Vulnerabilidades de Google
CVEs publicadas que afetam produtos de Google: 4517 registro(s), com severidade, exploração e correções.
Chrome 3829Android 628Mcp Toolbox For Databases 14MCP Toolbox for Databases (googleapis/mcp-toolbox) 6Mcp-toolbox 5SAM 3Chrome-devtools-mcp 3Libjxl 2Keras 2gVisor 2Android Xr 2Go-attestation 2OSV-SCALIBR 2Turbinia 1Nest 1Tink Java 1A2ui/web Core 1Common Expression Language 1Tink-Android 1Google-ADK 1Agent Development Kit (ADK) for Python 1Woff2 1Langfun 1Android Wear 1Cel-go 1Site Kit by Google 1Protobuf-javascript (aka Google-protobuf Npm Package) 1Mcp-toolbox-sdk-python 1Fuse-archive 1ADK TypeScript (@google/adk) 1Brotli 1Agent Development Kit (ADK) for Java 1Gerrit 1V8 1Libvpx 1Libwebp 1Security Operations Soar 1Nest Wifi Router Firmware 1Nest Wifi Point Firmware 1Nest Wifi Pro Firmware 1
CVE-2026-10003
Alta · 7.5
CWE-416 28/05/2026
Use After Free em Google Chrome
Use after free in Views in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)
CVE-2026-10002
Alta · 8.8
CWE-416 28/05/2026
Use After Free em Google Chrome
Use after free in PDFium in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file. (Chromium security severity: High)
CVE-2026-10001
Alta · 8.3
CWE-416 28/05/2026
Use After Free em Google Chrome
Use after free in PerformanceManager in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
CVE-2026-10000
Alta · 8.3
CWE-416 28/05/2026
Use After Free em Google Chrome
Use after free in Passwords in Google Chrome on Windows prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
CVE-2026-9739
Crítica · 9.4
CWE-942 27/05/2026
MCP Toolbox for Databases vulnerable to DNS rebinding attacks
Vulnerable to DNS rebinding attacks when using SSE (http://b/499408790). During the beta phase, we implemented `allowed-origins` and `allowed-hosts` flags to align with MCP security guidelines. However, the hardcoded `Access-Control-Allow-Origin: *` header in the SSE initialization handler was inadvertently retained. This vulnerability specifically impacts users connecting via Toolbox using SSE under specification v2024-11-05.
CVE-2026-9126
Alta · 8.8
CWE-416 20/05/2026
Use After Free em Google Chrome
Use after free in DOM in Google Chrome on prior to 148.0.7778.179 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-9124
Média · 5.3
CWE-20 20/05/2026
Improper Input Validation em Google Chrome
Insufficient validation of untrusted input in Input in Google Chrome on prior to 148.0.7778.179 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-9123
Alta · 7.5
CWE-122 20/05/2026
Heap-based Buffer Overflow em Google Chrome
Heap buffer overflow in Chromecast in Google Chrome on Android, Linux, ChromeOS prior to 148.0.7778.179 allowed a local attacker to execute arbitrary code inside a sandbox via malicious network traffic. (Chromium security severity: Medium)
CVE-2026-9122
Média · 6.5
CWE-125 20/05/2026
Out-of-bounds Read em Google Chrome
Out of bounds read in GPU in Google Chrome on Mac prior to 148.0.7778.179 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-9121
Alta · 8.8
CWE-125 20/05/2026
Out-of-bounds Read em Google Chrome
Out of bounds read in GPU in Google Chrome on prior to 148.0.7778.179 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-9120
Alta · 8.8
CWE-416 20/05/2026
Use After Free em Google Chrome
Use after free in WebRTC in Google Chrome prior to 148.0.7778.179 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)
CVE-2026-9119
Alta · 8.8
CWE-122 20/05/2026
Heap-based Buffer Overflow em Google Chrome
Heap buffer overflow in WebRTC in Google Chrome on prior to 148.0.7778.179 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-9118
Alta · 8.8
CWE-416 20/05/2026
Use After Free em Google Chrome
Use after free in XR in Google Chrome on Windows prior to 148.0.7778.179 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)
CVE-2026-9117
Alta · 7.5
CWE-843 20/05/2026
Type Confusion em Google Chrome
Type Confusion in GFX in Google Chrome on Linux, ChromeOS prior to 148.0.7778.179 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted video file. (Chromium security severity: High)
CVE-2026-9116
Média · 4.3
CWE-693 20/05/2026
Insufficient policy enforcement in ServiceWorker in Google Chrome on prior to…
Insufficient policy enforcement in ServiceWorker in Google Chrome on prior to 148.0.7778.179 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)
CVE-2026-9115
Média · 4.3
CWE-693 20/05/2026
Insufficient policy enforcement in Service Worker in Google Chrome on prior to…
Insufficient policy enforcement in Service Worker in Google Chrome on prior to 148.0.7778.179 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: High)
CVE-2026-9114
Alta · 8.8
CWE-416 20/05/2026
Use After Free em Google Chrome
Use after free in QUIC in Google Chrome on prior to 148.0.7778.179 allowed a remote attacker to execute arbitrary code inside a sandbox via malicious network traffic. (Chromium security severity: High)
CVE-2026-9113
Média · 4.3
CWE-125 20/05/2026
Out-of-bounds Read em Google Chrome
Out of bounds read in GPU in Google Chrome on Mac prior to 148.0.7778.179 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: High)
CVE-2026-9112
Alta · 8.8
CWE-416 20/05/2026
Use After Free em Google Chrome
Use after free in GPU in Google Chrome on Windows prior to 148.0.7778.179 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-9111
Alta · 8.8
CWE-416 20/05/2026
Use After Free em Google Chrome
Use after free in WebRTC in Google Chrome on Linux prior to 148.0.7778.179 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: Critical)
CVE-2026-9110
Média · 4.2
CWE-451 20/05/2026
Inappropriate implementation in UI in Google Chrome on Windows prior to 148.0.7778.179…
Inappropriate implementation in UI in Google Chrome on Windows prior to 148.0.7778.179 allowed a remote attacker who had compromised the renderer process to perform UI spoofing via a crafted HTML page. (Chromium security severity: Critical)
CVE-2026-8587
Alta · 8.8
CWE-416 14/05/2026
Use after free in Extensions in Google Chrome on Mac prior to 148.0.7778.168 allowed an attacker...
Use after free in Extensions in Google Chrome on Mac prior to 148.0.7778.168 allowed an attacker who convinced a user to install a malicious extension to execute arbitrary code via a crafted Chrome Extension. (Chromium security severity: Medium)
CVE-2026-8586
Média · 5.5
CWE-284 14/05/2026
Inappropriate implementation in Chromoting in Google Chrome prior to 148.0.7778.168 allowed a...
Inappropriate implementation in Chromoting in Google Chrome prior to 148.0.7778.168 allowed a local attacker to bypass discretionary access control via a malicious file. (Chromium security severity: Medium)
CVE-2026-8585
Alta · 7.5
CWE-693 14/05/2026
Inappropriate implementation in Media in Google Chrome on iOS prior to 148.0.7778.168…
Inappropriate implementation in Media in Google Chrome on iOS prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-8584
Média · 4.2
CWE-451 14/05/2026
Inappropriate implementation in Views in Google Chrome on iOS prior to 148.0.7778.168 allowed a...
Inappropriate implementation in Views in Google Chrome on iOS prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)