Google CVEs
9,028 CVEs and advisories name Google as an affected vendor, 82 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-28622In getQueryBuilderInternal of MediaProvider.java, there is a possible way to retrieve location metadata due to a permissions bypass.
- CVE-2026-28620In multiple locations, there is a possible unauthorized URI access due to a permissions bypass.
- CVE-2026-28618In dec_frm_prepare of oapv.c, there is a possible OOB write due to a heap buffer overflow.
- CVE-2026-28617In add of WifiNetworkSuggestionsManager.java, there is a possible persistent DOS due to resource exhaustion.
- CVE-2026-28616In Setup Wizard, there is a possible way to force connection to a malicious network due to confused deputy.
- CVE-2026-28614In onCreate of SlicePermissionActivity.java, there is a possible permission bypass due to a confused deputy.
- CVE-2026-28613In initAppLinkTypeAndIntent of ChannelImpl.java, there is a possible launch an arbitrary intent due to improper input validation.
- CVE-2026-28612In resolveActivity of ActivityStarter.java, there is a possible way to perform Intent Redirection attacks due to a logic error in the code.
- CVE-2026-28611In multiple functions of NfcService.java, there is a possible silent payment session hijacking enablement due to a missing permission check.
- CVE-2026-28609In read of MatroskaExtractor.cpp, there is a possible out-of-bounds write due to improper casting.
- CVE-2026-28607In multiple functions in multiple locations, there is a possible background activity launch bypass due to a confused deputy.
- CVE-2026-28606In handleBondStateChanged of AdapterService.java, there is a possible way to skip pairing due to a logic error in the code.
- CVE-2026-28604In multiple locations, there is a possible use after free due to a race condition.
- CVE-2026-28603In assertSafeToStartCustomActivity of AppRestrictionsFragment.java, there is a possible read/write access to private files due to a confused
- CVE-2026-28602In setClipboardAccessNotificationsEnabledForUser of ClipboardService.java, there is a possible mult-iuser isolation due to a logic error in
- CVE-2026-28600In onCreate of PaymentDefaultDialog.java, there is a possible way to change default payment app due to a confused deputy.
- CVE-2026-28599In addCreatorToken of ActivityManagerService.java, there is a possible Intent Redirection Bypass due to a logic error in the code.
- CVE-2026-28596In parseInterventionFromXml of GameManagerService.java, there is a possible permanent denial of service due to resource exhaustion.
- CVE-2026-28594In multiple locations, there is a possible use after free due to a logic error in the code.
- CVE-2026-28593In getItemList of SettingsFragment.java, there is a possible user interaction bypass due to misleading or insufficient UI.
- CVE-2026-28590In multiple locations, there is a possible improper encryption key validation due to a logic error in the code.
- CVE-2026-28584In createSessionInternal of PackageInstallerService.java, there is a possible way to permanently DoS the device due to a logic error in the
- CVE-2026-28583In validate_camera_metadata_structure of camera_metadata.c, there is a possible out of bounds write due to a logical error in the code.
- CVE-2026-28582In onCreate of ConfirmDeviceCredentialActivity.java, there is a possible unauthorized access to and modification of device credentials due t
- CVE-2026-28572In onCreate of InstallLaunch.kt, there is a possible misleading UI due to a tapjacking/overlay attack.
- CVE-2026-0084In multiple functions of HostEmulationManager.java, there is a possible background activity launch due to a logic error in the code.
- CVE-2026-0065In areBackgroundActivityStartsAllowed of BackgroundLaunchProcessController.java, there is a possible unintended way to launch activities in
- CVE-2026-0054In isCallerAllowed of WalletContextualLocationsService.kt, there is a possible way to get wallet information due to a missing permission che
- CVE-2026-85044Use of released resource in Mobile in Google Chrome on on Android prior to 152.0.7977.82 allowed a remote attacker leveraging social enginee
- CVE-2026-85047Improper input validation in Transactions Platform in Google Chrome on on iOS prior to 152.0.7977.82 allowed a remote attacker to potentiall