Google CVEs
9,110 CVEs and advisories name Google as an affected vendor, 82 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2025-6044An Improper Access Control vulnerability in the Stylus Tools component of Google ChromeOS version 16238.64.0 on the garaged stylus devices a
- CVE-2025-6554Type confusion in V8 in Google Chrome prior to 138.0.7204.96 allowed a remote attacker to perform arbitrary read/write via a crafted HTML pa
- CVE-2025-6557Insufficient data validation in DevTools in Google Chrome on Windows prior to 138.0.7204.49 allowed a remote attacker who convinced a user t
- CVE-2025-6556Insufficient policy enforcement in Loader in Google Chrome prior to 138.0.7204.49 allowed a remote attacker to bypass content security polic
- CVE-2025-6555Use after free in Animation in Google Chrome prior to 138.0.7204.49 allowed a remote attacker to potentially exploit heap corruption via a c
- CVE-2025-6192Use after free in Metrics in Google Chrome prior to 137.0.7151.119 allowed a remote attacker to potentially exploit heap corruption via a cr
- CVE-2025-6191Integer overflow in V8 in Google Chrome prior to 137.0.7151.119 allowed a remote attacker to potentially perform out of bounds memory access
- CVE-2025-5981Arbitrary File write in OSV-SCALIBR
- CVE-2025-6179ChromeOS Extension Disablement and Developer Mode Bypass via ExtHang3r and ExtPrint3r Exploits
- CVE-2025-6177ChromeOS MiniOS Root Code Execution Bypass While Dev Mode Blocked
- CVE-2025-4613Client side RCE in Google Web Designer App
- CVE-2025-5959Type Confusion in V8 in Google Chrome prior to 137.0.7151.103 allowed a remote attacker to execute arbitrary code inside a sandbox via a cra
- CVE-2025-5958Use after free in Media in Google Chrome prior to 137.0.7151.103 allowed a remote attacker to potentially exploit heap corruption via a craf
- CVE-2025-2336AngularJS improper sanitization in SVG '<image>' element with 'ngSanitize'
- CVE-2025-5068Use after free in Blink in Google Chrome prior to 137.0.7151.68 allowed a remote attacker to potentially exploit heap corruption via a craft
- CVE-2025-5419Out of bounds read and write in V8 in Google Chrome prior to 137.0.7151.68 allowed a remote attacker to potentially exploit heap corruption
- CVE-2025-5067Inappropriate implementation in Tab Strip in Google Chrome prior to 137.0.7151.55 allowed a remote attacker to perform UI spoofing via a cra
- CVE-2025-5283Use after free in libvpx in Google Chrome prior to 137.0.7151.55 allowed a remote attacker to potentially exploit heap corruption via a craf
- CVE-2025-5281Inappropriate implementation in BFCache in Google Chrome prior to 137.0.7151.55 allowed a remote attacker to potentially obtain user informa
- CVE-2025-5066Inappropriate implementation in Messages in Google Chrome on Android prior to 137.0.7151.55 allowed a remote attacker who convinced a user t
- CVE-2025-5065Inappropriate implementation in FileSystemAccess API in Google Chrome prior to 137.0.7151.55 allowed a remote attacker to perform UI spoofin
- CVE-2025-5064Inappropriate implementation in Background Fetch API in Google Chrome prior to 137.0.7151.55 allowed a remote attacker to leak cross-origin
- CVE-2025-5280Out of bounds write in V8 in Google Chrome prior to 137.0.7151.55 allowed a remote attacker to potentially exploit heap corruption via a cra
- CVE-2025-5063Use after free in Compositing in Google Chrome prior to 137.0.7151.55 allowed a remote attacker to potentially exploit heap corruption via a
- CVE-2025-27701In the function process_crypto_cmd, the values of ptrs[i] can be potentially equal to NULL which is valid value after calling slice_map_arra
- CVE-2025-27700There is a possible bypass of carrier restrictions due to an unusual root cause.
- CVE-2024-56193There is a possible disclosure of Bluetooth adapter details due to a permissions bypass.
- CVE-2025-4664Insufficient policy enforcement in Loader in Google Chrome prior to 136.0.7103.113 allowed a remote attacker to leak cross-origin data via a
- CVE-2025-1079RCE In Google Web Designer
- CVE-2025-4372Use after free in WebAudio in Google Chrome prior to 136.0.7103.92 allowed a remote attacker to potentially exploit heap corruption via a cr