Google vulnerabilities
- Google has 5,615 CVE records published between 28 Oct 2023 and 28 Oct 2026, ranking #3 of 420 vendors on this site by that count.
- Of the 5,424 with a CVSS score, 3,192 (58.8%) are rated critical or high; 191 (3.4% of all) have no CVSS score.
- 76 vulnerabilities attributed to Google are listed in CISA's Known Exploited Vulnerabilities (KEV) catalog; the most recent, CVE-2026-111497, was added on 27 Oct 2026.
- None of them is marked as known to be used in ransomware campaigns.
- For the 76 KEV entries with a published CVE record, the median time from CVE publication to KEV listing is 6 days.
Records are attributed to Google from the vendor named in the source records. About the data.
CVE records per year
Show data as a table
| Year | CVE records |
|---|---|
| 2017 | 821 |
| 2018 | 448 |
| 2019 | 778 |
| 2020 | 822 |
| 2021 | 900 |
| 2022 | 1,083 |
| 2023 | 959 |
| 2024 | 699 |
| 2025 | 597 |
| 2026 | 4,095 |
2026 is partial (through 28 Oct 2026), shown in a lighter bar.
| Year | Records | Critical | High | Critical or high | Not scored |
|---|---|---|---|---|---|
| 2026 | 4,095 | 468 | 1,841 | 56.5% | 0.2% |
| 2025 | 597 | 23 | 344 | 61.5% | 0% |
| 2024 | 699 | 45 | 437 | 69% | 0% |
| 2023 | 959 | 21 | 247 | 68.5% | 59.2% |
| 2022 | 1,083 | 10 | 136 | 46.3% | 70.9% |
| 2021 | 900 | 3 | 18 | 53.8% | 95.7% |
| 2020 | 822 | 4 | 6 | 31.3% | 96.1% |
| 2019 | 778 | 0 | 2 | 50% | 99.5% |
| 2018 | 448 | 0 | 4 | 100% | 99.1% |
| 2017 | 821 | 0 | 3 | 75% | 99.5% |
| Before 2017 | 1,641 | ||||
Source: CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of 28 Oct 2026. About the data.
Exploited vulnerabilities in CISA's KEV catalog
| CVE | Product | Name | Added | Ransomware |
|---|---|---|---|---|
| CVE-2026-111497 | Brotli | Google Brotli Unchecked Return Value Vulnerability | 2026-10-27 | Unknown |
| CVE-2026-58704 | Pixel | Google Pixel Improper Authorization Vulnerability | 2026-09-16 | Unknown |
| CVE-2026-87491 | Chromium V8 | Google Chromium V8 Out of Bounds Write Vulnerability | 2026-09-09 | Unknown |
| CVE-2026-85046 | Chromium V8 | Google Chromium V8 Type Confusion Vulnerability | 2026-09-04 | Unknown |
| CVE-2026-11645 | Chromium V8 | Google Chromium V8 Out-of-Bounds Read and Write Vulnerability | 2026-06-09 | Unknown |
| CVE-2026-5281 | Dawn | Google Dawn Use-After-Free Vulnerability | 2026-04-01 | Unknown |
| CVE-2026-3909 | Skia | Google Skia Out-of-Bounds Write Vulnerability | 2026-03-13 | Unknown |
| CVE-2026-3910 | Chromium V8 | Google Chromium V8 Improper Restriction of Operations Within the Bounds of a Memory Buffer Vulnerability | 2026-03-13 | Unknown |
| CVE-2026-2441 | Chromium | Google Chromium CSS Use-After-Free Vulnerability | 2026-02-17 | Unknown |
| CVE-2025-14174 | Chromium | Google Chromium Out of Bounds Memory Access Vulnerability | 2025-12-12 | Unknown |
| CVE-2025-13223 | Chromium V8 | Google Chromium V8 Type Confusion Vulnerability | 2025-11-19 | Unknown |
| CVE-2025-10585 | Chromium V8 | Google Chromium V8 Type Confusion Vulnerability | 2025-09-23 | Unknown |
| CVE-2025-6558 | Chromium | Google Chromium ANGLE and GPU Improper Input Validation Vulnerability | 2025-07-22 | Unknown |
| CVE-2025-6554 | Chromium V8 | Google Chromium V8 Type Confusion Vulnerability | 2025-07-02 | Unknown |
| CVE-2025-5419 | Chromium V8 | Google Chromium V8 Out-of-Bounds Read and Write Vulnerability | 2025-06-05 | Unknown |
| CVE-2025-2783 | Chromium Mojo | Google Chromium Mojo Sandbox Escape Vulnerability | 2025-03-27 | Unknown |
| CVE-2024-7965 | Chromium V8 | Google Chromium V8 Inappropriate Implementation Vulnerability | 2024-08-28 | Unknown |
| CVE-2024-7971 | Chromium V8 | Google Chromium V8 Type Confusion Vulnerability | 2024-08-26 | Unknown |
| CVE-2024-5274 | Chromium V8 | Google Chromium V8 Type Confusion Vulnerability | 2024-05-28 | Unknown |
| CVE-2024-4947 | Chromium V8 | Google Chromium V8 Type Confusion Vulnerability | 2024-05-20 | Unknown |
| CVE-2024-4761 | Chromium V8 | Google Chromium V8 Out-of-Bounds Memory Write Vulnerability | 2024-05-16 | Unknown |
| CVE-2024-4671 | Chromium | Google Chromium Visuals Use-After-Free Vulnerability | 2024-05-13 | Unknown |
| CVE-2023-4762 | Chromium V8 | Google Chromium V8 Type Confusion Vulnerability | 2024-02-06 | Unknown |
| CVE-2024-0519 | Chromium V8 | Google Chromium V8 Out-of-Bounds Memory Access Vulnerability | 2024-01-17 | Unknown |
| CVE-2023-7024 | Chromium WebRTC | Google Chromium WebRTC Heap Buffer Overflow Vulnerability | 2024-01-02 | Unknown |
| CVE-2023-6345 | Chromium Skia | Google Skia Integer Overflow Vulnerability | 2023-11-30 | Unknown |
| CVE-2023-5217 | Chromium libvpx | Google Chromium libvpx Heap Buffer Overflow Vulnerability | 2023-10-02 | Unknown |
| CVE-2023-4863 | Chromium WebP | Google Chromium WebP Heap-Based Buffer Overflow Vulnerability | 2023-09-13 | Unknown |
| CVE-2023-3079 | Chromium V8 | Google Chromium V8 Type Confusion Vulnerability | 2023-06-07 | Unknown |
| CVE-2023-2136 | Chromium Skia | Google Chrome Skia Integer Overflow Vulnerability | 2023-04-21 | Unknown |
| CVE-2023-2033 | Chromium V8 | Google Chromium V8 Type Confusion Vulnerability | 2023-04-17 | Unknown |
| CVE-2022-3038 | Chromium Network Service | Google Chromium Network Service Use-After-Free Vulnerability | 2023-03-30 | Unknown |
| CVE-2022-4262 | Chromium V8 | Google Chromium V8 Type Confusion Vulnerability | 2022-12-05 | Unknown |
| CVE-2022-4135 | Chromium GPU | Google Chromium GPU Heap Buffer Overflow Vulnerability | 2022-11-28 | Unknown |
| CVE-2022-3723 | Chromium V8 | Google Chromium V8 Type Confusion Vulnerability | 2022-10-28 | Unknown |
| CVE-2022-3075 | Chromium Mojo | Google Chromium Mojo Insufficient Data Validation Vulnerability | 2022-09-08 | Unknown |
| CVE-2022-2856 | Chromium Intents | Google Chromium Intents Insufficient Input Validation Vulnerability | 2022-08-18 | Unknown |
| CVE-2021-30533 | Chromium PopupBlocker | Google Chromium PopupBlocker Security Bypass Vulnerability | 2022-06-27 | Unknown |
| CVE-2016-1646 | Chromium V8 | Google Chromium V8 Out-of-Bounds Read Vulnerability | 2022-06-08 | Unknown |
| CVE-2016-5198 | Chromium V8 | Google Chromium V8 Out-of-Bounds Memory Vulnerability | 2022-06-08 | Unknown |
| CVE-2017-5030 | Chromium V8 | Google Chromium V8 Memory Corruption Vulnerability | 2022-06-08 | Unknown |
| CVE-2017-5070 | Chromium V8 | Google Chromium V8 Type Confusion Vulnerability | 2022-06-08 | Unknown |
| CVE-2018-17463 | Chromium V8 | Google Chromium V8 Remote Code Execution Vulnerability | 2022-06-08 | Unknown |
| CVE-2018-17480 | Chromium V8 | Google Chromium V8 Out-of-Bounds Write Vulnerability | 2022-06-08 | Unknown |
| CVE-2018-6065 | Chromium V8 | Google Chromium V8 Integer Overflow Vulnerability | 2022-06-08 | Unknown |
| CVE-2019-5825 | Chromium V8 | Google Chromium V8 Out-of-Bounds Write Vulnerability | 2022-06-08 | Unknown |
| CVE-2019-13720 | Chrome WebAudio | Google Chrome WebAudio Use-After-Free Vulnerability | 2022-05-23 | Unknown |
| CVE-2019-5786 | Chrome Blink | Google Chrome Blink Use-After-Free Vulnerability | 2022-05-23 | Unknown |
| CVE-2022-1364 | Chromium V8 | Google Chromium V8 Type Confusion Vulnerability | 2022-04-15 | Unknown |
| CVE-2021-39793 | Pixel | Google Pixel Out-of-Bounds Write Vulnerability | 2022-04-11 | Unknown |
| CVE-2022-1096 | Chromium V8 | Google Chromium V8 Type Confusion Vulnerability | 2022-03-28 | Unknown |
| CVE-2022-0609 | Chromium Animation | Google Chromium Animation Use-After-Free Vulnerability | 2022-02-15 | Unknown |
| CVE-2020-6572 | Chrome Media | Google Chrome Media Use-After-Free Vulnerability | 2022-01-10 | Unknown |
| CVE-2021-4102 | Chromium V8 | Google Chromium V8 Use-After-Free Vulnerability | 2021-12-15 | Unknown |
| CVE-2020-15999 | Chrome FreeType | Google Chrome FreeType Heap Buffer Overflow Vulnerability | 2021-11-03 | Unknown |
| CVE-2020-16009 | Chromium V8 | Google Chromium V8 Type Confusion Vulnerability | 2021-11-03 | Unknown |
| CVE-2020-16010 | Chrome for Android UI | Google Chrome for Android UI Heap Buffer Overflow Vulnerability | 2021-11-03 | Unknown |
| CVE-2020-16013 | Chromium V8 | Google Chromium V8 Incorrect Implementation Vulnerabililty | 2021-11-03 | Unknown |
| CVE-2020-16017 | Chrome | Google Chrome Use-After-Free Vulnerability | 2021-11-03 | Unknown |
| CVE-2020-6418 | Chromium V8 | Google Chromium V8 Type Confusion Vulnerability | 2021-11-03 | Unknown |
| CVE-2021-21148 | Chromium V8 | Google Chromium V8 Heap Buffer Overflow Vulnerability | 2021-11-03 | Unknown |
| CVE-2021-21166 | Chromium | Google Chromium Race Condition Vulnerability | 2021-11-03 | Unknown |
| CVE-2021-21193 | Chromium Blink | Google Chromium Blink Use-After-Free Vulnerability | 2021-11-03 | Unknown |
| CVE-2021-21206 | Chromium Blink | Google Chromium Blink Use-After-Free Vulnerability | 2021-11-03 | Unknown |
| CVE-2021-21220 | Chromium V8 | Google Chromium V8 Improper Input Validation Vulnerability | 2021-11-03 | Unknown |
| CVE-2021-21224 | Chromium V8 | Google Chromium V8 Type Confusion Vulnerability | 2021-11-03 | Unknown |
| CVE-2021-30551 | Chromium V8 | Google Chromium V8 Type Confusion Vulnerability | 2021-11-03 | Unknown |
| CVE-2021-30554 | Chromium WebGL | Google Chromium WebGL Use-After-Free Vulnerability | 2021-11-03 | Unknown |
| CVE-2021-30563 | Chromium V8 | Google Chromium V8 Type Confusion Vulnerability | 2021-11-03 | Unknown |
| CVE-2021-30632 | Chromium V8 | Google Chromium V8 Out-of-Bounds Write Vulnerability | 2021-11-03 | Unknown |
| CVE-2021-30633 | Chromium Indexed DB API | Google Chromium Indexed DB API Use-After-Free Vulnerability | 2021-11-03 | Unknown |
| CVE-2021-37973 | Chromium Portals | Google Chromium Portals Use-After-Free Vulnerability | 2021-11-03 | Unknown |
| CVE-2021-37975 | Chromium V8 | Google Chromium V8 Use-After-Free Vulnerability | 2021-11-03 | Unknown |
| CVE-2021-37976 | Chromium | Google Chromium Information Disclosure Vulnerability | 2021-11-03 | Unknown |
| CVE-2021-38000 | Chromium Intents | Google Chromium Intents Improper Input Validation Vulnerability | 2021-11-03 | Unknown |
| CVE-2021-38003 | Chromium V8 | Google Chromium V8 Memory Corruption Vulnerability | 2021-11-03 | Unknown |
Source: CISA Known Exploited Vulnerabilities (KEV) catalog, 2026.10.27, as of 27 Oct 2026. About the data.
Highest exploit-prediction scores (EPSS)
EPSS estimates the probability that a vulnerability is exploited in the next 30 days. These are the 10 highest-scoring Google records today.
| CVE | EPSS | Percentile | Severity | In KEV |
|---|---|---|---|---|
| CVE-2023-4863 | 100% | 100% | High | Yes |
| CVE-2020-16040 | 99.6% | 99.9% | Not scored | No |
| CVE-2015-3824 | 90.5% | 99.8% | Not scored | No |
| CVE-2015-3829 | 89.9% | 99.8% | Not scored | No |
| CVE-2026-111497 | 88% | 99.8% | Critical | Yes |
| CVE-2015-3864 | 87.1% | 99.7% | Not scored | No |
| CVE-2015-3828 | 85.4% | 99.7% | Not scored | No |
| CVE-2022-0306 | 85.4% | 99.7% | Not scored | No |
| CVE-2018-17463 | 84.6% | 99.7% | High | Yes |
| CVE-2021-21224 | 84.2% | 99.7% | High | Yes |
Source: FIRST Exploit Prediction Scoring System (EPSS), v2026.06.15, as of 28 Oct 2026; CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of 28 Oct 2026; CISA Known Exploited Vulnerabilities (KEV) catalog, 2026.10.27, as of 27 Oct 2026. About the data.