google security advisories
60 threat alerts tracking vulnerabilities and security advisories that affect google products.
Vulnios monitors google CVE feeds, vendor advisories, CISA KEV listings, and exploit-prediction data continuously. Each alert below is enriched with severity, exploitation status, affected products, and a remediation path. Use this page to scan recent google security news in one place, or click into an individual alert for full detail.
Critical Vulnerability: CVE-2026-8511 — google, apple — chrome, macos
Use after free in UI in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)
criticalCVE-2026-8511Critical Vulnerability: CVE-2026-8580 — google — chrome
Use after free in Mojo in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)
criticalCVE-2026-8580Critical Vulnerability: CVE-2026-103630 — google — chrome
Use after free in FedCM in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
criticalCVE-2026-103630Critical Vulnerability: CVE-2025-36937 — google — android
In AudioDecoder::HandleProduceRequest of audio_decoder.cc, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote code execution with no additional executi
criticalCVE-2025-36937Critical Vulnerability: CVE-2025-48626 — google — android
In multiple locations, there is a possible way to launch an application from the background due to a precondition check failure. This could lead to remote escalation of privilege with no additional ex
criticalCVE-2025-48626Critical Vulnerability: CVE-2025-10890 — google, apple — chrome, macos
Side-channel information leakage in V8 in Google Chrome prior to 140.0.7339.207 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)
criticalCVE-2025-10890Critical Vulnerability: CVE-2026-49921 — google — android
In multiple locations, there is a possible memory safety issue due to a heap buffer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction
criticalCVE-2026-49921Critical Vulnerability: CVE-2026-58822 — google — android
In multiple functions of ftsmooth.c, there is a possible memory safety issue due to improper casting. This could lead to remote code execution with no additional execution privileges needed. User inte
criticalCVE-2026-58822Critical Vulnerability: CVE-2026-0163 — google — android
In multiple functions of vpu_ioctl.c, there is a possible use after free due to a use after free. This could lead to remote escalation of privilege with no additional execution privileges needed. User
criticalCVE-2026-0163Critical Vulnerability: CVE-2026-55366 — google — android
In IP Multimedia Subsystem, there is a possible authentication bypass due to a logic error in the code. This could lead to remote escalation of privilege with no additional execution privileges needed
criticalCVE-2026-55366Critical Vulnerability: CVE-2026-56960 — google — android
In multiple locations, there is a possible use-after-free due to a logic error in the code. This could lead to remote escalation of privilege with no additional execution privileges needed. User inter
criticalCVE-2026-56960Critical Vulnerability: CVE-2026-28606 — google — android
In handleBondStateChanged of AdapterService.java, there is a possible way to skip pairing due to a logic error in the code. This could lead to remote escalation of privilege without user consent with
criticalCVE-2026-28606Critical Vulnerability: CVE-2026-11717 — google — mcp_toolbox_for_databases
An authentication bypass vulnerability exists in the generic opaque token validation path (validateOpaqueToken) of googleapis/mcp-toolbox. When verifying an unparsed opaque token via an OAuth 2.0 int
criticalCVE-2026-11717Critical Vulnerability: CVE-2026-11718 — google — mcp_toolbox_for_databases
An authentication bypass vulnerability exists in the generic opaque token validation path (validateOpaqueToken) of googleapis/mcp-toolbox. When the toolbox validates an opaque token via an OAuth 2.0
criticalCVE-2026-11718Critical Vulnerability: CVE-2026-14537 — google — mcp_toolbox_for_databases
Incorrect Authorization in the direct HTTP API tool invocation endpoint in Google mcp-toolbox versions v1.3.0 and v1.4.0 allows an unauthenticated attacker to invoke tools protected by the scopeRequir
criticalCVE-2026-14537Critical Vulnerability: CVE-2026-11250 — google, apple — chrome, macos
Inappropriate implementation in DevTools in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from pro
criticalCVE-2026-11250Critical Vulnerability: CVE-2026-11293 — google, apple — chrome, macos
Use after free in Input in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Low)
criticalCVE-2026-11293Critical Vulnerability: CVE-2026-11282 — google, linux — chrome, linux_kernel
Insufficient policy enforcement in Sandbox in Google Chrome on Linux prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium securit
criticalCVE-2026-11282Critical Vulnerability: CVE-2026-11112 — google, linux — chrome, linux_kernel
Insufficient validation of untrusted input in Chromoting in Google Chrome on Linux prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sa
criticalCVE-2026-11112Critical Vulnerability: CVE-2026-11114 — google, apple — chrome, macos
Use after free in Device Trust in Google Chrome on Mac prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted H
criticalCVE-2026-11114Critical Vulnerability: CVE-2026-11207 — google, apple — chrome, macos
Insufficient validation of untrusted input in Autofill in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape via malicious network traffic. (Chromiu
criticalCVE-2026-11207Critical Vulnerability: CVE-2026-11070 — google, microsoft — chrome, windows
Insufficient validation of untrusted input in Chromoting in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker who had compromised the network process to potentially perform a s
criticalCVE-2026-11070Critical Vulnerability: CVE-2026-11152 — google, apple — chrome, macos
Object lifecycle issue in Dawn in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)
criticalCVE-2026-11152Critical Vulnerability: CVE-2026-11146 — google, apple — chrome, macos
Insufficient validation of untrusted input in Chromoting in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox esc
criticalCVE-2026-11146Critical Vulnerability: CVE-2026-11088 — google — chrome
Integer overflow in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (C
criticalCVE-2026-11088Critical Vulnerability: CVE-2026-11113 — google — chrome
Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape v
criticalCVE-2026-11113Critical Vulnerability: CVE-2026-11120 — google — chrome
Insufficient validation of untrusted input in Enterprise Reporting in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a s
criticalCVE-2026-11120Critical Vulnerability: CVE-2026-11198 — google, apple — chrome, macos
Insufficient validation of untrusted input in Codecs in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape via a crafted video file. (Chromium secur
criticalCVE-2026-11198Critical Vulnerability: CVE-2026-11052 — google, microsoft — chrome, windows
Type Confusion in GPU in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML p
criticalCVE-2026-11052Critical Vulnerability: CVE-2026-11095 — google — chrome
Insufficient validation of untrusted input in Codecs in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape
criticalCVE-2026-11095Critical Vulnerability: CVE-2026-11153 — google, apple — chrome, macos
Side-channel information leakage in Forms in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
criticalCVE-2026-11153Critical Vulnerability: CVE-2026-11165 — google, apple — chrome, iphone_os
Use after free in WebMIDI in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)
criticalCVE-2026-11165Critical Vulnerability: CVE-2026-11100 — google, apple — chrome, macos
Use after free in File Input in Google Chrome on Mac prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially perform a sandbox escape via
criticalCVE-2026-11100Critical Vulnerability: CVE-2026-11213 — google, apple — chrome, macos
Insufficient validation of untrusted input in Reading Mode in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox e
criticalCVE-2026-11213Critical Vulnerability: CVE-2026-11066 — google — chrome
Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium securit
criticalCVE-2026-11066Critical Vulnerability: CVE-2026-11094 — google, microsoft — chrome, windows
Use after free in Codecs in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTM
criticalCVE-2026-11094Critical Vulnerability: CVE-2026-11056 — google, microsoft — chrome, windows
Insufficient validation of untrusted input in SiteIsolation in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform
criticalCVE-2026-11056Critical Vulnerability: CVE-2026-11061 — google — chrome
Type Confusion in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)
criticalCVE-2026-11061Critical Vulnerability: CVE-2026-11063 — google, microsoft — chrome, windows
Insufficient validation of untrusted input in WebNN in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandb
criticalCVE-2026-11063Critical Vulnerability: CVE-2026-11047 — google, microsoft — chrome, windows
Inappropriate implementation in Base in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a
criticalCVE-2026-11047Critical Vulnerability: CVE-2026-11037 — google, apple — chrome, macos
Out of bounds write in Codecs in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape via a crafted video file. (Chromium security severity: Medium)
criticalCVE-2026-11037Critical Vulnerability: CVE-2026-11043 — google, apple — chrome, macos
Out of bounds write in ANGLE in Google Chrome on Mac prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTM
criticalCVE-2026-11043Critical Vulnerability: CVE-2026-10971 — google, microsoft — chrome, windows
Insufficient validation of untrusted input in Printing in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sa
criticalCVE-2026-10971Critical Vulnerability: CVE-2026-11009 — google, microsoft — chrome, windows
Use after free in USB in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)
criticalCVE-2026-11009Critical Vulnerability: CVE-2026-10990 — google — chrome
Use after free in Glic in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chro
criticalCVE-2026-10990Critical Vulnerability: CVE-2026-10966 — google — chrome
Inappropriate implementation in Codecs in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape via a crafted video file. (Chromium security severity:
criticalCVE-2026-10966Critical Vulnerability: CVE-2026-10881 — google, apple — chrome, macos
Out of bounds read and write in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Cr
criticalCVE-2026-10881Critical Vulnerability: CVE-2026-11021 — google, microsoft — chrome, windows
Insufficient validation of untrusted input in GPU in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox
criticalCVE-2026-11021Critical Vulnerability: CVE-2026-11002 — google — chrome
Use after free in Autofill in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (
criticalCVE-2026-11002Critical Vulnerability: CVE-2026-10983 — google — chrome
Insufficient validation of untrusted input in Dawn in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security
criticalCVE-2026-10983Critical Vulnerability: CVE-2026-10974 — google — chrome
Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium securit
criticalCVE-2026-10974Critical Vulnerability: CVE-2026-10931 — google — chrome
Use after free in FileSystem in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
criticalCVE-2026-10931Critical Vulnerability: CVE-2026-9874 — google, microsoft — chrome, windows
Use after free in Dawn in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)
criticalCVE-2026-9874Critical Vulnerability: CVE-2026-9875 — google — chrome, android
Out of bounds read in WebGL in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity:
criticalCVE-2026-9875Critical Vulnerability: CVE-2026-9872 — google — chrome, android
Out of bounds write in GPU in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: C
criticalCVE-2026-9872Critical Vulnerability: CVE-2026-9967 — google, microsoft — chrome, windows
Out of bounds write in GPU in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
criticalCVE-2026-9967Critical Vulnerability: CVE-2026-9886 — google, apple — chrome, macos
Use after free in Base in Google Chrome on Mac prior to 148.0.7778.216 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)
criticalCVE-2026-9886Critical Vulnerability: CVE-2026-9881 — google, apple — chrome, macos
Use after free in Bluetooth in Google Chrome on Mac prior to 148.0.7778.216 allowed an attacker who convinced a user to install a malicious extension to potentially perform a sandbox escape via a craf
criticalCVE-2026-9881Critical Vulnerability: CVE-2026-9876 — google — chrome, android
Use after free in WebGL in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Crit
criticalCVE-2026-9876Critical Vulnerability: CVE-2026-9918 — google — chrome
Inappropriate implementation in Tint in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Hi
criticalCVE-2026-9918
Showing the 60 most recent. Older alerts are archived but still reachable via search and the main feed.
Track google exposure across your environment
Vulnios automatically cross-references your asset inventory against new google CVEs and surfaces only what affects you. No more sifting manually — actionable findings only.
Start a free scan