Google vulnerabilities
9,028 CVEs and advisories name Google as an affected vendor, 82 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-28665In onCreate of SettingsApplication.java, there is a possible cross-profile consent dialog label injection due to improper input validation.
- CVE-2026-28645In onStrongAuthRequiredChanged of UsbService.java, there is a possible unauthenticated enabling of USB data due to a logic error in the…
- CVE-2026-28643In multiple locations, there is a possible denial of service due to a missing permission check.
- CVE-2026-28632In multiple locations, there is a possible way to share files across profiles due to a logic error in the code.
- CVE-2026-28621In getRingtone of RingtoneFactory.java, there is a possible unprivileged access risk due to a missing permission check.
- CVE-2026-28597In writeGrantedUriPermissions of UriGrantsManagerService.java, there is a possible permission bypass due to improper input validation.
- CVE-2026-28588In shouldBlockDirectoryFromTree of ExternalStorageProvider.java, there is a possible way to access protected data due to a logic error in…
- CVE-2026-0053In multiple locations, there is a possible method for a primary user to disable secure nfc on other full users due to insufficient…
- CVE-2025-26433In multiple locations, there is a possible way to trick a user into accepting a permission due to a tapjacking/overlay attack.
- CVE-2025-22436In multiple locations, there is a possible way to trick a user into disclosing Autofill contents due to a tapjacking/overlay attack.
- CVE-2026-119272Incorrect authorization in FileSystem in Google Chrome prior to 156.0.8078.79 allowed a remote attacker leveraging social engineering to…
- CVE-2026-119271Uninitialized resource in Skia in Google Chrome prior to 156.0.8078.79 allowed a remote attacker who had compromised the renderer process…
- CVE-2026-119270Incorrect reference resolution in CacheStorage in Google Chrome prior to 156.0.8078.79 allowed a remote attacker who had compromised the…
- CVE-2026-119269Incorrect authorization in Blink in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to bypass web origin policy via a…
- CVE-2026-119268Use after free in Editing in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox…
- CVE-2026-119267Use after free in DOM in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a…
- CVE-2026-119266Incorrect reference resolution in Quota in Google Chrome prior to 156.0.8078.79 allowed a remote attacker who had compromised the renderer…
- CVE-2026-119265Incorrect reference resolution in Quota in Google Chrome prior to 156.0.8078.79 allowed a remote attacker who had compromised the renderer…
- CVE-2026-119264Use after free in Dawn in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code outside the…
- CVE-2026-119263Use after free in GarbageCollection in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the…
- CVE-2026-119262Out of bounds write in V8 in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox…
- CVE-2026-119261Buffer overflow in Skia in Google Chrome prior to 156.0.8078.79 allowed a remote attacker who had compromised the renderer process to…
- CVE-2026-119260Use after free in Frames in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox…
- CVE-2026-76031Incorrect authorization in Input in Google Chrome prior to 156.0.8078.79 allowed a remote attacker leveraging social engineering to bypass…
- CVE-2026-76030Incorrect authorization in FileSystem in Google Chrome prior to 156.0.8078.79 allowed a remote attacker leveraging social engineering to…
- CVE-2026-76029Improper input validation in Network in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside…
- CVE-2026-76028Incorrect authorization in FileSystem in Google Chrome prior to 156.0.8078.79 allowed a remote attacker leveraging social engineering to…
- CVE-2026-76027Information loss in CacheStorage in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to obtain cross-origin data via a…
- CVE-2026-76026Origin validation error in Autofill in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to bypass web origin policy via a…
- CVE-2026-76025Incorrect authorization in FileSystem in Google Chrome prior to 156.0.8078.79 allowed a remote attacker leveraging social engineering to…