Vendor
9,109 known vulnerabilities.
Products
Chrome 6,157
Android 2,760
Asylo 16
ChromeOS 12
AngularJS 6
MCP Toolbox for Databases (googleapis/mcp-toolbox) 6
gVisor 6
gRPC 6
Dart SDK 5
mcp-toolbox 5
libjxl 4
Keras 4
Guava 3
go-attestation 3
SAM 3
Android XR 3
fscrypt 3
MCP Toolbox for Databases 3
Protocolbuffers 3
OSV-SCALIBR 3
Nearby 3
Fuchsia 3
guest-oslogin 3
AWS S3 Crypto SDK for GoLang 2
Nest Wifi Pro 2
Brotli 2
Web Designer 2
Tink 2
Pixel Watch 2
Fuchsia Kernel 2
Omaha 2
zx 2
protobuf-java 2
Web Stories 2
protobuf-kotlin 2
google-protobuf [JRuby Gem] 2
Site Kit by Google 2
Andrioid 2
Agent Development Kit (ADK) for Python 1
nodejs-firestore 1
9,109 results · Feed
-
High 7.8
In multiple functions of HeaderPrivacyIconsController.kt, there is a possible way to grand permissions across user due …
-
High 7.8
In startAlwaysOnVpn of Vpn.java, there is a possible way to disable always-on VPN due to a logic error in the code. Thi…
-
High 7.8
In onActivityResult of EditFdnContactScreen.java, there is a possible way to leak contacts from the work profile due to…
-
Medium 5.5
In multiple functions of NotificationManagerService.java, there is a possible way to bypass the per-package channel lim…
-
High 7.8CVE-2025-48583 Public exploit
In multiple functions of BaseBundle.java, there is a possible way to execute arbitrary code due to a logic error in the…
-
High 7.8
In connectInternal of MediaBrowser.java, there is a possible way to access while in use permission while the app is in …
-
Medium 5.5
In updateNotificationChannelGroupFromPrivilegedListener of NotificationManagerService.java, there is a possible permane…
-
High 7.8
In multiple functions of CertInstaller.java, there is a possible way to install certificates due to a permissions bypas…
-
High 7.8
In sendCommand of MediaSessionRecord.java, there is a possible way to launch the foreground service while the app is in…
-
High 7.8CVE-2025-48572 Exploited
In multiple locations, there is a possible way to launch activities from the background due to a permissions bypass. Th…
KEV Dec 2, 2025 -
High 7.8
In multiple locations, there is a possible permission bypass due to a confused deputy. This could lead to local escalat…
-
High 7.8
In multiple locations, there is a possible way to bypass the cross profile intent filter due to a logic error in the co…
-
High 7.0
In multiple locations, there is a possible intent filter bypass due to a race condition. This could lead to local escal…
-
High 7.8
In multiple functions of NotificationStation.java, there is a possible cross-profile information disclosure due to a co…
-
High 7.8
In grantAllowlistedPackagePermissions of SettingsSliceProvider.java, there is a possible way for a third party app to m…
-
High 7.8
In disassociate of DisassociationProcessor.java, there is a possible way for an app to continue reading notifications w…
-
High 7.8
In multiple functions of Session.java, there is a possible way to view images belonging to a different user of the devi…
-
High 7.8
In multiple functions of Session.java, there is a possible way to view images belonging to a different user of the devi…
-
Medium 6.7
In ensureBound of RemotePrintService.java, there is a possible way for a background app to keep foreground permissions …
-
Medium 6.7
In notifyTimeout of CallRedirectionProcessor.java, there is a possible persistent connection due to improper input vali…
-
High 7.8
In multiple locations, there is a possible way to leak audio files across user profiles due to a confused deputy. This …
-
Medium 4.7
Side-channel information leakage in Navigation and Loading in Google Chrome prior to 139.0.7258.66 allowed a remote att…
-
High 8.8
Use after free in Digital Credentials in Google Chrome prior to 143.0.7499.41 allowed a remote attacker who had comprom…
-
High 7.5
Race in v8 in Google Chrome prior to 143.0.7499.41 allowed a remote attacker to potentially exploit heap corruption via…
-
High 8.8
Bad cast in Loader in Google Chrome prior to 143.0.7499.41 allowed a remote attacker who had compromised the renderer p…
-
Low 3.5
Inappropriate implementation in Passwords in Google Chrome prior to 143.0.7499.41 allowed a local attacker to bypass au…
-
High 8.8
Use after free in Media Stream in Google Chrome prior to 143.0.7499.41 allowed a remote attacker to potentially exploit…
-
High 8.1
Inappropriate implementation in WebRTC in Google Chrome prior to 143.0.7499.41 allowed a remote attacker to perform arb…
-
Medium 4.3
Inappropriate implementation in Downloads in Google Chrome prior to 143.0.7499.41 allowed a remote attacker who convinc…
-
Medium 4.3
Inappropriate implementation in Split View in Google Chrome prior to 143.0.7499.41 allowed a remote attacker who convin…
-
Medium 4.4
Inappropriate implementation in Downloads in Google Chrome on Windows prior to 143.0.7499.41 allowed a local attacker t…
-
Medium 4.4
Inappropriate implementation in Downloads in Google Chrome prior to 143.0.7499.41 allowed a local attacker to perform U…
-
Medium 5.4
Inappropriate implementation in DevTools in Google Chrome prior to 143.0.7499.41 allowed an attacker who convinced a us…
-
High 8.8
Inappropriate implementation in Google Updater in Google Chrome on Mac prior to 143.0.7499.41 allowed a remote attacker…
-
High 8.8
Type Confusion in V8 in Google Chrome prior to 143.0.7499.41 allowed a remote attacker to potentially exploit heap corr…
-
Medium 5.6
Arbitrary node_modules Directory Deletion in Google zx
When zx is invoked with --prefer-local=<path>, the CLI creates a symlink named ./node_modules pointing to <path>/node_modules. Due to a logic error in src/cli.ts (linkNodeModules / cleanup), the function returns the target path instead of the alias (symlink p…
-
Low 1.9CVE-2025-13425 Public exploit
Denial of Service in OSV-SCALIBR
A bug in the filesystem traversal fallback path causes fs/diriterate/diriterate.go:Next() to overindex an empty slice when ReadDir returns nil for an empty directory, resulting in a panic (index out of range) and an application crash (denial of service) in OS…
-
High 8.0CVE-2025-48593 Public exploit
In bta_hf_client_cb_init of bta_hf_client_main.cc, there is a possible remote code execution due to a use after free. T…
-
High 8.8
Type Confusion in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to potentially exploit heap corr…
-
High 8.8
Type Confusion in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to potentially exploit heap corr…