Vendor
9,109 known vulnerabilities.
Products
Chrome 6,157
Android 2,760
Asylo 16
ChromeOS 12
AngularJS 6
MCP Toolbox for Databases (googleapis/mcp-toolbox) 6
gVisor 6
gRPC 6
Dart SDK 5
mcp-toolbox 5
libjxl 4
Keras 4
Guava 3
go-attestation 3
SAM 3
Android XR 3
fscrypt 3
MCP Toolbox for Databases 3
Protocolbuffers 3
OSV-SCALIBR 3
Nearby 3
Fuchsia 3
guest-oslogin 3
AWS S3 Crypto SDK for GoLang 2
Nest Wifi Pro 2
Brotli 2
Web Designer 2
Tink 2
Pixel Watch 2
Fuchsia Kernel 2
Omaha 2
zx 2
protobuf-java 2
Web Stories 2
protobuf-kotlin 2
google-protobuf [JRuby Gem] 2
Site Kit by Google 2
Andrioid 2
Agent Development Kit (ADK) for Python 1
nodejs-firestore 1
9,109 results · Feed
-
High 8.8
Out of bounds read in Compositing in Google Chrome prior to 156.0.8078.73 allowed a remote attacker who had compromised…
-
Critical 9.6
Use after free in V8 in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside…
-
High 8.8
Buffer overflow in PDFium in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code i…
-
High 8.8
Use after free in ImageCapture in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary c…
-
High 8.8
Use after free in ReadingList in Google Chrome prior to 156.0.8078.73 allowed a remote attacker leveraging social engin…
-
High 8.8
Use after free in Media in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitr…
-
Critical 9.6
Use after free in Compositing in Google Chrome prior to 156.0.8078.73 allowed a remote attacker who had compromised the…
-
High 8.8
Use after free in Payments in Google Chrome prior to 156.0.8078.73 allowed a remote attacker leveraging social engineer…
-
High 8.8
Use after free in V8 in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside…
-
High 8.8
Missing authorization in Paint in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to obtain cross-origin…
-
High 8.8
Incorrect authorization in Media in Google Chrome prior to 156.0.8078.73 allowed a remote attacker leveraging social en…
-
High 8.8
Race condition in Headless in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arb…
-
High 8.8
Out of bounds read in WebRTC in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to read memory inside th…
-
Medium 5.4
Buffer overflow in Video in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code in…
-
High 8.8
Use after free in WebAudio in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code …
-
Critical 9.6
Use after free in Command in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code i…
-
High 8.8
Use after free in Skia in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code outs…
-
High 8.8
Use after free in Paint in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code ins…
-
Medium 5.4
Use after free in Forms in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code ins…
-
High 8.8
Use after free in Cache in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code out…
-
High 8.8
Uninitialized resource in Skia in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to obtain cross-origin…
-
Critical 9.6
Integer overflow in Skia in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to obtain cross-origin data …
-
High 8.8
Uninitialized resource in ANGLE in Google Chrome on on Mac prior to 156.0.8078.73 allowed a remote attacker to read mem…
-
Critical 9.6
Use after free in Core in Google Chrome on on Android prior to 156.0.8078.73 allowed a remote attacker who had compromi…
-
High 8.8
Use after free in HTML in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code insi…
-
High 8.8
Race condition in V8 in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary…
-
Critical 9.6
Type confusion in Turbolev in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code …
-
Medium 4.3
Uninitialized resource in ANGLE in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to read memory outsid…
-
High 8.8
Use after free in FileSystem in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary cod…
-
High 8.8
Type confusion in Turbolev in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code …
-
Medium 4.3
Buffer overflow in V8 in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code insid…
-
High 8.8
Use after free in Animation in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code…
-
High 8.8
Use after free in FileAPI in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code o…
-
High 8.8
Integer overflow in Skia in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbit…
-
High 8.8
Use after free in Layout in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code in…
-
Critical 9.6CVE-2026-118306 Public exploit
Use after free in FileSystem in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary cod…
-
High 7.2
Cross-Site WebSocket Hijacking and Permissive CORS in Google Agent Development Kit (ADK) for Java Development Server
Missing Origin Validation in WebSockets (CWE-1385) and Permissive Cross-domain Policy with Untrusted Domains (CWE-942) in the development web server (ADK Web) in Google Agent Development Kit (ADK) for Java (com.google.adk:google-adk-dev versions 0.1.0 before …
-
Critical 9.2
Out-of-Bounds Write in Google Brotli Decoder
A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause …
KEV Oct 27, 2026 -
High 8.8
Unauthenticated Biscuit Credential Disclosure via GET /enroll/status in Google OSS Agent Mesh (SAM)
Missing Authentication for Critical Function (CWE-306) and Insufficiently Protected Credentials (CWE-522) in the control plane enrollment status handler (HandleEnrollStatus at GET /enroll/status in internal/controlplane/server.go) in Google OSS Agent Mesh (SA…
-
High 8.8
Cross-site scripting in ReadingMode in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to spoof UI eleme…