Google vulnerabilities
We track 4,264 vulnerabilities in Google products across 60+ products. 4,254 are rated high or critical, and 93 have been exploited in real attacks. The most recent was published on November 11, 2026.
Latest Google vulnerabilities
- 8.8 High severity
Google Chromium V8 Type Confusion Exploited
Type confusion in V8 in Google Chrome prior to 99.0.4844.84 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- 8.8 High severity
Chrome: Use After Free
Use after free in New Tab Page in Google Chrome prior to 99.0.4844.74 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via specific user interactions.
- 8.8 High severity
Chrome: Use After Free
Use after free in Safe Browsing in Google Chrome on Android prior to 99.0.4844.74 allowed a remote attacker who convinced a user to engage in specific user interaction to potentially exploit heap corruption via a crafted HTML page.
- 8.8 High severity
Chrome: Use After Free
Use after free in ANGLE in Google Chrome prior to 99.0.4844.74 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- 9.6 Critical severity
Chrome: Use After Free
Use after free in Browser UI in Google Chrome on Chrome OS prior to 99.0.4844.74 allowed a remote attacker who convinced a user to engage in specific user interaction to potentially exploit heap corruption via a crafted HTML page.
- 8.8 High severity
Chrome: Out-of-bounds Write
Heap buffer overflow in GPU in Google Chrome prior to 99.0.4844.74 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- 8.8 High severity
Chrome: Use After Free
Use after free in ANGLE in Google Chrome prior to 99.0.4844.74 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- 8.8 High severity
Chrome: Use After Free
Use after free in Splitscreen in Google Chrome on Chrome OS prior to 99.0.4844.74 allowed a remote attacker who convinced a user to engage in specific user interaction to potentially exploit heap corruption via a crafted HTML page.
- 9.6 Critical severity
Chrome: Use After Free
Use after free in Safe Browsing in Google Chrome prior to 99.0.4844.74 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- 8.8 High severity
Chrome: Use After Free
Use after free in Extensions in Google Chrome prior to 99.0.4844.74 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page.
- 8.8 High severity
Chrome: Use After Free
Use after free in Blink Layout in Google Chrome on Android prior to 99.0.4844.74 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.
- 7.8 High severity
Implicit Intent hijacking vulnerability in Finder prior to SMR Jul-2022 Release 1 allow allows…
Implicit Intent hijacking vulnerability in Finder prior to SMR Jul-2022 Release 1 allow allows attackers to launch certain activities with privilege of Finder.
- 7.8 High severity
Samsung Mobile Devices: Improper Authentication
Improper authentication vulnerability in AppLock prior to SMR Jul-2022 Release 1 allows attacker to bypass password confirm activity by hijacking the implicit intent.
- 7.8 High severity
Implicit Intent hijacking vulnerability in AppLinker prior to SMR Jul-2022 Release 1 allow…
Implicit Intent hijacking vulnerability in AppLinker prior to SMR Jul-2022 Release 1 allow allows attackers to launch certain activities with privilege of AppLinker.
- 7.8 High severity
MT6580, MT6735, MT6739, MT6761, MT6765…: Missing Authorization
In Autoboot, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06713894; Issu
- 8.8 High severity
MT8167S, MT8175, MT8183, MT8362A, MT8365, MT8385: Out-of-bounds Write
In Bluetooth, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06784351; Issue
- 8.8 High severity
MT8167, MT8175, MT8183, MT8362A, MT8365, MT8385: Out-of-bounds Write
In Bluetooth, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06784430; Issue
- 7.0 High severity
MT6768, MT6769, MT6781, MT6785, MT6789…: Concurrent Execution using Shared Resource with Improper Synchronization
In GPU, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07044730; Issue ID: ALPS07044730
- 7.5 High severity
kctf: Improper Access Control
kCTF is a Kubernetes-based infrastructure for capture the flag (CTF) competitions. Prior to version 1.6.0, the kctf cluster set-src-ip-ranges was broken and allowed traffic from any IP. The problem has been patched in v1.6.0. As a workaround, those who want to
- 7.8 High severity
Unprotected component vulnerability in DeviceSearchTrampoline in SecSettingsIntelligence prior…
Unprotected component vulnerability in DeviceSearchTrampoline in SecSettingsIntelligence prior to SMR Jun-2022 Release 1 allows local attackers to launch activities of SecSettingsIntelligence.
- 9.8 Critical severity
Samsung Mobile Devices: Improper Authorization
Implicit Intent hijacking vulnerability in Samsung Account prior to SMR Jun-2022 Release 1 allows attackers to bypass user confirmation of Samsung Account.
- 7.5 High severity
MT6833, MT6853, MT6877, MT6885, MT6889…: Improper Validation of Integrity Check Value
In WIFI Firmware, there is a possible system crash due to a missing count check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06468894; Issue ID: ALPS
- 8.8 High severity
MT6761, MT6762, MT6765, MT6768, MT6769…: Use After Free
In WIFI Firmware, there is a possible memory corruption due to a use after free. This could lead to remote escalation of privilege, when devices are connecting to the attacker-controllable Wi-Fi hotspot, with no additional execution privileges needed. User int
- 7.8 High severity
MT6580, MT6735, MT6737, MT6739, MT6750…: Integer Overflow or Wraparound
In ion, there is a possible use after free due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06371108; Issue ID: ALPS06371
- 8.4 High severity
MT6580, MT6735, MT6737, MT6739, MT6750…: Improper Handling of Exceptional Conditions
In ion, there is a possible use after free due to incorrect error handling. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06366069; Issue ID: ALPS
- 7.1 High severity
Improper validation of removing package name in Galaxy Themes prior to SMR May-2022 Release 1…
Improper validation of removing package name in Galaxy Themes prior to SMR May-2022 Release 1 allows attackers to uninstall arbitrary packages without permission. The patch adds proper validation logic for removing package name.
- 7.0 High severity
MT6580, MT6735, MT6737, MT6739, MT6750…: Time-of-check Time-of-use (TOCTOU) Race Condition
In ion, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06399915; Issue ID: ALPS06399901
- 7.8 High severity
MT6580, MT6739, MT6761, MT6762, MT6765…: Out-of-bounds Write
In aee daemon, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06296442; Issue ID
- 7.8 High severity
MT6731, MT6732, MT6735, MT6737, MT6739…: Missing Authorization
In telephony, there is a possible way to disable receiving SMS messages due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch I
- 7.8 High severity
MT6580, MT6731, MT6739, MT6761, MT6762…: Improper Handling of Exceptional Conditions
In aee driver, there is a possible reference count mistake due to incorrect error handling. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06209201; Issue
- 7.8 High severity
MT6731, MT6732, MT6735, MT6737, MT6739…: Missing Authorization
In telephony, there is a possible way to disable receiving emergency broadcasts due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- 7.5 High severity
com.google.code.gson:gson: Deserialization of Untrusted Data
The package com.google.code.gson:gson before 2.8.9 are vulnerable to Deserialization of Untrusted Data via the writeReplace() method in internal classes, which may lead to DoS attacks.
- 7.8 High severity
Samsung Mobile Devices: Improper Limitation of a Pathname to a Restricted Directory
Improper access control and path traversal vulnerability in Storage Manager and Storage Manager Service prior to SMR Apr-2022 Release 1 allow local attackers to access arbitrary system files without a proper permission. The patch adds proper validation logic t
- 7.0 High severity
Samsung Mobile Devices: Use After Free
Use after free vulnerability in dsp_context_unload_graph function of DSP driver prior to SMR Apr-2022 Release 1 allows attackers to perform malicious actions.
- 7.1 High severity
Samsung Mobile Devices: Out-of-bounds Read
Improper size check in sapefd_parse_meta_HEADER function of libsapeextractor library prior to SMR Apr-2022 Release 1 allows out of bounds read via a crafted media file.
- 7.1 High severity
Samsung Mobile Devices: Out-of-bounds Read
Improper size check of in sapefd_parse_meta_DESCRIPTION function of libsapeextractor library prior to SMR Apr-2022 Release 1 allows out of bounds read via a crafted media file
- 7.1 High severity
Samsung Mobile Devices: Out-of-bounds Read
Improper size check in sapefd_parse_meta_HEADER_old function of libsapeextractor library prior to SMR Apr-2022 Release 1 allows out of bounds read via a crafted media file.
- 7.2 High severity
Samsung Mobile Devices: Out-of-bounds Write
Improper input validation vulnerability in parser_iloc and sheifd_find_itemIndexin fuctions of libsimba library prior to SMR Apr-2022 Release 1 allows out of bounds write by privileged attacker.
- 7.2 High severity
Samsung Mobile Devices: Out-of-bounds Write
Improper input validation vulnerability in parser_infe and sheifd_find_itemIndexin fuctions of libsimba library prior to SMR Apr-2022 Release 1 allows out of bounds write by privileged attackers.
- 9.8 Critical severity
Samsung Mobile Devices: Out-of-bounds Write
Heap-based buffer overflow vulnerability in parser_ipma function of libsimba library prior to SMR Apr-2022 Release 1 allows code execution by remote attackers.