Google CVEs
9,028 CVEs and advisories name Google as an affected vendor, 82 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-28625In multiple locations, there is a possible permission bypass due to a logic error in the code.
- CVE-2026-58880In handle_app_val_response of btif_rc.cc, there is a possible way to achieve code execution due to a race condition.
- CVE-2026-58865In multiple functions of PduParser.java, there is a possible persistent denial of service due to a missing bounds check.
- CVE-2026-58859In multiple places, there is a possible denial of service due to an uncaught exception.
- CVE-2026-58856In returnOutputBufferLocked of DeprecatedCamera3StreamSplitter.cpp, there is a possible out-of-bounds read due to a missing bounds check.
- CVE-2026-58854In multiple locations, there is a possible memory corruption due to type confusion.
- CVE-2026-58841In multiple functions of VirtualAudioControllerTest.java, there is a possible permission bypass due to a logic error in the code.
- CVE-2026-58835In cfg2prop of btif_storage.cc, there is a possible out-of-bounds write due to a heap buffer overflow.
- CVE-2026-58834In setPermissionGrantState of DevicePolicyManagerService.java, there is a possible persistent denial of service due to improper input valida
- CVE-2026-58815In multiple locations, there is a possible out of bounds write due to an incorrect bounds check.
- CVE-2026-55286In stpropnci_process of stpropnci.cc, there is a possible out of bounds write due to an incorrect bounds check.
- CVE-2026-55280In multiple locations, there is a possible out-of-bounds write due to uninitialized data.
- CVE-2026-55270In dialInternal in multiple locations, there is a possible permission bypass due to a confused deputy.
- CVE-2026-55269In FilterCapturedPacket of snoop_logger.cc, there is a possible memory safety issue due to improper input validation.
- CVE-2026-55266In qsort of libufdt_sysdeps_vendor.c, there is a possible out-of-bounds write due to resource exhaustion.
- CVE-2026-55265In multiple functions of PduParser.java, there is a possible out of bounds read due to a missing bounds check.
- CVE-2026-49937In multiple functions of MessageQueueBase.h, there is a possible out of bounds read due to an incorrect bounds check.
- CVE-2026-49933In handle_le_monitor_device_event of msft.cc, there is a possible control-flow hijack in the privileged bluetooth process due to an uninitia
- CVE-2026-49885In rw_t4t_update_file of rw_t4t.cc, there is a possible out-of-bounds write due to an integer overflow.
- CVE-2026-49880In multiple functions of nfa_nfcee_act.cc, there is a possible out-of-bounds write due to a missing bounds check.
- CVE-2026-49878In wpas_handle_robust_av_scs_recv_action of robust_av.c, there is a possible out-of-bounds write due to a logic error in the code.
- CVE-2026-45524In isSystem of WifiPermissionsUtil.java, there is a possible sandbox escape due to a missing permission check.
- CVE-2026-28667In multiple functions of rw_t5t.cc, there is a possible out-of-bounds read due to a missing bounds check.
- CVE-2026-103627Information leak in SVG in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to obtain sensitive information via a crafted HTML
- CVE-2026-103631Buffer overflow in WebRTC in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code inside the sandbox via
- CVE-2026-103623Use after free in MediaStream in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code inside the sandbox
- CVE-2026-103622Use after free in SVG in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code inside the sandbox via a c
- CVE-2026-103629Integer overflow in Skia in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to leak cross-origin data via a crafted HTML page
- CVE-2026-103624Use after free in Contextual Tasks in Google Chrome on on Windows prior to 154.0.8037.97 allowed a remote attacker who had compromised the r
- CVE-2026-103625Type confusion in V8 in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code inside the sandbox via a cr