9302 CVEs across 291 Google products. Browse Google vulnerabilities, severities, and proof-of-concept exploits.
Google products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-19560 | High | 8.8 | 2026-08-11 | Use after free in Blink in Google Chrome prior to 151.0.7922.137 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page… |
CVE-2026-19559 | High | 8.8 | 2026-08-11 | Use after free in HTML in Google Chrome prior to 151.0.7922.137 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (… |
CVE-2026-19558 | High | 7.5 | 2026-08-11 | Use after free in Extensions in Google Chrome prior to 151.0.7922.137 allowed an attacker who convinced a user to install a malicious extension to execute arbi… |
CVE-2026-19557 | High | 8.3 | 2026-08-11 | Use after free in TabStrip in Google Chrome on Mac prior to 151.0.7922.137 allowed a remote attacker who had compromised the renderer process to potentially pe… |
CVE-2026-19556 | High | 8.8 | 2026-08-11 | Use after free in V8 in Google Chrome prior to 151.0.7922.137 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Ch… |
CVE-2026-67180 | High | 8.4 | 2026-08-11 | Google Turbinia allows arbitrary command execution via worker tasks. An attacker with privileges to submit a processing request or influence an evidence path/n… |
CVE-2026-19177 | High | 8.3 | 2026-08-06 | Insufficient validation of untrusted input in UI in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to… |
CVE-2026-19176 | High | 7.5 | 2026-08-06 | Use after free in Skia in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to execute arbitrary code in… |
CVE-2026-19175 | Critical | 9.6 | 2026-08-06 | Use after free in Payments in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page… |
CVE-2026-19174 | High | 8.8 | 2026-08-06 | Integer overflow in V8 in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (… |
CVE-2026-19173 | High | 8.3 | 2026-08-06 | Out of bounds write in Skia in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to potentially perform… |
CVE-2026-19172 | High | 8.3 | 2026-08-06 | Use after free in Views in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to potentially perform a sa… |
CVE-2026-19171 | Critical | 9.6 | 2026-08-06 | Use after free in Media in Google Chrome on Windows prior to 151.0.7922.109 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTM… |
CVE-2026-19170 | Critical | 9.6 | 2026-08-06 | Use after free in WebGL in Google Chrome on Android prior to 151.0.7922.109 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTM… |
CVE-2026-19169 | High | 8.8 | 2026-08-06 | Insufficient validation of untrusted input in Contextual Tasks in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to perform privilege escalati… |
CVE-2026-19168 | High | 8.8 | 2026-08-06 | Inappropriate implementation in V8 in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted… |
CVE-2026-19167 | Low | 3.1 | 2026-08-06 | Integer overflow in GPU in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to leak cross-origin data v… |
CVE-2026-19166 | Critical | 9.6 | 2026-08-06 | Use after free in Web Authentication in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to potentially perform a sandbox escape via a crafted H… |
CVE-2026-19165 | High | 7.5 | 2026-08-06 | Use after free in Extensions in Google Chrome prior to 151.0.7922.109 allowed an attacker who convinced a user to install a malicious extension to execute arbi… |
CVE-2026-19164 | Critical | 9.6 | 2026-08-06 | Insufficient validation of untrusted input in Codecs in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to potentially perform a sandbox escape… |
CVE-2026-19163 | High | 8.3 | 2026-08-06 | Use after free in Media in Google Chrome on Windows prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to potentially p… |
CVE-2026-19162 | High | 8.8 | 2026-08-06 | Out of bounds write in V8 in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page… |
CVE-2026-19161 | Low | 3.1 | 2026-08-06 | Uninitialized Use in Skia in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to leak cross-origin data… |
CVE-2026-19160 | Low | 3.1 | 2026-08-06 | Uninitialized Use in Skia in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to leak cross-origin data… |
CVE-2026-19159 | High | 7.5 | 2026-08-06 | Use after free in Views in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentiall… |
CVE-2026-19158 | High | 7.5 | 2026-08-06 | Use after free in Views in Google Chrome on Windows prior to 151.0.7922.109 allowed a remote attacker who convinced a user to engage in specific UI gestures to… |
CVE-2026-19157 | Critical | 9.6 | 2026-08-06 | Out of bounds write in ANGLE in Google Chrome on Android prior to 151.0.7922.109 allowed a remote attacker to potentially perform a sandbox escape via a crafte… |
CVE-2026-19156 | High | 7.5 | 2026-08-06 | Heap buffer overflow in Base in Google Chrome prior to 151.0.7922.109 allowed an attacker who convinced a user to install a malicious extension to potentially… |
CVE-2026-19155 | High | 8.3 | 2026-08-06 | Use after free in Payments in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to potentially perform a… |
CVE-2026-19154 | High | 8.3 | 2026-08-06 | Use after free in Skia in Google Chrome on Android prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to potentially pe… |
CVE-2026-19153 | High | 8.1 | 2026-08-06 | Insufficient validation of untrusted input in Workers in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer proce… |
CVE-2026-19152 | High | 8.3 | 2026-08-06 | Insufficient policy enforcement in Navigation in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to po… |
CVE-2026-19151 | High | 8.8 | 2026-08-06 | Use after free in V8 in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Ch… |
CVE-2026-19150 | High | 8.8 | 2026-08-06 | Inappropriate implementation in V8 in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted… |
CVE-2026-19149 | Critical | 9.6 | 2026-08-06 | Use after free in Aura in Google Chrome on Linux prior to 151.0.7922.109 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML p… |
CVE-2026-19148 | High | 8.3 | 2026-08-06 | Out of bounds write in GPU in Google Chrome on Linux prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to potentially… |
CVE-2026-19147 | High | 8.3 | 2026-08-06 | Use after free in Aura in Google Chrome on Linux prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to potentially perf… |
CVE-2026-19146 | Medium | 5.3 | 2026-08-06 | Uninitialized Use in GPU in Google Chrome on Android prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to obtain poten… |
CVE-2026-19145 | High | 8.8 | 2026-08-06 | Use after free in Translate in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML pa… |
CVE-2026-19144 | High | 8.8 | 2026-08-06 | Use after free in HTML in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chro… |
CVE-2026-19143 | High | 8.6 | 2026-08-06 | Insufficient validation of untrusted input in WebAPKs in Google Chrome on Android prior to 151.0.7922.109 allowed a local attacker to potentially perform a san… |
CVE-2026-19142 | High | 7.5 | 2026-08-06 | Use after free in Views in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentiall… |
CVE-2026-19141 | High | 8.3 | 2026-08-06 | Use after free in Resources in Google Chrome on Android prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to potential… |
CVE-2026-19140 | High | 8.3 | 2026-08-06 | Use after free in GPU in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to potentially perform a sand… |
CVE-2026-19139 | High | 7.4 | 2026-08-06 | Race in CredentialProvider in Google Chrome on Windows prior to 151.0.7922.109 allowed a local attacker to perform OS-level privilege escalation via a maliciou… |
CVE-2026-19138 | High | 8.3 | 2026-08-06 | Heap buffer overflow in CrashReporting in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to potential… |
CVE-2026-19137 | High | 8.3 | 2026-08-06 | Use after free in WebGL in Google Chrome on Android prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to potentially p… |
CVE-2026-0163 | Critical | 9.8 | 2026-08-04 | In multiple functions of vpu_ioctl.c, there is a possible use after free due to a use after free. This could lead to remote escalation of privilege with no add… |
CVE-2026-10032 | | 2026-08-04 | The openUrl function in @a2ui/web_core passes an agent-controlled URL directly to window.open() without validating the URI scheme. A malicious agent can supply… | |
CVE-2026-65802 | High | 7.4 | 2026-08-04 | External control of file name or path in Microsoft Edge for Android allows an unauthorized attacker to disclose information over a network. |
CVE-2026-14541 | High | 7.5 | 2026-07-31 | An authentication bypass and audience confusion vulnerability exists in the Google OAuth provider component of Google mcp-toolbox version 1.4.0. When a Google… |
CVE-2026-14540 | Medium | 6.1 | 2026-07-31 | A Server-Side Request Forgery (SSRF) vulnerability exists in the generic HTTP source and tool components of Google mcp-toolbox versions 0.3.0 through 1.4.0. Wh… |
CVE-2026-14539 | High | 7.5 | 2026-07-31 | An allocation of resources without limits vulnerability in the HTTP handler component of Google mcp-toolbox versions up to and including 1.4.0 allows an unauth… |
CVE-2026-14538 | High | 7.7 | 2026-07-31 | An improper authorization and security-boundary bypass vulnerability in the bigquery-execute-sql tool component of Google mcp-toolbox versions 0.16.1 through 1… |
CVE-2026-14537 | Critical | 9.8 | 2026-07-31 | Incorrect Authorization in the direct HTTP API tool invocation endpoint in Google mcp-toolbox versions v1.3.0 and v1.4.0 allows an unauthenticated attacker to… |
CVE-2026-18019 | Medium | 4.3 | 2026-07-30 | Side-channel information leakage in Media in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page… |
CVE-2026-18018 | Medium | 4.0 | 2026-07-30 | Inappropriate implementation in Updater in Google Chrome on Windows prior to 151.0.7922.72 allowed a local attacker to perform UI spoofing via a malicious file… |
CVE-2026-18017 | High | 8.8 | 2026-07-30 | Use after free in Dawn in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (C… |
CVE-2026-18016 | Medium | 4.3 | 2026-07-30 | Insufficient policy enforcement in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via a crafted… |
CVE-2026-18015 | Critical | 9.6 | 2026-07-30 | Inappropriate implementation in Tint in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a cra… |
CVE-2026-18014 | Medium | 6.5 | 2026-07-30 | Insufficient validation of untrusted input in DevTools in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass navigation restrictions via… |
CVE-2026-18013 | Medium | 4.3 | 2026-07-30 | Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via a crafted HT… |
CVE-2026-18012 | High | 8.8 | 2026-07-30 | Use after free in PDFium in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted PDF file. (… |
CVE-2026-18011 | Low | 2.4 | 2026-07-30 | Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a local attacker to obtain potentially sensitive informat… |
CVE-2026-18010 | Medium | 4.3 | 2026-07-30 | Inappropriate implementation in Passwords in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via malicious network traffi… |
CVE-2026-18009 | Medium | 4.3 | 2026-07-30 | Insufficient validation of untrusted input in Passwords in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via malicious… |
CVE-2026-18008 | Medium | 4.3 | 2026-07-30 | Inappropriate implementation in Settings in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via malicious network traffic… |
CVE-2026-18007 | Medium | 4.3 | 2026-07-30 | Inappropriate implementation in Input in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via a crafted HTML pa… |
CVE-2026-18006 | Medium | 4.3 | 2026-07-30 | Inappropriate implementation in Google Lens in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to perfo… |
CVE-2026-18005 | Medium | 6.5 | 2026-07-30 | Inappropriate implementation in WebXR in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to obtain potentially sensitive information from proces… |
CVE-2026-18004 | Medium | 4.3 | 2026-07-30 | Insufficient policy enforcement in Speech in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to leak cr… |
CVE-2026-18003 | Medium | 4.3 | 2026-07-30 | Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via a crafted HT… |
CVE-2026-18002 | Critical | 9.6 | 2026-07-30 | Insufficient validation of untrusted input in Google Lens in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer pr… |
CVE-2026-18001 | Medium | 6.5 | 2026-07-30 | Inappropriate implementation in WebGL in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to obtain potentially sensitive information from proces… |
CVE-2026-18000 | Low | 3.1 | 2026-07-30 | Insufficient policy enforcement in USB in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to… |
CVE-2026-17999 | Medium | 6.5 | 2026-07-30 | Race in PictureInPicture in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to perform domain spoofing via a crafted HTML page. (Chro… |
CVE-2026-17998 | Medium | 4.3 | 2026-07-30 | Incorrect security UI in Extensions in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a user to install a malicious extension to perfor… |
CVE-2026-17997 | Low | 3.1 | 2026-07-30 | Inappropriate implementation in Passwords in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to leak cr… |
CVE-2026-17996 | Medium | 6.2 | 2026-07-30 | Inappropriate implementation in Browser in Google Chrome on Mac prior to 151.0.7922.72 allowed a local attacker to bypass navigation restrictions via a malicio… |
CVE-2026-17995 | High | 8.1 | 2026-07-30 | Out of bounds read in Dawn in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (… |
CVE-2026-17994 | Medium | 4.3 | 2026-07-30 | Inappropriate implementation in Media in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to bypass navigation restrictions via a craf… |
CVE-2026-17993 | High | 7.0 | 2026-07-30 | Race in Updater in Google Chrome on Windows prior to 151.0.7922.72 allowed a local attacker to perform privilege escalation via a malicious file. (Chromium sec… |
CVE-2026-17992 | Medium | 6.5 | 2026-07-30 | Uninitialized Use in Skia in Google Chrome on Windows prior to 151.0.7922.72 allowed a remote attacker to obtain potentially sensitive information from process… |
CVE-2026-17991 | Critical | 9.6 | 2026-07-30 | Insufficient validation of untrusted input in AI in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to… |
CVE-2026-17990 | Critical | 9.6 | 2026-07-30 | Insufficient validation of untrusted input in WebAuthn in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer proce… |
CVE-2026-17989 | High | 8.8 | 2026-07-30 | Type Confusion in V8 in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chr… |
CVE-2026-17988 | Medium | 6.5 | 2026-07-30 | Insufficient validation of untrusted input in Navigation in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer pro… |
CVE-2026-17987 | Critical | 9.6 | 2026-07-30 | Insufficient validation of untrusted input in Notifications in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer… |
CVE-2026-17986 | Medium | 6.5 | 2026-07-30 | Insufficient policy enforcement in Bluetooth in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to bypa… |
CVE-2026-17985 | Medium | 6.5 | 2026-07-30 | Insufficient policy enforcement in Speech in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass site isolation via a crafted HTML page. (… |
CVE-2026-17984 | Low | 3.3 | 2026-07-30 | Inappropriate implementation in Browser in Google Chrome on Android prior to 151.0.7922.72 allowed a local attacker to leak cross-origin data via a crafted HTM… |
CVE-2026-17983 | Medium | 4.3 | 2026-07-30 | Inappropriate implementation in Global Media Controls in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via a crafted HT… |
CVE-2026-17982 | Medium | 4.3 | 2026-07-30 | Insufficient validation of untrusted input in Cast in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass same origin policy via a crafted… |
CVE-2026-17981 | Medium | 4.3 | 2026-07-30 | Inappropriate implementation in Blink in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chr… |
CVE-2026-17980 | Low | 3.1 | 2026-07-30 | Inappropriate implementation in UI in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker who convinced a user to engage in specific UI g… |
CVE-2026-17979 | High | 7.5 | 2026-07-30 | Race in V8 in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium secu… |
CVE-2026-17978 | Medium | 5.3 | 2026-07-30 | Side-channel information leakage in WebCodecs in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to obtain potentially sensitive information fro… |
CVE-2026-17977 | Medium | 4.3 | 2026-07-30 | Policy bypass in CSS in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security se… |
CVE-2026-17976 | Medium | 4.3 | 2026-07-30 | Insufficient policy enforcement in Extensions in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a user to install a malicious extension… |
CVE-2026-17975 | Medium | 6.5 | 2026-07-30 | Inappropriate implementation in IME in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker to obtain potentially sensitive information from p… |