Google vulnerabilities
We track 4,264 vulnerabilities in Google products across 60+ products. 4,254 are rated high or critical, and 93 have been exploited in real attacks. The most recent was published on November 11, 2026.
Latest Google vulnerabilities
- 8.1 High severity
Web Stories: Server-Side Request Forgery
The Web Stories plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including 1.24.0 due to insufficient validation of URLs supplied via the 'url' parameter found via the /v1/hotlink/proxy REST API Endpoint. This makes it p
- 9.8 Critical severity
The implementation of backslash parsing in the Dart URI class for versions prior to 2.18 and…
The implementation of backslash parsing in the Dart URI class for versions prior to 2.18 and Flutter versions prior to 3.30 differs from the WhatWG URL standards. Dart uses the RFC 3986 syntax, which creates incompatibilities with the '\' characters in URIs, w
- 7.3 High severity
Drive for Desktop MacOS: Improper Privilege Management
An attacker can pre-create the `/Applications/Google\ Drive.app/Contents/MacOS` directory which is expected to be owned by root to be owned by a non-root user. When the Drive for Desktop installer is run for the first time, it will place a binary in that direc
- 7.8 High severity
SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T61…: Missing Authorization
In Music service, there is a missing permission check. This could lead to elevation of privilege in Music service with no additional execution privileges needed.
- 7.8 High severity
SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T61…: Missing Authorization
In Music service, there is a missing permission check. This could lead to elevation of privilege in Music service with no additional execution privileges needed.
- 7.8 High severity
SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T61…: Missing Authorization
In Music service, there is a missing permission check. This could lead to elevation of privilege in Music service with no additional execution privileges needed.
- 7.8 High severity
SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T61…: Missing Authorization
In Music service, there is a missing permission check. This could lead to elevation of privilege in Music service with no additional execution privileges needed.
- 7.8 High severity
SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T61…: Missing Authorization
In Soundrecorder service, there is a missing permission check. This could lead to elevation of privilege in Soundrecorder service with no additional execution privileges needed.
- 7.8 High severity
SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T61…: Missing Authorization
In messaging service, there is a missing permission check. This could lead to elevation of privilege in contacts service with no additional execution privileges needed.
- 7.8 High severity
SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T61…: Missing Authorization
In messaging service, there is a missing permission check. This could lead to elevation of privilege in contacts service with no additional execution privileges needed.
- 7.8 High severity
SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T61…: Missing Authorization
In soundrecorder service, there is a missing permission check. This could lead to elevation of privilege in contacts service with no additional execution privileges needed.
- 7.8 High severity
SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T61…: Missing Authorization
In soundrecorder service, there is a missing permission check. This could lead to elevation of privilege in contacts service with no additional execution privileges needed.
- 7.8 High severity
SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T61…: Missing Authorization
In music service, there is a missing permission check. This could lead to elevation of privilege in contacts service with no additional execution privileges needed.
- 7.5 High severity
A parsing issue with binary data in protobuf-java core and lite versions prior to 3.21.7…
A parsing issue with binary data in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 can lead to a denial of service attack. Inputs containing multiple instances of non-repeated embedded messages with repeated or unknown fields c
- 7.5 High severity
In ril, there is a possible system crash due to an incorrect bounds check.
In ril, there is a possible system crash due to an incorrect bounds check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07257259; Issue ID: ALPS072572
- 7.5 High severity
MT6761, MT6762, MT6765, MT6768, MT6779…: Improper Resource Shutdown or Release
In Wi-Fi driver, there is a possible way to disconnect Wi-Fi due to an improper resource release. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS0703060
- 7.8 High severity
MT6739, MT6761, MT6762, MT6763, MT6765…: Deserialization of Untrusted Data
In ims, there is a possible escalation of privilege due to a parcel format mismatch. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07319095; Issue
- 7.8 High severity
MT6580, MT6739, MT6761, MT6765, MT6768…: Deserialization of Untrusted Data
In telephony, there is a possible escalation of privilege due to a parcel format mismatch. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07319121;
- 7.8 High severity
Samsung Mobile Devices: Out-of-bounds Write
A heap-based overflow vulnerability in makeContactAGIF in libagifencoder.quram.so library prior to SMR Oct-2022 Release 1 allows attacker to perform code execution.
- 8.8 High severity
Chrome: Out-of-bounds Write
Heap buffer overflow in Internals in Google Chrome prior to 105.0.5195.125 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
- 8.8 High severity
Chrome: Use After Free
Use after free in Frames in Google Chrome prior to 105.0.5195.125 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
- 8.8 High severity
Chrome: Use After Free
Use after free in PDF in Google Chrome prior to 105.0.5195.125 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file. (Chromium security severity: High)
- 8.8 High severity
Chrome: Use After Free
Use after free in PDF in Google Chrome prior to 105.0.5195.125 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file. (Chromium security severity: High)
- 8.8 High severity
Chrome: Use After Free
Use after free in PDF in Google Chrome prior to 105.0.5195.125 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file. (Chromium security severity: High)
- 8.8 High severity
Chrome: Out-of-bounds Write
Out of bounds write in Storage in Google Chrome prior to 105.0.5195.125 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: High)
- 9.6 Critical severity
Google Chromium Mojo Insufficient Data Validation Exploited
Insufficient data validation in Mojo in Google Chrome prior to 105.0.5195.102 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
- 8.8 High severity
Chrome: Concurrent Execution using Shared Resource with Improper Synchronization
Use after free in Tab Strip in Google Chrome on Chrome OS, Lacros prior to 105.0.5195.52 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption via crafted UI interaction.
- 8.8 High severity
Chrome: Use After Free
Use after free in Sign-In Flow in Google Chrome prior to 105.0.5195.52 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption via crafted UI interaction.
- 8.8 High severity
Chrome: Use After Free
Use after free in Passwords in Google Chrome prior to 105.0.5195.52 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption via a crafted HTML page.
- 8.8 High severity
Chrome: Out-of-bounds Write
Heap buffer overflow in Window Manager in Google Chrome on Chrome OS, Lacros prior to 105.0.5195.52 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption via crafted UI interactions.
- 8.8 High severity
Chrome: Out-of-bounds Write
Heap buffer overflow in Exosphere in Google Chrome on Chrome OS, Lacros prior to 105.0.5195.52 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption via crafted UI interactions.
- 8.8 High severity
Chrome: Out-of-bounds Write
Heap buffer overflow in WebUI in Google Chrome on Chrome OS prior to 105.0.5195.52 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption via crafted UI interactions.
- 8.8 High severity
Chrome: Concurrent Execution using Shared Resource with Improper Synchronization
Use after free in SplitScreen in Google Chrome on Chrome OS, Lacros prior to 105.0.5195.52 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption via a crafted HTML page.
- 8.8 High severity
Chrome: Use After Free
Use after free in Browser Tag in Google Chrome prior to 105.0.5195.52 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page.
- 8.8 High severity
Chrome: Out-of-bounds Write
Insufficient validation of untrusted input in V8 in Google Chrome prior to 105.0.5195.52 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- 8.8 High severity
Chrome: Out-of-bounds Write
Heap buffer overflow in Screen Capture in Google Chrome on Chrome OS prior to 105.0.5195.52 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption via a crafted HTML page.
- 8.8 High severity
Chrome: Concurrent Execution using Shared Resource with Improper Synchronization
Use after free in PhoneHub in Google Chrome on Chrome OS prior to 105.0.5195.52 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- 8.8 High severity
Chrome: Use After Free
Use after free in WebSQL in Google Chrome prior to 105.0.5195.52 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- 8.8 High severity
Chrome: Out-of-bounds Write
Use after free in Layout in Google Chrome prior to 105.0.5195.52 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- 8.8 High severity
Chrome: Use After Free
Use after free in WebSQL in Google Chrome prior to 105.0.5195.52 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.