Google vulnerabilities
We track 4,264 vulnerabilities in Google products across 60+ products. 4,254 are rated high or critical, and 93 have been exploited in real attacks. The most recent was published on November 11, 2026.
Latest Google vulnerabilities
- 7.8 High severity
Android: Improper Privilege Management
In updateList of NotificationAccessSettings.java, there is a possible way to hide approved notification listeners in the settings due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed.
- 7.8 High severity
Android: Use After Free
In bta_av_rc_msg of bta_av_act.cc, there is a possible use after free due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- 7.8 High severity
Android: Missing Authorization
In multiple files, there is a possible way to import a contact from another user due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation
- 8.8 High severity
Android: Use After Free
In gatt_process_prep_write_rsp of gatt_cl.cc, there is a possible privilege escalation due to a use after free. This could lead to remote (proximal/adjacent) code execution with no additional execution privileges needed. User interaction is not needed for expl
- 8.8 High severity
Chrome: Use After Free
Use after free in Networks in Google Chrome prior to 116.0.5845.179 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
- 8.8 High severity
Google Chromium V8 Type Confusion Exploited
Type Confusion in V8 in Google Chrome prior to 116.0.5845.179 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)
- 8.1 High severity
Chrome: Out-of-bounds Read
Out of bounds memory access in FedCM in Google Chrome prior to 116.0.5845.179 allowed a remote attacker who had compromised the renderer process to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: High)
- 7.8 High severity
SC7731E/SC9832E/SC9863A/T606/T612/T616/T610/T618: Missing Authorization
In vowifiservice, there is a possible missing permission check.This could lead to local escalation of privilege with no additional execution privileges
- 7.8 High severity
SC7731E/SC9832E/SC9863A/T606/T612/T616/T610/T618: Missing Authorization
In vowifiservice, there is a possible missing permission check.This could lead to local escalation of privilege with no additional execution privileges
- 7.8 High severity
SC7731E/SC9832E/SC9863A/T606/T612/T616/T610/T618: Missing Authorization
In vowifiservice, there is a possible missing permission check.This could lead to local escalation of privilege with no additional execution privileges
- 7.8 High severity
SC7731E/SC9832E/SC9863A/T606/T612/T616/T610/T618: Missing Authorization
In vowifiservice, there is a possible missing permission check.This could lead to local escalation of privilege with no additional execution privileges
- 7.8 High severity
SC7731E/SC9832E/SC9863A/T606/T612/T616/T610/T618: Missing Authorization
In vowifiservice, there is a possible missing permission check.This could lead to local escalation of privilege with no additional execution privileges
- 7.8 High severity
SC7731E/SC9832E/SC9863A/T606/T612/T616/T610/T618: Missing Authorization
In vowifiservice, there is a possible missing permission check.This could lead to local escalation of privilege with no additional execution privileges
- 7.8 High severity
SC7731E/SC9832E/SC9863A/T606/T612/T616/T610/T618: Missing Authorization
In vowifiservice, there is a possible missing permission check.This could lead to local escalation of privilege with no additional execution privileges
- 7.8 High severity
SC7731E/SC9832E/SC9863A/T606/T612/T616/T610/T618: Missing Authorization
In vowifiservice, there is a possible missing permission check.This could lead to local escalation of privilege with no additional execution privileges
- 7.8 High severity
SC7731E/SC9832E/SC9863A/T606/T612/T616/T610/T618: Missing Authorization
In vowifiservice, there is a possible missing permission check.This could lead to local escalation of privilege with no additional execution privileges
- 7.8 High severity
SC9832E/SC9863A/T606/T612/T616/T610/T618: Missing Authorization
In vowifiservice, there is a possible missing permission check.This could lead to local escalation of privilege with no additional execution privileges
- 7.8 High severity
SC7731E/SC9832E/SC9863A/T606/T612/T616/T610/T618: Missing Authorization
In vowifiservice, there is a possible missing permission check.This could lead to local escalation of privilege with no additional execution privileges
- 7.8 High severity
SC7731E/SC9832E/SC9863A/T606/T612/T616/T610/T618: Missing Authorization
In vowifiservice, there is a possible missing permission check.This could lead to local escalation of privilege with no additional execution privileges
- 7.8 High severity
SC7731E/SC9832E/SC9863A/T606/T612/T616/T610/T618: Missing Authorization
In vowifiservice, there is a possible missing permission check.This could lead to local escalation of privilege with no additional execution privileges
- 7.5 High severity
T760/T770/T820/S8000: Missing Authorization
In LTE protocol stack, there is a possible missing permission check. This could lead to remote information disclosure no additional execution privileges needed
- 7.5 High severity
In NIA0 algorithm in Security Mode Command, there is a possible missing verification incorrect…
In NIA0 algorithm in Security Mode Command, there is a possible missing verification incorrect input. This could lead to remote information disclosure no additional execution privileges needed
- 8.8 High severity
Chrome: Use After Free
Use after free in MediaStream in Google Chrome prior to 116.0.5845.140 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
- 8.1 High severity
Chrome: Out-of-bounds Read
Out of bounds memory access in Fonts in Google Chrome prior to 116.0.5845.110 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: Medium)
- 8.8 High severity
Chrome: Use After Free
Use after free in Vulkan in Google Chrome prior to 116.0.5845.110 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
- 8.8 High severity
Chrome: Use After Free
Use after free in Loader in Google Chrome prior to 116.0.5845.110 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
- 8.1 High severity
Chrome: Out-of-bounds Read
Out of bounds memory access in CSS in Google Chrome prior to 116.0.5845.110 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: High)
- 8.1 High severity
Chrome: Out-of-bounds Read
Out of bounds memory access in V8 in Google Chrome prior to 116.0.5845.110 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: High)
- 8.8 High severity
Chrome: Use After Free
Use after free in Extensions in Google Chrome prior to 116.0.5845.96 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)
- 8.8 High severity
Chrome: Out-of-bounds Write
Heap buffer overflow in Mojom IDL in Google Chrome prior to 116.0.5845.96 allowed a remote attacker who had compromised the renderer process and gained control of a WebUI process to potentially exploit heap corruption via a crafted HTML page. (Chromium securit
- 8.8 High severity
Chrome: Use After Free
Use after free in DNS in Google Chrome prior to 116.0.5845.96 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)
- 8.8 High severity
Insufficient validation of untrusted input in XML in Google Chrome prior to 116.0.5845.96…
Insufficient validation of untrusted input in XML in Google Chrome prior to 116.0.5845.96 allowed a remote attacker to bypass file access restrictions via a crafted HTML page. (Chromium security severity: Medium)
- 8.8 High severity
Chrome: Use After Free
Use after free in Audio in Google Chrome prior to 116.0.5845.96 allowed a remote attacker who has convinced a user to engage in specific UI interaction to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)
- 8.8 High severity
Chrome: Out-of-bounds Write
Out of bounds memory access in V8 in Google Chrome prior to 116.0.5845.96 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
- 8.8 High severity
Chrome: Out-of-bounds Write
Heap buffer overflow in Skia in Google Chrome prior to 116.0.5845.96 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
- 8.8 High severity
Chrome: Out-of-bounds Write
Heap buffer overflow in ANGLE in Google Chrome prior to 116.0.5845.96 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
- 8.8 High severity
Chrome: Access of Resource Using Incompatible Type
Type confusion in V8 in Google Chrome prior to 116.0.5845.96 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
- 8.8 High severity
Chrome: Use After Free
Use after free in Network in Google Chrome prior to 116.0.5845.96 allowed a remote attacker who has elicited a browser shutdown to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
- 8.8 High severity
Chrome: Use After Free
Use after free in Device Trust Connectors in Google Chrome prior to 116.0.5845.96 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
- 8.8 High severity
Chrome: Use After Free
Use after free in Offline in Google Chrome on Android prior to 116.0.5845.96 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)