, there is a possible way to install certificates due to a permissions bypass.
- CVE-2025-48573In sendCommand of MediaSessionRecord.java, there is a possible way to launch the foreground service while the app is in the background due t
- CVE-2025-48572In multiple locations, there is a possible way to launch activities from the background due to a permissions bypass.
- CVE-2025-48566In multiple locations, there is a possible permission bypass due to a confused deputy.
- CVE-2025-48565In multiple locations, there is a possible way to bypass the cross profile intent filter due to a logic error in the code.
- CVE-2025-48564In multiple locations, there is a possible intent filter bypass due to a race condition.
- CVE-2025-48555In multiple functions of NotificationStation.java, there is a possible cross-profile information disclosure due to a confused deputy.
- CVE-2025-48536In grantAllowlistedPackagePermissions of SettingsSliceProvider.java, there is a possible way for a third party app to modify secure settings
- CVE-2025-48525In disassociate of DisassociationProcessor.java, there is a possible way for an app to continue reading notifications when not associated to
- CVE-2025-32329In multiple functions of Session.java, there is a possible way to view images belonging to a different user of the device due to a logic err
- CVE-2025-32328In multiple functions of Session.java, there is a possible way to view images belonging to a different user of the device due to a logic err
- CVE-2025-32319In ensureBound of RemotePrintService.java, there is a possible way for a background app to keep foreground permissions due to a permissions
- CVE-2025-22432In notifyTimeout of CallRedirectionProcessor.java, there is a possible persistent connection due to improper input validation.
- CVE-2025-22420In multiple locations, there is a possible way to leak audio files across user profiles due to a confused deputy.
- CVE-2025-13992Side-channel information leakage in Navigation and Loading in Google Chrome prior to 139.0.7258.66 allowed a remote attacker to bypass site
- CVE-2025-13633Use after free in Digital Credentials in Google Chrome prior to 143.0.7499.41 allowed a remote attacker who had compromised the renderer pro
- CVE-2025-13721Race in v8 in Google Chrome prior to 143.0.7499.41 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- CVE-2025-13720Bad cast in Loader in Google Chrome prior to 143.0.7499.41 allowed a remote attacker who had compromised the renderer process to potentially
- CVE-2025-13640Inappropriate implementation in Passwords in Google Chrome prior to 143.0.7499.41 allowed a local attacker to bypass authentication via phys
- CVE-2025-13639Inappropriate implementation in WebRTC in Google Chrome prior to 143.0.7499.41 allowed a remote attacker to perform arbitrary read/write via
- CVE-2025-13638Use after free in Media Stream in Google Chrome prior to 143.0.7499.41 allowed a remote attacker to potentially exploit heap corruption via
- CVE-2025-13637Inappropriate implementation in Downloads in Google Chrome prior to 143.0.7499.41 allowed a remote attacker who convinced a user to engage i