Page 30 of 100 — Google CVEs from a corpus of 15879, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-8879 | High | 8.8 | 2025-08-13 | Heap buffer overflow in libaom in Google Chrome prior to 139.0.7258.127 allowed a remote attacker to potentially exploit heap corruption via a curated set of g… |
CVE-2025-8747 | High | 7.8 | 2025-08-11 | A safe mode bypass vulnerability in the `Model.load_model` method in Keras versions 3.0.0 through 3.10.0 allows an attacker to achieve arbitrary code execution… |
CVE-2025-8583 | Medium | 4.3 | 2025-08-07 | Inappropriate implementation in Permissions in Google Chrome prior to 139.0.7258.66 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (… |
CVE-2025-8582 | Medium | 4.3 | 2025-08-07 | Insufficient validation of untrusted input in Core in Google Chrome prior to 139.0.7258.66 allowed a remote attacker to spoof the contents of the Omnibox (URL… |
CVE-2025-8581 | Medium | 4.3 | 2025-08-07 | Inappropriate implementation in Extensions in Google Chrome prior to 139.0.7258.66 allowed a remote attacker who convinced a user to engage in specific UI gest… |
CVE-2025-8580 | Medium | 4.3 | 2025-08-07 | Inappropriate implementation in Filesystems in Google Chrome prior to 139.0.7258.66 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (… |
CVE-2025-8579 | Medium | 4.3 | 2025-08-07 | Inappropriate implementation in Picture In Picture in Google Chrome prior to 139.0.7258.66 allowed a remote attacker who convinced a user to engage in specific… |
CVE-2025-8578 | High | 8.8 | 2025-08-07 | Use after free in Cast in Google Chrome prior to 139.0.7258.66 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chrom… |
CVE-2025-8577 | Medium | 4.3 | 2025-08-07 | Inappropriate implementation in Picture In Picture in Google Chrome prior to 139.0.7258.66 allowed a remote attacker who convinced a user to engage in specific… |
CVE-2025-8576 | High | 8.8 | 2025-08-07 | Use after free in Extensions in Google Chrome prior to 139.0.7258.66 allowed a remote attacker to potentially exploit heap corruption via a crafted Chrome Exte… |
CVE-2025-21024 | Low | 3.3 | 2025-08-06 | Use of Implicit Intent for Sensitive Communication in Smart View prior to Android 16 allows local attackers to access sensitive information. |
CVE-2025-20698 | Medium | 6.7 | 2025-08-04 | In Power HAL, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has… |
CVE-2025-20697 | Medium | 6.7 | 2025-08-04 | In Power HAL, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has… |
CVE-2025-20696 | Medium | 6.8 | 2025-08-04 | In DA, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege, if an attacker has physical acc… |
CVE-2025-45769 | Medium | 6.5 | 2025-07-31 | php-jwt v6.11.0 was discovered to contain weak encryption. NOTE: this issue has been disputed on the basis that key lengths are expected to be set by an applic… |
CVE-2025-8292 | High | 8.8 | 2025-07-30 | Use after free in Media Stream in Google Chrome prior to 138.0.7204.183 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML pag… |
CVE-2025-8011 | High | 8.8 | 2025-07-22 | Type Confusion in V8 in Google Chrome prior to 138.0.7204.168 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromi… |
CVE-2025-8010 | High | 8.8 | 2025-07-22 | Type Confusion in V8 in Google Chrome prior to 138.0.7204.168 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromi… |
CVE-2025-7657 | High | 8.8 | 2025-07-15 | Use after free in WebRTC in Google Chrome prior to 138.0.7204.157 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Ch… |
CVE-2025-7656 | High | 8.8 | 2025-07-15 | Integer overflow in V8 in Google Chrome prior to 138.0.7204.157 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chro… |
CVE-2025-6558 | High | 8.8 | 2025-07-15 | Insufficient validation of untrusted input in ANGLE and GPU in Google Chrome prior to 138.0.7204.157 allowed a remote attacker to potentially perform a sandbox… |
CVE-2025-20695 | Medium | 6.5 | 2025-07-08 | In Bluetooth FW, there is a possible system crash due to an uncaught exception. This could lead to remote denial of service with no additional execution privil… |
CVE-2025-20694 | Medium | 6.5 | 2025-07-08 | In Bluetooth FW, there is a possible system crash due to an uncaught exception. This could lead to remote denial of service with no additional execution privil… |
CVE-2025-20693 | Medium | 6.5 | 2025-07-08 | In wlan STA driver, there is a possible out of bounds read due to an incorrect bounds check. This could lead to remote (proximal/adjacent) information disclosu… |
CVE-2025-6044 | Medium | 6.1 | 2025-07-07 | An Improper Access Control vulnerability in the Stylus Tools component of Google ChromeOS version 16238.64.0 on the garaged stylus devices allows a physical at… |
CVE-2025-6554 | High | 8.1 | 2025-06-30 | Type confusion in V8 in Google Chrome prior to 138.0.7204.96 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. (Chromium secur… |
CVE-2025-46708 | Medium | 4.3 | 2025-06-27 | Software installed and running inside a Guest VM may conduct improper GPU system calls to prevent other Guests from running work on the GPU. |
CVE-2025-46707 | Medium | 5.2 | 2025-06-27 | Software installed and running inside a Guest VM may override Firmware's state and gain access to the GPU. |
CVE-2025-6557 | Medium | 5.4 | 2025-06-24 | Insufficient data validation in DevTools in Google Chrome on Windows prior to 138.0.7204.49 allowed a remote attacker who convinced a user to engage in specifi… |
CVE-2025-6556 | Medium | 5.4 | 2025-06-24 | Insufficient policy enforcement in Loader in Google Chrome prior to 138.0.7204.49 allowed a remote attacker to bypass content security policy via a crafted HTM… |
CVE-2025-6555 | Medium | 5.4 | 2025-06-24 | Use after free in Animation in Google Chrome prior to 138.0.7204.49 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (… |
CVE-2025-6431 | Medium | 6.5 | 2025-06-24 | When a link can be opened in an external application, Firefox for Android will, by default, prompt the user before doing so. An attacker could have bypassed th… |
CVE-2025-6428 | Medium | 4.3 | 2025-06-24 | When a URL was provided in a link querystring parameter, Firefox for Android would follow that URL instead of the correct URL, potentially leading to phishing… |
CVE-2025-6192 | High | 8.8 | 2025-06-18 | Use after free in Metrics in Google Chrome prior to 137.0.7151.119 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (C… |
CVE-2025-6191 | High | 8.8 | 2025-06-18 | Integer overflow in V8 in Google Chrome prior to 137.0.7151.119 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML… |
CVE-2025-5981 | Medium | 6.5 | 2025-06-18 | Arbitrary file write as the OSV-SCALIBR user on the host system via a path traversal vulnerability when using OSV-SCALIBR's unpack() function for container ima… |
CVE-2025-6179 | Critical | 9.8 | 2025-06-16 | Permissions Bypass in Extension Management in Google ChromeOS 16181.27.0 on managed Chrome devices allows a local attacker to disable extensions and ac… |
CVE-2025-6177 | High | 7.4 | 2025-06-16 | Privilege Escalation in MiniOS in Google ChromeOS (16063.45.2 and potentially others) on enrolled devices allows a local attacker to gain root code execution v… |
CVE-2025-4565 | Medium | 5.3 | 2025-06-16 | Any project that uses Protobuf Pure-Python backend to parse untrusted Protocol Buffers data containing an arbitrary number of recursive groups, recursive messa… |
CVE-2025-4613 | High | 8.8 | 2025-06-12 | Path traversal in Google Web Designer's template handling versions prior to 16.3.0.0407 on Windows allows attacker to achieve remote code execution by tricking… |
CVE-2025-5959 | High | 8.8 | 2025-06-11 | Type Confusion in V8 in Google Chrome prior to 137.0.7151.103 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Ch… |
CVE-2025-5958 | High | 8.8 | 2025-06-11 | Use after free in Media in Google Chrome prior to 137.0.7151.103 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chr… |
CVE-2025-2336 | Medium | 4.8 | 2025-06-04 | Improper sanitization of the value of the 'href' and 'xlink:href' attributes in '<image>' SVG elements in AngularJS's 'ngSanitize' module allows attackers to b… |
CVE-2025-31712 | Medium | 5.1 | 2025-06-03 | In cplog service, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with no additional executio… |
CVE-2025-31711 | Medium | 5.1 | 2025-06-03 | In cplog service, there is a possible system crash due to null pointer dereference. This could lead to local denial of service with no additional execution pri… |
CVE-2025-31710 | Medium | 5.9 | 2025-06-03 | In engineermode service, there is a possible command injection due to improper input validation. This could lead to local escalation of privilege with no addit… |
CVE-2025-5419 | High | 8.8 | 2025-06-03 | Out of bounds read and write in V8 in Google Chrome prior to 137.0.7151.68 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML… |
CVE-2025-5068 | High | 8.8 | 2025-06-03 | Use after free in Blink in Google Chrome prior to 137.0.7151.68 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chro… |
CVE-2025-5283 | Medium | 5.4 | 2025-05-27 | Use after free in libvpx in Google Chrome prior to 137.0.7151.55 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chr… |
CVE-2025-5281 | Medium | 5.4 | 2025-05-27 | Inappropriate implementation in BFCache in Google Chrome prior to 137.0.7151.55 allowed a remote attacker to potentially obtain user information via a crafted… |
CVE-2025-5280 | High | 8.8 | 2025-05-27 | Out of bounds write in V8 in Google Chrome prior to 137.0.7151.55 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Ch… |
CVE-2025-5067 | Medium | 5.4 | 2025-05-27 | Inappropriate implementation in Tab Strip in Google Chrome prior to 137.0.7151.55 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Ch… |
CVE-2025-5066 | Medium | 6.5 | 2025-05-27 | Inappropriate implementation in Messages in Google Chrome on Android prior to 137.0.7151.55 allowed a remote attacker who convinced a user to engage in specifi… |
CVE-2025-5065 | Medium | 6.5 | 2025-05-27 | Inappropriate implementation in FileSystemAccess API in Google Chrome prior to 137.0.7151.55 allowed a remote attacker to perform UI spoofing via a crafted HTM… |
CVE-2025-5064 | Medium | 5.4 | 2025-05-27 | Inappropriate implementation in Background Fetch API in Google Chrome prior to 137.0.7151.55 allowed a remote attacker to leak cross-origin data via a crafted… |
CVE-2025-5063 | High | 8.8 | 2025-05-27 | Use after free in Compositing in Google Chrome prior to 137.0.7151.55 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page… |
CVE-2025-27701 | Medium | 5.5 | 2025-05-27 | In the function process_crypto_cmd, the values of ptrs[i] can be potentially equal to NULL which is valid value after calling slice_map_array(). Later this val… |
CVE-2025-27700 | High | 8.4 | 2025-05-27 | There is a possible bypass of carrier restrictions due to an unusual root cause. This could lead to local escalation of privilege with no additional execution… |
CVE-2024-56193 | Medium | 5.1 | 2025-05-27 | There is a possible disclosure of Bluetooth adapter details due to a permissions bypass. This could lead to local information disclosure with no additional exe… |
CVE-2021-25262 | Medium | 5.4 | 2025-05-21 | Yandex Browser for Android prior to version 21.3.0 allows remote attackers to perform IDN homograph attack. |
CVE-2025-4600 | High | 7.5 | 2025-05-16 | A request smuggling vulnerability existed in the Google Cloud Classic Application Load Balancer due to improper handling of chunked-encoded HTTP requests. This… |
CVE-2025-4664 | Medium | 4.3 | 2025-05-14 | Insufficient policy enforcement in Loader in Google Chrome prior to 136.0.7103.113 allowed a remote attacker to leak cross-origin data via a crafted HTML page… |
CVE-2025-1079 | High | 7.8 | 2025-05-12 | Client RCE on macOS and Linux via improper symbolic link resolution in Google Web Designer's preview feature |
CVE-2025-20980 | Medium | 4.0 | 2025-05-07 | Out-of-bounds write in libsavscmn prior to Android 15 allows local attackers to cause memory corruption. |
CVE-2025-20979 | High | 8.4 | 2025-05-07 | Out-of-bounds write in libsavscmn prior to Android 15 allows local attackers to execute arbitrary code. |
CVE-2025-4372 | High | 8.8 | 2025-05-06 | Use after free in WebAudio in Google Chrome prior to 136.0.7103.92 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (C… |
CVE-2025-0649 | High | 7.5 | 2025-05-06 | Incorrect JSON input stringification in Google's Tensorflow serving versions up to 2.18.0 allows for potentially unbounded recursion leading to server crash. |
CVE-2025-2509 | High | 7.8 | 2025-05-06 | Out-of-Bounds Read in Virglrenderer in ChromeOS 16093.57.0 allows a malicious guest VM to achieve arbitrary address access within the crosvm sandboxed process… |
CVE-2025-4096 | High | 8.8 | 2025-05-05 | Heap buffer overflow in HTML in Google Chrome prior to 136.0.7103.59 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page… |
CVE-2025-4052 | Critical | 9.8 | 2025-05-05 | Inappropriate implementation in DevTools in Google Chrome prior to 136.0.7103.59 allowed a remote attacker who convinced a user to engage in specific UI gestur… |
CVE-2025-4051 | Medium | 6.3 | 2025-05-05 | Insufficient data validation in DevTools in Google Chrome prior to 136.0.7103.59 allowed a remote attacker who convinced a user to engage in specific UI gestur… |
CVE-2025-4050 | High | 8.8 | 2025-05-05 | Out of bounds memory access in DevTools in Google Chrome prior to 136.0.7103.59 allowed a remote attacker who convinced a user to engage in specific UI gesture… |
CVE-2025-20671 | High | 7.0 | 2025-05-05 | In thermal, there is a possible out of bounds write due to a race condition. This could lead to local escalation of privilege if a malicious actor has already… |
CVE-2025-20668 | High | 7.8 | 2025-05-05 | In scp, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has alread… |
CVE-2025-20665 | Medium | 5.5 | 2025-05-05 | In devinfo, there is a possible information disclosure due to a missing SELinux policy. This could lead to local information disclosure of device identifier wi… |
CVE-2025-0716 | Medium | 4.8 | 2025-04-29 | Improper sanitization of the value of the 'href' and 'xlink:href' attributes in '<image>' SVG elements in AngularJS allows attackers to bypass common image sou… |
CVE-2025-1290 | High | 8.1 | 2025-04-17 | A race condition Use-After-Free vulnerability exists in the virtio_transport_space_update function within the Kernel 5.4 on ChromeOS. Concurrent allocation and… |
CVE-2025-2073 | High | 8.8 | 2025-04-16 | Out-of-Bounds Read in netfilter/ipset in Linux Kernel ChromeOS [6.1, 5.15, 5.10, 5.4, 4.19] allows a local attacker with low privileges to trigger an out-of-bo… |
CVE-2025-1704 | Medium | 6.5 | 2025-04-16 | ComponentInstaller Modification in ComponentInstaller in Google ChromeOS 15823.23.0 on Chromebooks allows enrolled users with local access to unenroll devices… |
CVE-2025-1568 | High | 8.8 | 2025-04-16 | Access Control Vulnerability in Gerrit chromiumos project configuration in Google ChromeOS 16063.87.0 allows an attacker with a registered Gerrit account to in… |
CVE-2025-1566 | High | 7.5 | 2025-04-16 | DNS Leak in Native System VPN in Google ChromeOS Dev Channel on ChromeOS 16002.23.0 allows network observers to expose plaintext DNS queries via failure to pro… |
CVE-2025-3620 | High | 8.8 | 2025-04-16 | Use after free in USB in Google Chrome prior to 135.0.7049.95 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromi… |
CVE-2025-3619 | High | 8.8 | 2025-04-16 | Heap buffer overflow in Codecs in Google Chrome on Windows prior to 135.0.7049.95 allowed a remote attacker to potentially exploit heap corruption via a crafte… |
CVE-2025-1292 | Medium | 6.7 | 2025-04-15 | Out-Of-Bounds Write in TPM2 Reference Library in Google ChromeOS 122.0.6261.132 stable on Cr50 Boards allows an attacker with root access to gain persistence… |
CVE-2025-1122 | Medium | 6.7 | 2025-04-15 | Out-Of-Bounds Write in TPM2 Reference Library in Google ChromeOS 15753.50.0 stable on Cr50 Boards allows an attacker with root access to gain persistence and… |
CVE-2025-20662 | Medium | 6.7 | 2025-04-07 | In PlayReady TA, there is a possible out of bounds read due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor ha… |
CVE-2025-20661 | Medium | 6.7 | 2025-04-07 | In PlayReady TA, there is a possible out of bounds read due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor ha… |
CVE-2025-20660 | Medium | 6.7 | 2025-04-07 | In PlayReady TA, there is a possible out of bounds read due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor ha… |
CVE-2025-20658 | Medium | 6.0 | 2025-04-07 | In DA, there is a possible permission bypass due to a logic error. This could lead to local escalation of privilege, if an attacker has physical access to the… |
CVE-2025-20657 | Medium | 6.7 | 2025-04-07 | In vdec, there is a possible permission bypass due to improper input validation. This could lead to local escalation of privilege if a malicious actor has alre… |
CVE-2025-20656 | Medium | 6.8 | 2025-04-07 | In DA, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege, if an attacker has physical acc… |
CVE-2025-20655 | Medium | 5.3 | 2025-04-07 | In keymaster, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure if a malicious actor has al… |
CVE-2025-3074 | Medium | 5.4 | 2025-04-02 | Inappropriate implementation in Downloads in Google Chrome prior to 135.0.7049.52 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Ch… |
CVE-2025-3073 | Medium | 5.4 | 2025-04-02 | Inappropriate implementation in Autofill in Google Chrome prior to 135.0.7049.52 allowed a remote attacker who convinced a user to engage in specific UI gestur… |
CVE-2025-3072 | Medium | 5.4 | 2025-04-02 | Inappropriate implementation in Custom Tabs in Google Chrome prior to 135.0.7049.52 allowed a remote attacker who convinced a user to engage in specific UI ges… |
CVE-2025-3071 | Medium | 5.4 | 2025-04-02 | Inappropriate implementation in Navigations in Google Chrome prior to 135.0.7049.52 allowed a remote attacker who convinced a user to engage in specific UI ges… |
CVE-2025-3070 | Medium | 6.5 | 2025-04-02 | Insufficient validation of untrusted input in Extensions in Google Chrome prior to 135.0.7049.52 allowed a remote attacker to perform privilege escalation via… |
CVE-2025-3069 | High | 8.8 | 2025-04-02 | Inappropriate implementation in Extensions in Google Chrome prior to 135.0.7049.52 allowed a remote attacker to perform privilege escalation via a crafted HTML… |
CVE-2025-3068 | High | 8.8 | 2025-04-02 | Inappropriate implementation in Intents in Google Chrome on Android prior to 135.0.7049.52 allowed a remote attacker to perform privilege escalation via a craf… |
CVE-2025-3067 | High | 8.8 | 2025-04-02 | Inappropriate implementation in Custom Tabs in Google Chrome on Android prior to 135.0.7049.52 allowed a remote attacker who convinced a user to engage in spec… |