Google vulnerabilities
Published CVEs affecting Google products: 4517 record(s), with severity, exploitation and fixes.
Chrome 3829Android 628Mcp Toolbox For Databases 14MCP Toolbox for Databases (googleapis/mcp-toolbox) 6Mcp-toolbox 5SAM 3Chrome-devtools-mcp 3Libjxl 2Keras 2gVisor 2Android Xr 2Go-attestation 2OSV-SCALIBR 2Turbinia 1Nest 1Tink Java 1A2ui/web Core 1Common Expression Language 1Tink-Android 1Google-ADK 1Agent Development Kit (ADK) for Python 1Woff2 1Langfun 1Android Wear 1Cel-go 1Site Kit by Google 1Protobuf-javascript (aka Google-protobuf Npm Package) 1Mcp-toolbox-sdk-python 1Fuse-archive 1ADK TypeScript (@google/adk) 1Brotli 1Agent Development Kit (ADK) for Java 1Gerrit 1V8 1Libvpx 1Libwebp 1Security Operations Soar 1Nest Wifi Router Firmware 1Nest Wifi Point Firmware 1Nest Wifi Pro Firmware 1
CVE-2026-10003
High · 7.5
CWE-416 May 28, 2026
Use After Free in Google Chrome
Use after free in Views in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)
CVE-2026-10002
High · 8.8
CWE-416 May 28, 2026
Use After Free in Google Chrome
Use after free in PDFium in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file. (Chromium security severity: High)
CVE-2026-10001
High · 8.3
CWE-416 May 28, 2026
Use After Free in Google Chrome
Use after free in PerformanceManager in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
CVE-2026-10000
High · 8.3
CWE-416 May 28, 2026
Use After Free in Google Chrome
Use after free in Passwords in Google Chrome on Windows prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
CVE-2026-9739
Critical · 9.4
CWE-942 May 27, 2026
MCP Toolbox for Databases vulnerable to DNS rebinding attacks
Vulnerable to DNS rebinding attacks when using SSE (http://b/499408790). During the beta phase, we implemented `allowed-origins` and `allowed-hosts` flags to align with MCP security guidelines. However, the hardcoded `Access-Control-Allow-Origin: *` header in the SSE initialization handler was inadvertently retained. This vulnerability specifically impacts users connecting via Toolbox using SSE under specification v2024-11-05.
CVE-2026-9126
High · 8.8
CWE-416 May 20, 2026
Use After Free in Google Chrome
Use after free in DOM in Google Chrome on prior to 148.0.7778.179 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-9124
Medium · 5.3
CWE-20 May 20, 2026
Improper Input Validation in Google Chrome
Insufficient validation of untrusted input in Input in Google Chrome on prior to 148.0.7778.179 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-9123
High · 7.5
CWE-122 May 20, 2026
Heap-based Buffer Overflow in Google Chrome
Heap buffer overflow in Chromecast in Google Chrome on Android, Linux, ChromeOS prior to 148.0.7778.179 allowed a local attacker to execute arbitrary code inside a sandbox via malicious network traffic. (Chromium security severity: Medium)
CVE-2026-9122
Medium · 6.5
CWE-125 May 20, 2026
Out-of-bounds Read in Google Chrome
Out of bounds read in GPU in Google Chrome on Mac prior to 148.0.7778.179 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-9121
High · 8.8
CWE-125 May 20, 2026
Out-of-bounds Read in Google Chrome
Out of bounds read in GPU in Google Chrome on prior to 148.0.7778.179 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-9120
High · 8.8
CWE-416 May 20, 2026
Use After Free in Google Chrome
Use after free in WebRTC in Google Chrome prior to 148.0.7778.179 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)
CVE-2026-9119
High · 8.8
CWE-122 May 20, 2026
Heap-based Buffer Overflow in Google Chrome
Heap buffer overflow in WebRTC in Google Chrome on prior to 148.0.7778.179 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-9118
High · 8.8
CWE-416 May 20, 2026
Use After Free in Google Chrome
Use after free in XR in Google Chrome on Windows prior to 148.0.7778.179 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)
CVE-2026-9117
High · 7.5
CWE-843 May 20, 2026
Type Confusion in Google Chrome
Type Confusion in GFX in Google Chrome on Linux, ChromeOS prior to 148.0.7778.179 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted video file. (Chromium security severity: High)
CVE-2026-9116
Medium · 4.3
CWE-693 May 20, 2026
Insufficient policy enforcement in ServiceWorker in Google Chrome on prior to…
Insufficient policy enforcement in ServiceWorker in Google Chrome on prior to 148.0.7778.179 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)
CVE-2026-9115
Medium · 4.3
CWE-693 May 20, 2026
Insufficient policy enforcement in Service Worker in Google Chrome on prior to…
Insufficient policy enforcement in Service Worker in Google Chrome on prior to 148.0.7778.179 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: High)
CVE-2026-9114
High · 8.8
CWE-416 May 20, 2026
Use After Free in Google Chrome
Use after free in QUIC in Google Chrome on prior to 148.0.7778.179 allowed a remote attacker to execute arbitrary code inside a sandbox via malicious network traffic. (Chromium security severity: High)
CVE-2026-9113
Medium · 4.3
CWE-125 May 20, 2026
Out-of-bounds Read in Google Chrome
Out of bounds read in GPU in Google Chrome on Mac prior to 148.0.7778.179 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: High)
CVE-2026-9112
High · 8.8
CWE-416 May 20, 2026
Use After Free in Google Chrome
Use after free in GPU in Google Chrome on Windows prior to 148.0.7778.179 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-9111
High · 8.8
CWE-416 May 20, 2026
Use After Free in Google Chrome
Use after free in WebRTC in Google Chrome on Linux prior to 148.0.7778.179 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: Critical)
CVE-2026-9110
Medium · 4.2
CWE-451 May 20, 2026
Inappropriate implementation in UI in Google Chrome on Windows prior to 148.0.7778.179…
Inappropriate implementation in UI in Google Chrome on Windows prior to 148.0.7778.179 allowed a remote attacker who had compromised the renderer process to perform UI spoofing via a crafted HTML page. (Chromium security severity: Critical)
CVE-2026-8587
High · 8.8
CWE-416 May 14, 2026
Use after free in Extensions in Google Chrome on Mac prior to 148.0.7778.168 allowed an attacker...
Use after free in Extensions in Google Chrome on Mac prior to 148.0.7778.168 allowed an attacker who convinced a user to install a malicious extension to execute arbitrary code via a crafted Chrome Extension. (Chromium security severity: Medium)
CVE-2026-8586
Medium · 5.5
CWE-284 May 14, 2026
Inappropriate implementation in Chromoting in Google Chrome prior to 148.0.7778.168 allowed a...
Inappropriate implementation in Chromoting in Google Chrome prior to 148.0.7778.168 allowed a local attacker to bypass discretionary access control via a malicious file. (Chromium security severity: Medium)
CVE-2026-8585
High · 7.5
CWE-693 May 14, 2026
Inappropriate implementation in Media in Google Chrome on iOS prior to 148.0.7778.168…
Inappropriate implementation in Media in Google Chrome on iOS prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-8584
Medium · 4.2
CWE-451 May 14, 2026
Inappropriate implementation in Views in Google Chrome on iOS prior to 148.0.7778.168 allowed a...
Inappropriate implementation in Views in Google Chrome on iOS prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)