Vulnerability activity for Google: what is being exploited, what was published lately, and when the next patch release is due.
Last 30 days
- CVEs
- 176
- Critical (CVSS 9+)
- 26
- Exploited (CISA KEV)
- 1
- With exploit code
- 1
Last 90 days
- CVEs
- 245
- Critical (CVSS 9+)
- 39
- Exploited (CISA KEV)
- 4
- With exploit code
- 2
Last 365 days
- CVEs
- 280
- Critical (CVSS 9+)
- 46
- Exploited (CISA KEV)
- 11
- With exploit code
- 4
Next expected patch release
Android Security Bulletin
Nov 2, 2026, in 4 days (approximate, can shift for holidays)
Expected from the vendor's usual schedule; vendors can shift dates.
Exploited now
CVEs on CISA's known-exploited list, newest first. "Days to KEV" counts from the CVE's publication.
- 9.2CriticalOct 22, 2026Google Brotli Memory corruptionCVE-2026-111497A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1Added to KEV Oct 27, 2026 · 4 days after publicationExploitedExploit code
- 8.8HighSep 16, 2026Google Pixel Auth bypass / access controlCVE-2026-58704Google Pixel devices contain an improper authorization vulnerability in the cellular modem. A logic error may allow an attacker to bypass permission checks and escalate privileges.Added to KEV Sep 16, 2026Exploited
- 8.8HighSep 9, 2026Google Chromium V8 Memory corruptionCVE-2026-87491Google Chromium V8 contains an out of bounds write vulnerability that allows a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.Added to KEV Sep 9, 2026Exploited3.1% likely
- 8.8HighSep 4, 2026Google Chromium V8 Memory corruptionCVE-2026-85046Google Chromium V8 contains a type confusion vulnerability that allows a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.Added to KEV Sep 4, 2026Exploited49% likelyExploit code
- 8.8HighJun 9, 2026Google Chromium V8 Memory corruptionCVE-2026-11645Google Chromium V8 out-of-bounds read and write vulnerability that could allow a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.Added to KEV Jun 9, 2026Exploited2.4% likely
- 8.8HighApr 1, 2026Google Dawn Memory corruptionCVE-2026-5281Google Dawn contains an use-after-free vulnerability that could allow a remote attacker who had compromised the renderer process to execute arbitrary code via a crafted HTML page. This vulnerability could affect multiple Chromium-based products including, but not limited to, Google Chrome, Microsoft Edge, and Opera.Added to KEV Apr 1, 2026Exploited
- 8.8HighMar 13, 2026Google Skia Memory corruptionCVE-2026-3909Google Skia contains an out-of-bounds write vulnerability that could allow a remote attacker to perform out of bounds memory access via a crafted HTML page. This vulnerability affects Google Chrome and ChromeOS, Android, Flutter, and possibly other products.Added to KEV Mar 13, 2026Exploited2.3% likely
- 8.8HighMar 13, 2026Google Chromium V8 Memory corruptionCVE-2026-3910Google Chromium V8 contains an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.Added to KEV Mar 13, 2026Exploited1.1% likely
- 8.8HighFeb 17, 2026Google Chromium Memory corruptionCVE-2026-2441Google Chromium CSS contains a use-after-free vulnerability that could allow a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.Added to KEV Feb 17, 2026Exploited55% likelyExploit codeExploit-DB
- 8.8HighDec 12, 2025Google ChromiumCVE-2025-14174Google Chromium contains an out of bounds memory access vulnerability in ANGLE that could allow a remote attacker to perform out of bounds memory access via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.Added to KEV Dec 12, 2025Exploited22% likelyExploit code
- 8.8HighNov 19, 2025Google Chromium V8 Memory corruptionCVE-2025-13223Google Chromium V8 contains a type confusion vulnerability that allows for heap corruption.Added to KEV Nov 19, 2025Exploited4.9% likely
- 8.8HighSep 24, 2025Google Chromium V8 Memory corruptionCVE-2025-10585Google Chromium contains a type confusion vulnerability in the V8 JavaScript and WebAssembly engine.Added to KEV Sep 23, 2025 · same day as publicationExploited9% likely
- 8.8HighJul 15, 2025Google ChromiumCVE-2025-6558Google Chromium contains an improper input validation vulnerability in ANGLE and GPU. This vulnerability could allow a remote attacker to potentially perform a sandbox escape via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.Added to KEV Jul 22, 2025 · 6 days after publicationExploited11% likely
- 8.1HighJun 30, 2025Google Chromium V8 Memory corruptionCVE-2025-6554Google Chromium V8 contains a type confusion vulnerability that could allow a remote attacker to perform arbitrary read/write via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.Added to KEV Jul 2, 2025 · 1 day after publicationExploited14% likely
- 8.8HighJun 2, 2025Google Chromium V8 Memory corruptionCVE-2025-5419Google Chromium V8 contains an out-of-bounds read and write vulnerability that could allow a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.Added to KEV Jun 5, 2025 · 2 days after publicationExploited7.8% likely
- 8.3HighMar 26, 2025Google Chromium MojoCVE-2025-2783Google Chromium Mojo on Windows contains a sandbox escape vulnerability caused by a logic error, which results from an incorrect handle being provided in unspecified circumstances. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.Added to KEV Mar 27, 2025 · same day as publicationExploited9.2% likelyExploit codeExploit-DB
- 8.8HighAug 21, 2024Google Chromium V8CVE-2024-7965Google Chromium V8 contains an inappropriate implementation vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.Added to KEV Aug 28, 2024 · 6 days after publicationExploited19% likely
- 8.8HighAug 21, 2024Google Chromium V8 Memory corruptionCVE-2024-7971Google Chromium V8 contains a type confusion vulnerability that allows a remote attacker to exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.Added to KEV Aug 26, 2024 · 4 days after publicationExploited21% likely
- 8.3HighMay 28, 2024Google Chromium V8 Memory corruptionCVE-2024-5274Google Chromium V8 contains a type confusion vulnerability that allows a remote attacker to execute code via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.Added to KEV May 28, 2024 · same day as publicationExploited7.7% likely
- 9.6CriticalMay 15, 2024Google Chromium V8 Memory corruptionCVE-2024-4947Google Chromium V8 contains a type confusion vulnerability that allows a remote attacker to execute code via a crafted HTML page.Added to KEV May 20, 2024 · 4 days after publicationExploited15% likely
- 8.3HighMay 14, 2024Google Chromium V8 Memory corruptionCVE-2024-4761Google Chromium V8 Engine contains an unspecified out-of-bounds memory write vulnerability via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. Added to KEV May 16, 2024 · 2 days after publicationExploited11% likely
- 9.6CriticalMay 9, 2024Google Chromium Memory corruptionCVE-2024-4671Google Chromium Visuals contains a use-after-free vulnerability that allows a remote attacker to exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.Added to KEV May 13, 2024 · 3 days after publicationExploited8.3% likely
- 8.8HighSep 5, 2023Google Chromium V8 Memory corruptionCVE-2023-4762Google Chromium V8 contains a type confusion vulnerability that allows a remote attacker to execute code via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.Added to KEV Feb 6, 2024 · 153 days after publicationExploited41% likely
- 8.8HighJan 16, 2024Google Chromium V8 Memory corruptionCVE-2024-0519Google Chromium V8 Engine contains an out-of-bounds memory access vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.Added to KEV Jan 17, 2024 · same day as publicationExploited3.8% likely
- 8.8HighDec 21, 2023Google Chromium WebRTC Memory corruptionCVE-2023-7024Google Chromium WebRTC, an open-source project providing web browsers with real-time communication, contains a heap buffer overflow vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could impact web browsers using WebRTC, including but not limited to Google Chrome.Added to KEV Jan 2, 2024 · 11 days after publicationExploited6.7% likely
Recent
- 5.3MediumOct 28, 2026Google Agent Development Kit (ADK) for Python Information disclosureCVE-2026-115522Exposure of Resource to Wrong Sphere (CWE-668) in FileArtifactService in Google Agent Development Kit (ADK) for Python (google-adk) versions 1.19.0 before 1.39.1 and 2.0.0a1 before 2.7.0 allows a caller in one application to list, read, overwrite, or delete artifacts belonging to another application when both applications share a FileArtifactService root directory and use the same user_id (and session_id for session-scoped artifacts). FileArtifactService accepted app_name across its public API m
- 9.6CriticalOct 27, 2026Google chromeCVE-2026-118355Improper input validation in Command in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
- 8.8HighOct 27, 2026Google ChromeCVE-2026-118343Improper input validation in ReadingList in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
- 9.6CriticalOct 27, 2026Google Chrome Memory corruptionCVE-2026-118342Out of bounds write in Editing in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
- 8.8HighOct 27, 2026Google Chrome Memory corruptionCVE-2026-118341Use after free in Modularization in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
- 9.6CriticalOct 27, 2026Google Chrome Memory corruptionCVE-2026-118340Memory corruption in Skia in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
- 8.8HighOct 27, 2026Google Chrome Memory corruptionCVE-2026-118339Use after free in Animation in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
- 8.8HighOct 27, 2026Google Chrome Memory corruptionCVE-2026-118338Use after free in Animation in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
- –UnscoredOct 27, 2026Google Chrome Auth bypass / access controlCVE-2026-118337Improper access control in Forms in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: High)
- 8.8HighOct 27, 2026Google ChromeCVE-2026-118336Improper input validation in Headless in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
- 8.8HighOct 27, 2026Google ChromeCVE-2026-118335Improper input validation in Metrics in Google Chrome on on Mac prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
- 8.8HighOct 27, 2026Google Chrome Memory corruptionCVE-2026-118334Use after free in ImageCapture in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
- –UnscoredOct 27, 2026Google Chrome Auth bypass / access controlCVE-2026-118333Missing authorization in Video in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: High)
- 9.6CriticalOct 27, 2026Google ChromeCVE-2026-118332Improper input validation in Compositing in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
- 8.8HighOct 27, 2026Google ChromeCVE-2026-118331Improper input validation in FileAPI in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
- 8.8HighOct 27, 2026Google Chrome Memory corruptionCVE-2026-118330Use after free in Browser in Google Chrome on on Windows prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
- 8.8HighOct 27, 2026Google ChromeCVE-2026-118329Improper input validation in ANGLE in Google Chrome on on Mac prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
- 8.8HighOct 27, 2026Google ChromeCVE-2026-118328Improper input validation in WebRTC in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
- 8.8HighOct 27, 2026Google Chrome Memory corruptionCVE-2026-118327Memory corruption in Media in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
- 4.3MediumOct 27, 2026Google Chrome Memory corruptionCVE-2026-118322Memory corruption in ANGLE in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. (Chromium security severity: High)
- 9.6CriticalOct 27, 2026Google ChromeCVE-2026-118321Improper input validation in Core in Google Chrome on on Android prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
- 8.8HighOct 27, 2026Google Chrome Memory corruptionCVE-2026-118320Memory corruption in V8 in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
- 4.3MediumOct 27, 2026Google Chrome Memory corruptionCVE-2026-118319Memory corruption in Skia in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. (Chromium security severity: High)
- 4.3MediumOct 27, 2026Google Chrome Auth bypass / access controlCVE-2026-118318Improper access control in V8 in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to read memory via a crafted HTML page. (Chromium security severity: High)
- 8.8HighOct 27, 2026Google Chrome Memory corruptionCVE-2026-118317Memory corruption in HTML in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
- 9.6CriticalOct 27, 2026Google ChromeCVE-2026-118316Improper input validation in V8 in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
- 8.8HighOct 27, 2026Google ChromeCVE-2026-118315Improper input validation in SVG in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
- 8.8HighOct 27, 2026Google ChromeCVE-2026-118314Improper input validation in UI in Google Chrome on on Android prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
- 8.8HighOct 27, 2026Google Chrome Memory corruptionCVE-2026-118313Use after free in Video in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
- 9.6CriticalOct 27, 2026Google Chrome Memory corruptionCVE-2026-118312Memory corruption in Paint in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
- 8.8HighOct 27, 2026Google Chrome Memory corruptionCVE-2026-118311Memory corruption in Media in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
- 9.6CriticalOct 27, 2026Google ChromeCVE-2026-118310Improper input validation in Views in Google Chrome on on Windows prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
- 9.6CriticalOct 27, 2026Google ChromeCVE-2026-118309Improper input validation in UI in Google Chrome on on Android prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
- 9.6CriticalOct 27, 2026Google Chrome Memory corruptionCVE-2026-118308Use after free in SVG in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
- 8.8HighOct 27, 2026Google Chrome Memory corruptionCVE-2026-118307Use after free in Paint in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
- 9.6CriticalOct 27, 2026Google Chrome Memory corruptionCVE-2026-118306Memory corruption in FileSystem in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
- 9.6CriticalOct 27, 2026Google Chrome Memory corruptionCVE-2026-118305Memory corruption in Turbolev in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
- 8.8HighOct 27, 2026Google ChromeCVE-2026-118304Improper input validation in SVG in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
- 8.8HighOct 27, 2026Google Chrome Memory corruptionCVE-2026-118347Use after free in FileSystem in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
- 8.8HighOct 27, 2026Google Chrome Memory corruptionCVE-2026-118346Use after free in Compositing in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
- 8.8HighOct 27, 2026Google Chrome Memory corruptionCVE-2026-118349Memory corruption in Payments in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
- 8.8HighOct 27, 2026Google Chrome Memory corruptionCVE-2026-118358Memory corruption in WebAudio in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
- 8.8HighOct 27, 2026Google Chrome Memory corruptionCVE-2026-118357Use after free in FileSystem in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
- 8.8HighOct 27, 2026Google Chrome Memory corruptionCVE-2026-118344Use after free in Layout in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
- –UnscoredOct 27, 2026GoogleADV-chrome-ca2da17fbee3The Stable channel has been updated to 156.0.8078.73/.74 for Windows and Mac and 156.0.8078.73 to Linux which will roll out over the coming days/weeks. A full list of changes in this build is available in the Log Security changes will be updated shortly Interested in switching release channels? Find out how here . If you find a new issue, please let us know by filing a bug . The community help forum is also a great place to reach out for help or learn about common issues. Srinivas Sista Google C
- 9.2CriticalOct 22, 2026Google Brotli Memory corruptionCVE-2026-111497A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1ExploitedExploit code
- –UnscoredOct 26, 2026GoogleADV-cccs-5f930db80afbSerial number: AV26-1085 Date: October 26, 2026 As of October 22, 2026, Google is affected by a vulnerability in the following product: Brotli Versions 1.0.3 to versions prior to v1.0.10 Versions 1.1.0 to versions prior to v1.1.1 Versions 1.2.0 to versions prior to v1.2.1 The Cyber Centre encourages users and administrators to review the provided web link and apply any necessary updates as they become available. Brotli Releases
- 7.2HighOct 23, 2026Google Agent Development Kit (ADK) for Java Auth bypass / access controlCVE-2026-107858Missing Origin Validation in WebSockets (CWE-1385) and Permissive Cross-domain Policy with Untrusted Domains (CWE-942) in the development web server (ADK Web) in Google Agent Development Kit (ADK) for Java (com.google.adk:google-adk-dev versions 0.1.0 before 1.13.0 and com.google.adk:google-adk-maven-plugin versions 0.3.0 before 1.13.0) allow a remote attacker to control a locally running agent and read its data via a malicious web page visited by a developer while the server is running. The /ru
- 8.8HighOct 20, 2026Google chrome Memory corruptionCVE-2026-113344Use after free in Performance in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
- 6.5MediumOct 20, 2026Google chrome Memory corruptionCVE-2026-113224Memory corruption in WebAppInstalls in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Top products
- Chrome258 CVEs in the last year, 44 critical
- Chromium V85 CVEs in the last year, 5 exploited
- MCP Toolbox for Databases2 CVEs in the last year, 1 critical
- Chromium2 CVEs in the last year, 2 exploited
- Skia1 CVE in the last year, 1 exploited
- Pixel1 CVE in the last year, 1 exploited
- libjxl1 CVE in the last year
- Dawn1 CVE in the last year, 1 exploited
- Brotli1 CVE in the last year, 1 critical, 1 exploited
- Agent Development Kit (ADK) for Python1 CVE in the last year
Advisories
Official advisories from the last 90 days that name this vendor's CVEs.
- Synology · Oct 29, 2026Synology-SA-26:15 Node2ShellCVE-2026-111497
- Microsoft MSRC · Oct 29, 2026CVE-2026-19175 Use after free in PaymentsCVE-2026-19175
- AWS · Oct 28, 2026CVE-2026-111497: Native Brotli Decoder Remote Code Execution and Memory DisclosureCVE-2026-111497
- Cisco PSIRT · Oct 28, 2026Vulnerabilities in Node.js Affecting Cisco Products: October 2026CVE-2026-111497
- Chrome Releases · Oct 28, 2026Stable Channel Update for ChromeOS / ChromeOS FlexCVE-2026-118307CVE-2026-118309CVE-2026-118331CVE-2026-118332CVE-2026-118339CVE-2026-118343
- CCCS (Canada) · Oct 28, 2026AL26-027 - Critical vulnerability impacting Google Brotli – CVE-2026-111497CVE-2026-111497
- Microsoft MSRC · Oct 28, 2026Chromium: CVE-2026-78975 Incorrect authorization in DOMCVE-2026-78975
- Microsoft MSRC · Oct 28, 2026Chromium: CVE-2026-78974 UI misrepresentation in Linux Toolkit ThemingCVE-2026-78974
- Microsoft MSRC · Oct 28, 2026Chromium: CVE-2026-78969 Uninitialized resource in VideoCVE-2026-78969
- Microsoft MSRC · Oct 28, 2026Chromium: CVE-2026-78968 Missing authorization in CoreCVE-2026-78968
- Microsoft MSRC · Oct 28, 2026Chromium: CVE-2026-78967 Missing authorization in BFCacheCVE-2026-78967
- Microsoft MSRC · Oct 28, 2026Chromium: CVE-2026-78966 Externally controlled reference in QUICCVE-2026-78966
- Microsoft MSRC · Oct 28, 2026Chromium: CVE-2026-78965 Uninitialized resource in ANGLECVE-2026-78965
- Microsoft MSRC · Oct 28, 2026Chromium: CVE-2026-78964 Use after free in SyncCVE-2026-78964
- Microsoft MSRC · Oct 28, 2026Chromium: CVE-2026-78963 Improper input validation in MediaCVE-2026-78963
Counts cover CVEs and advisories Watch Floor tracks, by the date they became news. Updated every 10 minutes.