Google vulnerabilities103 known to be exploited.
Google has 13,072 published vulnerabilities across 261 products in our catalogue. 103 of them are on the list of flaws known to be exploited, so criminals are using them now. The most affected product is Android, with 8,589. If you run Google software, patch the exploited flaws first.
The most recent Google flaw added to the known-exploited list is CVE-2026-58704, on 16 September 2026. We keep watching the known-exploited list.
Which Google vulnerabilities are being exploited?
103 flaws are on the government list of vulnerabilities known to be exploited. These are the ones criminals are using now, so they go first, whatever their severity score says.
- 8.8Google Pixel Improper Authorization Vulnerability
Google Pixel devices contain an improper authorization vulnerability in the cellular modem.
- 7.8Android Framework Information Disclosure Vulnerability
Android Framework contains an unspecified vulnerability that allows for information disclosure.
- 8.8Google Chromium V8 Type Confusion Vulnerability
Google Chromium contains a type confusion vulnerability in the V8 JavaScript and WebAssembly engine.
- 8.8Android Runtime Use-After-Free Vulnerability
Android Runtime contains a use-after-free vulnerability potentially allowing a chrome sandbox escape leading to local privilege escalation.
- 8.8Google Chromium ANGLE and GPU Improper Input Validation Vulnerability
Google Chromium contains an improper input validation vulnerability in ANGLE and GPU.
- 8.1Google Chromium V8 Type Confusion Vulnerability
Google Chromium V8 contains a type confusion vulnerability that could allow a remote attacker to perform arbitrary read/write via a crafted HTML page.
- 8.8Google Chromium V8 Out-of-Bounds Read and Write Vulnerability
Google Chromium V8 contains an out-of-bounds read and write vulnerability that could allow a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- 4.3Google Chromium Loader Insufficient Policy Enforcement Vulnerability
Google Chromium contains an insufficient policy enforcement vulnerability that allows a remote attacker to leak cross-origin data via a crafted HTML page.
Which Google flaws are most likely to be used?
Ranked by the latest exploit-likelihood forecast: the chance each flaw is used in an attack in the next 30 days. A high severity score on its own doesn't tell you that. Flaws shared by many other makers' products are left out.
- 91%
Adobe Flash Player before 10.3.183.15 and 11.x before 11.1.102.62 on Windows, Mac OS X, Linux, and Solaris; before 11.1.111.6 on Android 2.x and 3.x; and before 11.1.115.6 on Android 4.x allows attackers to execute...
- 87%CVE-2012-0779Critical
Adobe Flash Player before 10.3.183.19 and 11.x before 11.2.202.235 on Windows, Mac OS X, and Linux; before 11.1.111.9 on Android 2.x and 3.x; and before 11.1.115.8 on Android 4.x allows remote attackers to execute...
- 86%CVE-2011-2110Critical
Adobe Flash Player before 10.3.181.26 on Windows, Mac OS X, Linux, and Solaris, and 10.3.185.23 and earlier on Android, allows remote attackers to execute arbitrary code or cause a denial of service (memory...
- 82%CVE-2011-2140Critical
Adobe Flash Player before 10.3.183.5 on Windows, Mac OS X, Linux, and Solaris and before 10.3.186.3 on Android, and Adobe AIR before 2.7.1 on Windows and Mac OS X and before 2.7.1.1961 on Android, allows attackers to...
- 73%CVE-2011-3389Medium
The SSL protocol, as used in certain configurations in Microsoft Windows and Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Opera, and other products, encrypts data by using CBC mode with chained...
- 73%CVE-2011-3026Medium
Integer overflow in libpng, as used in Google Chrome before 17.0.963.56, allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that trigger an integer...
- 70%CVE-2010-3654Critical
Adobe Flash Player before 9.0.289.0 and 10.x before 10.1.102.64 on Windows, Mac OS X, Linux, and Solaris and 10.1.95.1 on Android, and authplay.dll (aka AuthPlayLib.bundle or libauthplay.so.0.0.0) in Adobe Reader and...
- 61%CVE-2010-1807Critical
WebKit in Apple Safari 4.x before 4.1.2 and 5.x before 5.0.2; Android before 2.2; and webkitgtk before 1.2.6; does not properly validate floating-point data, which allows remote attackers to execute arbitrary code or...
All Google products we track.
135 products, most vulnerabilities first. Find the ones you run, then open a product to see its versions and exploited flaws.
- Androidandroid8,589 vulnerabilities76 versions
- Chromechrome3,680 vulnerabilities9,619 versions
- Chrome OSchrome_os475 vulnerabilities702 versions
- Tensorflowtensorflow429 vulnerabilities94 versions
- V8v833 vulnerabilities336 versions
- Asyloasylo16 vulnerabilities17 versions
- Blinkblink12 vulnerabilities3 versions
- Picasapicasa11 vulnerabilities13 versions
- Mini Search Appliancemini_search_appliance8 vulnerabilities2 versions
- Sketchupsketchup7 vulnerabilities4 versions
- Nest Cam Iq Indoor Firmwarenest_cam_iq_indoor_firmware6 vulnerabilities1 version
- Chromecast Firmwarechromecast_firmware5 vulnerabilities2 versions
- Fuchsiafuchsia5 vulnerabilities26 versions
- Gvisorgvisor5 vulnerabilities232 versions
- Protobufprotobuf5 vulnerabilities247 versions
- Protobuf-Javaprotobuf-java5 vulnerabilities85 versions
- Rendertronrendertron5 vulnerabilities6 versions
- Toolbartoolbar5 vulnerabilities19 versions
- Web Toolkitweb_toolkit5 vulnerabilities23 versions
- App Engine Python SDKapp_engine_python_sdk4 vulnerabilities95 versions
- Earthearth4 vulnerabilities40 versions
- Fscryptfscrypt4 vulnerabilities6 versions
- Protobuf-Javaliteprotobuf-javalite4 vulnerabilities12 versions
- Android SDKandroid_sdk3 vulnerabilities8 versions
This directory lists the 135 Google products with at least one tracked version, of 261 in our catalogue.
Running Google? We'll keep checking.
Looking flaws up one at a time doesn't scale. Tell us what you run once, and we tell you which flaws matter to you, in what order, and keep watching for new ones.
- Tell us what you runPick your software from a list, or let us work it out from your website.
- We match it to every flawOver 400,000 published flaws, checked against your list.
- Ranked by real-world riskA 0 to 100 score, led by evidence criminals are using it.
- Told as soon as we knowAn alert by email, in the app or by webhook to your own tools.
Free plan, no card needed. Nothing to install.
1 flaw being exploited affects software Acme tracks
Google Pixel devices contain an improper authorization vulnerability in the cellular modem. A logic error may allow an attacker to bypass permission checks and escalate privileges.
- Matched to
- Google on Acme's software list
- What to do
- Patch first, then check for signs of use
Sent to the alert recipients Acme chose. Also in the app and to Acme's webhook.
Our catalogue lists 13,072 published vulnerabilities across 261 products and 13,847 versions from Google. The most recent Google flaw added to the known-exploited list is CVE-2026-58704, on 16 September 2026.
103 Google vulnerabilities are on the list of flaws known to be exploited. The most recently added are CVE-2026-58704, CVE-2025-48633 and CVE-2025-10585. The full list is on this page.
Android, with 8,589 published vulnerabilities. Its own page lists the ones known to be exploited.
Create a EdgeProtect account and track the Google products you run. We match them against every published flaw, give each one a risk score from 0 to 100 and tell you as soon as we spot one that affects you, by email, in the app or by webhook.