Google CVEs
9,028 CVEs and advisories name Google as an affected vendor, 82 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-19145Use after free in Translate in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to execute arbitrary code inside a sandbox vi
- CVE-2026-19144Use after free in HTML in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to potentially exploit heap corruption via a craft
- CVE-2026-19143Insufficient validation of untrusted input in WebAPKs in Google Chrome on Android prior to 151.0.7922.109 allowed a local attacker to potent
- CVE-2026-19142Use after free in Views in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who convinced a user to engage in specific UI ges
- CVE-2026-19141Use after free in Resources in Google Chrome on Android prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer p
- CVE-2026-19140Use after free in GPU in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to potenti
- CVE-2026-19139Race in CredentialProvider in Google Chrome on Windows prior to 151.0.7922.109 allowed a local attacker to perform OS-level privilege escala
- CVE-2026-19138Heap buffer overflow in CrashReporting in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer p
- CVE-2026-19168Inappropriate implementation in V8 in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to execute arbitrary code inside a san
- CVE-2026-19169Insufficient validation of untrusted input in Contextual Tasks in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to perform
- CVE-2026-19172Use after free in Views in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to poten
- CVE-2026-19170Use after free in WebGL in Google Chrome on Android prior to 151.0.7922.109 allowed a remote attacker to potentially perform a sandbox escap
- CVE-2026-19157Out of bounds write in ANGLE in Google Chrome on Android prior to 151.0.7922.109 allowed a remote attacker to potentially perform a sandbox
- CVE-2026-19154Use after free in Skia in Google Chrome on Android prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer proces
- CVE-2026-19149Use after free in Aura in Google Chrome on Linux prior to 151.0.7922.109 allowed a remote attacker to potentially perform a sandbox escape v
- CVE-2026-19137Use after free in WebGL in Google Chrome on Android prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer proce
- CVE-2026-0163In multiple functions of vpu_ioctl.c, there is a possible use after free due to a use after free.
- CVE-2026-10032Arbitrary JavaScript Execution via openUrl in @a2ui/web_core
- CVE-2026-14541Authentication Bypass and Audience Confusion in MCP Toolbox OAuth Provider
- CVE-2026-14540Server-Side Request Forgery via Unrestricted HTTP Redirection in MCP Toolbox
- CVE-2026-14539Denial of Service via Unrestricted Payload Buffering in MCP Toolbox
- CVE-2026-14538BigQuery Dataset Allowlist Bypass via Metadata Dry-Run in MCP Toolbox
- CVE-2026-14537Authorization Bypass in MCP Toolbox Legacy HTTP Endpoints
- CVE-2026-18019Side-channel information leakage in Media in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a
- CVE-2026-18018Inappropriate implementation in Updater in Google Chrome on Windows prior to 151.0.7922.72 allowed a local attacker to perform UI spoofing v
- CVE-2026-18017Use after free in Dawn in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a cr
- CVE-2026-18016Insufficient policy enforcement in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to perform UI spo
- CVE-2026-18015Inappropriate implementation in Tint in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandb
- CVE-2026-18014Insufficient validation of untrusted input in DevTools in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass navigatio
- CVE-2026-18013Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofi