All vendors
Google KEV entries added per year — 2021: 23, 2022: 21, 2023: 7, 2024: 9, 2025: 7, 2026: 8.
Google — known exploited vulnerabilities
The CISA Known Exploited Vulnerabilities catalog (KEV) lists vulnerabilities that CISA has confirmed are being exploited in the wild; U.S. federal civilian agencies are required to remediate each entry by its due date. This page joins the KEV entries for Google with NVD CVSS scores and CISA's ransomware-campaign flag. See our methodology or browse all CVEs.
75 KEV entries
0 ransomware-linked
25 products
avg CVSS 8.7
last added 2026-09-16
Key findings
CISA's Known Exploited Vulnerabilities catalog lists 75 Google vulnerabilities confirmed as exploited in the wild across 25 products; none are currently flagged as used in known ransomware campaigns. Chromium V8 is the most-affected product, with 41 entries (55% of the total). CISA added 8 entries in 2026 so far, compared with 7 in 2025. Across the 75 entries with an NVD CVSS score (100% of the total), the average score is 8.7; 14 entries are rated critical by NVD. The most recent addition is CVE-2026-58704 (Google Pixel Improper Authorization Vulnerability), added on 2026-09-16.
Affected products
| Product | Entries | Share |
|---|---|---|
| Chromium V8 | 41 | 55% |
| Chromium | 6 | 8.0% |
| Pixel | 2 | 2.7% |
| Chromium Mojo | 2 | 2.7% |
| Chromium Skia | 2 | 2.7% |
| Chromium Intents | 2 | 2.7% |
| Chromium Blink | 2 | 2.7% |
| Dawn | 1 | 1.3% |
| Skia | 1 | 1.3% |
| Chromium WebRTC | 1 | 1.3% |
| Chromium libvpx | 1 | 1.3% |
| Chromium WebP | 1 | 1.3% |
| Chromium Network Service | 1 | 1.3% |
| Chromium GPU | 1 | 1.3% |
| Chromium PopupBlocker | 1 | 1.3% |
| Chrome Blink | 1 | 1.3% |
| Chrome WebAudio | 1 | 1.3% |
| Chromium Animation | 1 | 1.3% |
| Chrome Media | 1 | 1.3% |
| Chrome for Android UI | 1 | 1.3% |
| Chrome FreeType | 1 | 1.3% |
| Chrome | 1 | 1.3% |
| Chromium Indexed DB API | 1 | 1.3% |
| Chromium Portals | 1 | 1.3% |
| Chromium WebGL | 1 | 1.3% |
Entries added per year
By date added to the KEV catalog
Exploited Google vulnerabilities (75)
Newest first. CVSS scores from NVD where available.
| CVE | Product | Vulnerability | Date added | Ransomware | CVSS |
|---|---|---|---|---|---|
| CVE-2026-58704 | Pixel | Google Pixel Improper Authorization Vulnerability | 2026-09-16 | — | HIGH8.8 |
| CVE-2026-87491 | Chromium V8 | Google Chromium V8 Out of Bounds Write Vulnerability | 2026-09-09 | — | HIGH8.8 |
| CVE-2026-85046 | Chromium V8 | Google Chromium V8 Type Confusion Vulnerability | 2026-09-04 | — | HIGH8.8 |
| CVE-2026-11645 | Chromium V8 | Google Chromium V8 Out-of-Bounds Read and Write Vulnerability | 2026-06-09 | — | HIGH8.8 |
| CVE-2026-5281 | Dawn | Google Dawn Use-After-Free Vulnerability | 2026-04-01 | — | HIGH8.8 |
| CVE-2026-3910 | Chromium V8 | Google Chromium V8 Improper Restriction of Operations Within the Bounds of a Memory Buffer Vulnerability | 2026-03-13 | — | HIGH8.8 |
| CVE-2026-3909 | Skia | Google Skia Out-of-Bounds Write Vulnerability | 2026-03-13 | — | HIGH8.8 |
| CVE-2026-2441 | Chromium | Google Chromium CSS Use-After-Free Vulnerability | 2026-02-17 | — | HIGH8.8 |
| CVE-2025-14174 | Chromium | Google Chromium Out of Bounds Memory Access Vulnerability | 2025-12-12 | — | HIGH8.8 |
| CVE-2025-13223 | Chromium V8 | Google Chromium V8 Type Confusion Vulnerability | 2025-11-19 | — | HIGH8.8 |
| CVE-2025-10585 | Chromium V8 | Google Chromium V8 Type Confusion Vulnerability | 2025-09-23 | — | CRITICAL9.8 |
| CVE-2025-6558 | Chromium | Google Chromium ANGLE and GPU Improper Input Validation Vulnerability | 2025-07-22 | — | HIGH8.8 |
| CVE-2025-6554 | Chromium V8 | Google Chromium V8 Type Confusion Vulnerability | 2025-07-02 | — | HIGH8.1 |
| CVE-2025-5419 | Chromium V8 | Google Chromium V8 Out-of-Bounds Read and Write Vulnerability | 2025-06-05 | — | HIGH8.8 |
| CVE-2025-2783 | Chromium Mojo | Google Chromium Mojo Sandbox Escape Vulnerability | 2025-03-27 | — | HIGH8.3 |
| CVE-2024-7965 | Chromium V8 | Google Chromium V8 Inappropriate Implementation Vulnerability | 2024-08-28 | — | HIGH8.8 |
| CVE-2024-7971 | Chromium V8 | Google Chromium V8 Type Confusion Vulnerability | 2024-08-26 | — | CRITICAL9.6 |
| CVE-2024-5274 | Chromium V8 | Google Chromium V8 Type Confusion Vulnerability | 2024-05-28 | — | CRITICAL9.6 |
| CVE-2024-4947 | Chromium V8 | Google Chromium V8 Type Confusion Vulnerability | 2024-05-20 | — | CRITICAL9.6 |
| CVE-2024-4761 | Chromium V8 | Google Chromium V8 Out-of-Bounds Memory Write Vulnerability | 2024-05-16 | — | HIGH8.8 |
| CVE-2024-4671 | Chromium | Google Chromium Visuals Use-After-Free Vulnerability | 2024-05-13 | — | CRITICAL9.6 |
| CVE-2023-4762 | Chromium V8 | Google Chromium V8 Type Confusion Vulnerability | 2024-02-06 | — | HIGH8.8 |
| CVE-2024-0519 | Chromium V8 | Google Chromium V8 Out-of-Bounds Memory Access Vulnerability | 2024-01-17 | — | HIGH8.8 |
| CVE-2023-7024 | Chromium WebRTC | Google Chromium WebRTC Heap Buffer Overflow Vulnerability | 2024-01-02 | — | HIGH8.8 |
| CVE-2023-6345 | Chromium Skia | Google Skia Integer Overflow Vulnerability | 2023-11-30 | — | CRITICAL9.6 |
| CVE-2023-5217 | Chromium libvpx | Google Chromium libvpx Heap Buffer Overflow Vulnerability | 2023-10-02 | — | HIGH8.8 |
| CVE-2023-4863 | Chromium WebP | Google Chromium WebP Heap-Based Buffer Overflow Vulnerability | 2023-09-13 | — | HIGH8.8 |
| CVE-2023-3079 | Chromium V8 | Google Chromium V8 Type Confusion Vulnerability | 2023-06-07 | — | HIGH8.8 |
| CVE-2023-2136 | Chromium Skia | Google Chrome Skia Integer Overflow Vulnerability | 2023-04-21 | — | CRITICAL9.6 |
| CVE-2023-2033 | Chromium V8 | Google Chromium V8 Type Confusion Vulnerability | 2023-04-17 | — | HIGH8.8 |
| CVE-2022-3038 | Chromium Network Service | Google Chromium Network Service Use-After-Free Vulnerability | 2023-03-30 | — | HIGH8.8 |
| CVE-2022-4262 | Chromium V8 | Google Chromium V8 Type Confusion Vulnerability | 2022-12-05 | — | HIGH8.8 |
| CVE-2022-4135 | Chromium GPU | Google Chromium GPU Heap Buffer Overflow Vulnerability | 2022-11-28 | — | CRITICAL9.6 |
| CVE-2022-3723 | Chromium V8 | Google Chromium V8 Type Confusion Vulnerability | 2022-10-28 | — | HIGH8.8 |
| CVE-2022-3075 | Chromium Mojo | Google Chromium Mojo Insufficient Data Validation Vulnerability | 2022-09-08 | — | CRITICAL9.6 |
| CVE-2022-2856 | Chromium Intents | Google Chromium Intents Insufficient Input Validation Vulnerability | 2022-08-18 | — | MEDIUM6.5 |
| CVE-2021-30533 | Chromium PopupBlocker | Google Chromium PopupBlocker Security Bypass Vulnerability | 2022-06-27 | — | MEDIUM6.5 |
| CVE-2019-5825 | Chromium V8 | Google Chromium V8 Out-of-Bounds Write Vulnerability | 2022-06-08 | — | MEDIUM6.5 |
| CVE-2018-6065 | Chromium V8 | Google Chromium V8 Integer Overflow Vulnerability | 2022-06-08 | — | HIGH8.8 |
| CVE-2018-17480 | Chromium V8 | Google Chromium V8 Out-of-Bounds Write Vulnerability | 2022-06-08 | — | HIGH8.8 |
| CVE-2018-17463 | Chromium V8 | Google Chromium V8 Remote Code Execution Vulnerability | 2022-06-08 | — | HIGH8.8 |
| CVE-2017-5070 | Chromium V8 | Google Chromium V8 Type Confusion Vulnerability | 2022-06-08 | — | HIGH8.8 |
| CVE-2017-5030 | Chromium V8 | Google Chromium V8 Memory Corruption Vulnerability | 2022-06-08 | — | HIGH8.8 |
| CVE-2016-5198 | Chromium V8 | Google Chromium V8 Out-of-Bounds Memory Vulnerability | 2022-06-08 | — | HIGH8.8 |
| CVE-2016-1646 | Chromium V8 | Google Chromium V8 Out-of-Bounds Read Vulnerability | 2022-06-08 | — | HIGH8.8 |
| CVE-2019-5786 | Chrome Blink | Google Chrome Blink Use-After-Free Vulnerability | 2022-05-23 | — | MEDIUM6.5 |
| CVE-2019-13720 | Chrome WebAudio | Google Chrome WebAudio Use-After-Free Vulnerability | 2022-05-23 | — | HIGH8.8 |
| CVE-2022-1364 | Chromium V8 | Google Chromium V8 Type Confusion Vulnerability | 2022-04-15 | — | HIGH8.8 |
| CVE-2021-39793 | Pixel | Google Pixel Out-of-Bounds Write Vulnerability | 2022-04-11 | — | HIGH7.8 |
| CVE-2022-1096 | Chromium V8 | Google Chromium V8 Type Confusion Vulnerability | 2022-03-28 | — | HIGH8.8 |
| CVE-2022-0609 | Chromium Animation | Google Chromium Animation Use-After-Free Vulnerability | 2022-02-15 | — | HIGH8.8 |
| CVE-2020-6572 | Chrome Media | Google Chrome Media Use-After-Free Vulnerability | 2022-01-10 | — | HIGH8.8 |
| CVE-2021-4102 | Chromium V8 | Google Chromium V8 Use-After-Free Vulnerability | 2021-12-15 | — | HIGH8.8 |
| CVE-2020-16010 | Chrome for Android UI | Google Chrome for Android UI Heap Buffer Overflow Vulnerability | 2021-11-03 | — | CRITICAL9.6 |
| CVE-2020-15999 | Chrome FreeType | Google Chrome FreeType Heap Buffer Overflow Vulnerability | 2021-11-03 | — | CRITICAL9.6 |
| CVE-2021-21166 | Chromium | Google Chromium Race Condition Vulnerability | 2021-11-03 | — | HIGH8.8 |
| CVE-2020-16017 | Chrome | Google Chrome Use-After-Free Vulnerability | 2021-11-03 | — | CRITICAL9.6 |
| CVE-2021-37976 | Chromium | Google Chromium Information Disclosure Vulnerability | 2021-11-03 | — | MEDIUM6.5 |
| CVE-2020-16009 | Chromium V8 | Google Chromium V8 Type Confusion Vulnerability | 2021-11-03 | — | HIGH8.8 |
| CVE-2021-30632 | Chromium V8 | Google Chromium V8 Out-of-Bounds Write Vulnerability | 2021-11-03 | — | HIGH8.8 |
| CVE-2020-16013 | Chromium V8 | Google Chromium V8 Incorrect Implementation Vulnerabililty | 2021-11-03 | — | HIGH8.8 |
| CVE-2021-30633 | Chromium Indexed DB API | Google Chromium Indexed DB API Use-After-Free Vulnerability | 2021-11-03 | — | CRITICAL9.6 |
| CVE-2021-21148 | Chromium V8 | Google Chromium V8 Heap Buffer Overflow Vulnerability | 2021-11-03 | — | HIGH8.8 |
| CVE-2021-37973 | Chromium Portals | Google Chromium Portals Use-After-Free Vulnerability | 2021-11-03 | — | CRITICAL9.6 |
| CVE-2021-30551 | Chromium V8 | Google Chromium V8 Type Confusion Vulnerability | 2021-11-03 | — | HIGH8.8 |
| CVE-2021-37975 | Chromium V8 | Google Chromium V8 Use-After-Free Vulnerability | 2021-11-03 | — | HIGH8.8 |
| CVE-2020-6418 | Chromium V8 | Google Chromium V8 Type Confusion Vulnerability | 2021-11-03 | — | HIGH8.8 |
| CVE-2021-30554 | Chromium WebGL | Google Chromium WebGL Use-After-Free Vulnerability | 2021-11-03 | — | HIGH8.8 |
| CVE-2021-21206 | Chromium Blink | Google Chromium Blink Use-After-Free Vulnerability | 2021-11-03 | — | HIGH8.8 |
| CVE-2021-38000 | Chromium Intents | Google Chromium Intents Improper Input Validation Vulnerability | 2021-11-03 | — | MEDIUM6.1 |
| CVE-2021-38003 | Chromium V8 | Google Chromium V8 Memory Corruption Vulnerability | 2021-11-03 | — | HIGH8.8 |
| CVE-2021-21224 | Chromium V8 | Google Chromium V8 Type Confusion Vulnerability | 2021-11-03 | — | HIGH8.8 |
| CVE-2021-21193 | Chromium Blink | Google Chromium Blink Use-After-Free Vulnerability | 2021-11-03 | — | HIGH8.8 |
| CVE-2021-21220 | Chromium V8 | Google Chromium V8 Improper Input Validation Vulnerability | 2021-11-03 | — | HIGH8.8 |
| CVE-2021-30563 | Chromium V8 | Google Chromium V8 Type Confusion Vulnerability | 2021-11-03 | — | HIGH8.8 |
Source: CISA Known Exploited Vulnerabilities catalog, joined with NIST NVD CVSS data. Vendor names are normalized across spellings. Compare all vendors.