CVE Intelligence

Google vulnerabilities

🔔 Create alert RSS

Published CVEs affecting Google products: 4517 record(s), with severity, exploitation and fixes.

Chrome 3829Android 628Mcp Toolbox For Databases 14MCP Toolbox for Databases (googleapis/mcp-toolbox) 6Mcp-toolbox 5SAM 3Chrome-devtools-mcp 3Libjxl 2Keras 2gVisor 2Android Xr 2Go-attestation 2OSV-SCALIBR 2Turbinia 1Nest 1Tink Java 1A2ui/web Core 1Common Expression Language 1Tink-Android 1Google-ADK 1Agent Development Kit (ADK) for Python 1Woff2 1Langfun 1Android Wear 1Cel-go 1Site Kit by Google 1Protobuf-javascript (aka Google-protobuf Npm Package) 1Mcp-toolbox-sdk-python 1Fuse-archive 1ADK TypeScript (@google/adk) 1Brotli 1Agent Development Kit (ADK) for Java 1Gerrit 1V8 1Libvpx 1Libwebp 1Security Operations Soar 1Nest Wifi Router Firmware 1Nest Wifi Point Firmware 1Nest Wifi Pro Firmware 1

Exploited only (KEV) →

CVE-2026-3541 High · 8.8 CWE-284 Mar 4, 2026
Improper Access Control in Google Chrome
Inappropriate implementation in CSS in Google Chrome prior to 145.0.7632.159 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: High)
CVE-2026-3540 High · 8.8 CWE-125 Mar 4, 2026
Out-of-bounds Read in Google Chrome
Inappropriate implementation in WebAudio in Google Chrome prior to 145.0.7632.159 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)
CVE-2026-3538 High · 8.8 CWE-191 Mar 4, 2026
Integer Underflow in Google Chrome
Integer overflow in Skia in Google Chrome prior to 145.0.7632.159 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page. (Chromium security severity: Critical)
CVE-2026-3537 High · 8.8 CWE-787 Mar 4, 2026
Out-of-bounds Write in Google Chrome
Object lifecycle issue in PowerVR in Google Chrome on Android prior to 145.0.7632.159 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical)
CVE-2026-3536 High · 8.8 CWE-472 Mar 4, 2026
Integer overflow in ANGLE in Google Chrome prior to 145.0.7632.159 allowed a remote…
Integer overflow in ANGLE in Google Chrome prior to 145.0.7632.159 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page. (Chromium security severity: Critical)
CVE-2026-3136 Critical · 9.8 CWE-863 Mar 3, 2026
Google Cloud Build Comment Control Bypass
An improper authorization vulnerability in GitHub Trigger Comment Control in Google Cloud Build prior to 2026-1-26 allows a remote attacker to execute arbitrary code in the build environment. This vulnerability was patched on 26 January 2026, and no customer action is needed.
CVE-2026-0047 High · 8.4 CWE-280 Mar 2, 2026
In dumpBitmapsProto of ActivityManagerService.java, there is a possible way for an app…
In dumpBitmapsProto of ActivityManagerService.java, there is a possible way for an app to access private information due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-0038 High · 8.4 Mar 2, 2026
In multiple functions of mem_protect.c, there is a possible way to execute arbitrary…
In multiple functions of mem_protect.c, there is a possible way to execute arbitrary code due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-0037 High · 8.4 CWE-787 Mar 2, 2026
Out-of-bounds Write in Google Android
In multiple functions of ffa.c, there is a possible memory corruption due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-0035 High · 8.4 CWE-125 Mar 2, 2026
Out-of-bounds Read in Google Android
In createRequest of MediaProvider.java, there is a possible way for an app to gain read/write access to non-existing files due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-0034 High · 8.4 CWE-20 Mar 2, 2026
Improper Input Validation in Google Android
In setPackageOrComponentEnabled of ManagedServices.java, there is a possible notification policy desync due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-0032 High · 7.8 CWE-787 Mar 2, 2026
Out-of-bounds Write in Google Android
In multiple functions of mem_protect.c, there is a possible out-of-bounds write due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-0031 High · 8.4 CWE-190 Mar 2, 2026
Integer Overflow or Wraparound in Google Android
In multiple functions of mem_protect.c, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-0030 High · 8.4 CWE-787 Mar 2, 2026
Out-of-bounds Write in Google Android
In __host_check_page_state_range of mem_protect.c, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-0029 High · 8.4 CWE-269 Mar 2, 2026
Improper Privilege Management in Google Android
In __pkvm_init_vm of pkvm.c, there is a possible memory corruption due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-0028 High · 8.4 CWE-190 Mar 2, 2026
Integer Overflow or Wraparound in Google Android
In __pkvm_host_share_guest of mem_protect.c, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-0027 Medium · 6.7 CWE-416 Mar 2, 2026
Use After Free in Google Android
In smmu_detach_dev of arm-smmu-v3.c, there is a possible out of bounds write due to a use after free. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-0026 High · 7.8 CWE-862 Mar 2, 2026
Missing Authorization in Google Android
In removePermission of PermissionManagerServiceImpl.java, there is a possible way to override any system permission due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.
CVE-2026-0025 High · 8.4 CWE-200 Mar 2, 2026
Exposure of Sensitive Information in Google Android
In hasImage of Notification.java, there is a possible way to reveal information across users due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-0024 Medium · 4.0 CWE-862 Mar 2, 2026
Missing Authorization in Google Android
In isRedactionNeededForOpenViaContentResolver of MediaProvider.java, there is a possible way to reveal the location of media due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-0023 High · 7.8 CWE-269 Mar 2, 2026
Improper Privilege Management in Google Android
In createSessionInternal of PackageInstallerService.java, there is a possible way for an app to update its ownership due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-0021 High · 8.4 CWE-441 Mar 2, 2026
In hasInteractAcrossUsersFullPermission of AppInfoBase.java, there is a possible…
In hasInteractAcrossUsersFullPermission of AppInfoBase.java, there is a possible cross-user permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-0020 High · 8.4 CWE-639 Mar 2, 2026
Authorization Bypass Through User-Controlled Key (IDOR) in Google Android
In parsePermissionGroup of ParsedPermissionUtils.java, there is a possible way to bypass a consent dialog to obtain permissions due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-0017 High · 7.7 CWE-285 Mar 2, 2026
Improper Authorization in Google Android
In onChange of BiometricService.java, there is a possible way to enable fingerprint unlock due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-0015 Medium · 6.2 CWE-20 Mar 2, 2026
Improper Input Validation in Google Android
In multiple locations of AppOpsService.java, there is a possible persistent denial of service due to improper input validation. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.