CVE Tools
Track your stack

Google

15,302 CVEs tracked since 2003. Since Oct 2021, 69 of them reached CISA KEV.

Google CVEs per month

Oct 2021 to Nov 2026. Point at a month, or focus the strip and use the arrow keys.
Google CVEs per month, with the share now in CISA KEV
MonthCVEsIn CISA KEV
2021-101115
2021-11952
2021-121972
2022-01631
2022-021721
2022-031372
2022-041361
2022-05880
2022-061210
2022-071993
2022-082210
2022-091863
2022-10990
2022-111372
2022-122701
2023-011120
2023-021060
2023-03no snapshot
2023-041012
2023-051390
2023-061692
2023-071460
2023-081440
2023-091374
2023-102051
2023-11751
2023-121981
2024-01611
2024-02690
2024-03920
2024-04792
2024-05574
2024-06821
2024-07750
2024-08652
2024-09600
2024-10780
2024-111362
2024-12641
2025-011050
2025-02470
2025-03351
2025-04270
2025-05290
2025-06212
2025-07231
2025-08510
2025-091864
2025-10170
2025-11771
2025-121333
2026-01450
2026-02351
2026-031782
2026-041471
2026-053800
2026-0610952
2026-074960
2026-084020
2026-096623
2026-107741
2026-110

Products

The products that kept showing up in Google's monthly top three, with their CVEs summed over those months.

  1. Chrome4,79253 months
  2. Android4,27557 months
  3. Google Chrome1,48750 months
  4. Tensorflow1734 months
  5. Android Studio173 months
  6. Chrome OS81 month
  7. Mcp-toolbox51 month
  8. Sam31 month
  9. Fuchsia21 month
  10. Mcp Toolbox For Databases (Googleapis/mcp-toolbox)21 month

Latest CVEs

The 15 most recently published vulnerabilities affecting Google.

  1. CVE-2026-120930Incorrect authorization in Blink in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: High)5.4
  2. CVE-2026-120931Out of bounds write in WebGL in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium securit...9.6
  3. CVE-2026-121195Incorrect authorization in TrustedTypes in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)8.8
  4. CVE-2026-121141Improper input validation in Editing in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium s...5.4
  5. CVE-2026-121232Incorrect authorization in Core in Google Chrome prior to 157.0.8103.38 allowed a local attacker leveraging social engineering to obtain sensitive information via a co-installed app. (Chromium secu...5.1
  6. CVE-2026-121142Incorrect authorization in Network in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted Chrome extension. (Chrom...—
  7. CVE-2026-121169Missing authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted Chrome extension. (Chromi...—
  8. CVE-2026-121064Improper input validation in Performance in Google Chrome prior to 157.0.8103.38 allowed a local attacker to potentially execute arbitrary code inside the sandbox via a local program. (Chromium sec...7.8
  9. CVE-2026-121069Use after free in Track in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)8.8
  10. CVE-2026-121230Race condition in ANGLE in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security sever...8.3
  11. CVE-2026-121175Improper resource exposure in ORB in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass site isolation via a crafted HTML page. (Chromium security severity: Low)—
  12. CVE-2026-121093Out of bounds read in Animation in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. (Chromium security severity:...—
  13. CVE-2026-121092Uncontrolled recursion in SVG in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security ...8.8
  14. CVE-2026-121041Missing authorization in Input in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)6.5
  15. CVE-2026-121073Use after free in Network in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security...9.6

The record

Peak rank
#1 in Jun 2026
Busiest month shown
Jun 2026, 1,095 CVEs
Months with a KEV entry
36 since Oct 2021
Monthly snapshots
206 since 2003
Google's full record, month by month