Number 4 by total vulnerabilities in the catalog.
Computed from the whole catalog when the site is built.
Combines these spellings from source records: Google, google
Total vulnerabilities
9,034
Critical
591
High
3,085
Known Exploited
83
Exploit available
52
Network, no login needed
75.8%
Of 6,170 scored records
- Critical
- High
- Medium
- Low
- None or not scored
Show as table
| Period | Total | Critical | High | Medium | Low | None or not scored |
|---|---|---|---|---|---|---|
| 2026 (incomplete) | 4,655 | 502 | 2,077 | 1,770 | 171 | 135 |
| 2025 | 578 | 20 | 330 | 219 | 9 | 0 |
| 2024 | 701 | 45 | 440 | 210 | 6 | 0 |
| 2023 | 627 | 12 | 148 | 34 | 0 | 433 |
| 2022 | 386 | 5 | 61 | 34 | 1 | 285 |
| 2021 | 370 | 3 | 18 | 14 | 1 | 334 |
| 2020 | 290 | 4 | 5 | 19 | 3 | 259 |
| 2019 | 355 | 0 | 2 | 2 | 0 | 351 |
| 2018 | 393 | 0 | 3 | 0 | 0 | 390 |
| 2017 | 628 | 0 | 0 | 1 | 0 | 627 |
| 2016 | 51 | 0 | 1 | 0 | 0 | 50 |
Top products
| Product | Total | Critical/High |
|---|---|---|
| Chrome | 6,075 | 2,667 |
| Android | 2,761 | 915 |
| Asylo | 16 | 0 |
| ChromeOS | 12 | 7 |
| AngularJS | 6 | 1 |
| MCP Toolbox for Databases (googleapis/mcp-toolbox) | 6 | 5 |
| gRPC | 6 | 4 |
| Dart SDK | 5 | 1 |
| gVisor | 5 | 2 |
| mcp-toolbox | 5 | 3 |
Top bug types
| Bug type | Total | Critical/High |
|---|---|---|
| Memory Corruption | 2,253 | 1,902 |
| Improper Input Validation | 567 | 275 |
| Incorrect Authorization | 290 | 128 |
| Missing Authorization | 264 | 121 |
| User Interface (UI) Misrepresentation of Critical Information | 207 | 18 |
| Protection Mechanism Failure | 198 | 109 |
| Type Confusion | 186 | 175 |
| Race Condition | 179 | 118 |
| Information Disclosure | 165 | 24 |
| Privilege Escalation | 134 | 98 |
Known to be attacked
| CVE | Title | Published | Severity | EPSS |
|---|---|---|---|---|
| CVE-2026-125350 | Google Chrome: Memory Corruption | High | n/a | |
| CVE-2026-111497 | Out-of-Bounds Write in Google Brotli Decoder | Critical | 82.6% | |
| CVE-2026-58704 | Google Android vulnerability | High | 0.6% | |
| CVE-2026-87491 | Google Chrome: Memory Corruption | High | 3.5% | |
| CVE-2026-85046 | Google Chrome: Type Confusion | High | 1.8% | |
| CVE-2026-11645 | Google Chrome: Memory Corruption | High | 2.4% | |
| CVE-2025-48595 | Google Android: Memory Corruption | High | 1.9% | |
| CVE-2026-5281 | Google Chrome: Memory Corruption | High | 13.7% | |
| CVE-2026-3910 | Google Chrome: Memory Corruption | High | 2.7% | |
| CVE-2026-3909 | Google Chrome: Memory Corruption | High | 2.3% |
Newest vulnerabilities
| CVE | Title | Published | Severity | EPSS |
|---|---|---|---|---|
| CVE-2026-95405 | Google Android vulnerability | None | n/a | |
| CVE-2026-95404 | Google Android vulnerability | Medium | n/a | |
| CVE-2026-95403 | Google Android vulnerability | None | n/a | |
| CVE-2026-95402 | Google Android vulnerability | None | n/a | |
| CVE-2026-95401 | Google Android vulnerability | None | n/a | |
| CVE-2026-95400 | Google Android vulnerability | None | n/a | |
| CVE-2026-95399 | Google Android vulnerability | None | n/a | |
| CVE-2026-95397 | Google Android vulnerability | None | n/a | |
| CVE-2026-59637 | Google Android vulnerability | None | n/a | |
| CVE-2026-59636 | Google Android vulnerability | None | n/a |