Vulnerabilidades de Google
CVEs publicadas que afetam produtos de Google: 4517 registro(s), com severidade, exploração e correções.
Chrome 3829Android 628Mcp Toolbox For Databases 14MCP Toolbox for Databases (googleapis/mcp-toolbox) 6Mcp-toolbox 5SAM 3Chrome-devtools-mcp 3Libjxl 2Keras 2gVisor 2Android Xr 2Go-attestation 2OSV-SCALIBR 2Turbinia 1Nest 1Tink Java 1A2ui/web Core 1Common Expression Language 1Tink-Android 1Google-ADK 1Agent Development Kit (ADK) for Python 1Woff2 1Langfun 1Android Wear 1Cel-go 1Site Kit by Google 1Protobuf-javascript (aka Google-protobuf Npm Package) 1Mcp-toolbox-sdk-python 1Fuse-archive 1ADK TypeScript (@google/adk) 1Brotli 1Agent Development Kit (ADK) for Java 1Gerrit 1V8 1Libvpx 1Libwebp 1Security Operations Soar 1Nest Wifi Router Firmware 1Nest Wifi Point Firmware 1Nest Wifi Pro Firmware 1
CVE-2024-4761
Alta · 8.8
KEV Alta · 61 Exploit público CWE-787 14/05/2024
Google Chromium V8 Out-of-Bounds Memory Write Vulnerability
Out of bounds write in V8 in Google Chrome prior to 124.0.6367.207 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: High)
CVE-2024-4671
Crítica · 9.6
KEV Alta · 59 CWE-416 14/05/2024
Google Chromium Visuals Use-After-Free Vulnerability
Use after free in Visuals in Google Chrome prior to 124.0.6367.201 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
CVE-2024-29745
Média · 5.5
KEV CWE-908 05/04/2024
Android Pixel Information Disclosure Vulnerability
there is a possible Information Disclosure due to uninitialized data. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2024-29748
Alta · 7.8
KEV Alta · 49 CWE-755 05/04/2024
Android Pixel Privilege Escalation Vulnerability
there is a possible way to bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.
CVE-2024-0519
Alta · 8.8
KEV Alta · 60 Exploit público CWE-787 16/01/2024
Google Chromium V8 Out-of-Bounds Memory Access Vulnerability
Out of bounds memory access in V8 in Google Chrome prior to 120.0.6099.224 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVE-2023-7024
Alta · 8.8
KEV Alta · 61 Exploit público CWE-787 21/12/2023
Google Chromium WebRTC Heap Buffer Overflow Vulnerability
Heap buffer overflow in WebRTC in Google Chrome prior to 120.0.6099.129 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVE-2023-6345
Crítica · 9.6
KEV Alta · 63 CWE-190 29/11/2023
Google Skia Integer Overflow Vulnerability
Integer overflow in Skia in Google Chrome prior to 119.0.6045.199 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a malicious file. (Chromium security severity: High)
CVE-2023-5217
Alta · 8.8
KEV Alta · 62 Exploit público CWE-787 28/09/2023
Estouro de buffer no heap na codificação VP8 do libvpx no Google Chromium
Estouro de buffer no heap na codificação vp8 no libvpx do Google Chrome anterior à 117.0.5938.132 e libvpx 1.13.1 permitia que um atacante remoto potencialmente explorasse corrupção de heap por meio de uma página HTML criada. (Gravidade de segurança do Chromium: Alta)
CVE-2023-4863
Alta · 8.8
KEV Alta · 62 Exploit público CWE-787 12/09/2023
Estouro de buffer baseado em heap no libwebp do Google Chromium
Estouro de buffer baseado em heap na libwebp no Google Chrome anterior a 116.0.5845.187 e libwebp 1.3.2 permitiu que um atacante remoto realizasse uma escrita fora dos limites de memória por meio de uma página HTML criada. (Gravidade de segurança do Chromium: Crítica)
CVE-2023-35674
Alta · 7.8
KEV Alta · 60 Exploit público CWE-269 11/09/2023
Android Framework Privilege Escalation Vulnerability
In onCreate of WindowState.java, there is a possible way to launch a background activity due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2023-4762
Alta · 8.8
KEV Alta · 62 Exploit público CWE-843 05/09/2023
Google Chromium V8 Type Confusion Vulnerability
Type Confusion in V8 in Google Chrome prior to 116.0.5845.179 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)
CVE-2023-21237
Média · 5.5
KEV CWE-200 28/06/2023
Android Pixel Information Disclosure Vulnerability
In applyRemoteView of NotificationContentInflater.java, there is a possible way to hide foreground service notification due to misleading or insufficient UI. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-251586912
CVE-2023-3079
Alta · 8.8
KEV Alta · 62 Exploit público CWE-843 05/06/2023
Google Chromium V8 Type Confusion Vulnerability
Type confusion in V8 in Google Chrome prior to 114.0.5735.110 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVE-2023-2468
Média · 4.3
02/05/2023
Inappropriate implementation in PictureInPicture in Google Chrome prior to 113.0.5672.63 allowed...
Inappropriate implementation in PictureInPicture in Google Chrome prior to 113.0.5672.63 allowed a remote attacker who had compromised the renderer process to obfuscate the security UI via a crafted HTML page. (Chromium security severity: Low)
CVE-2023-2462
Média · 4.3
02/05/2023
Inappropriate implementation in Prompts in Google Chrome prior to 113.0.5672.63 allowed a remote...
Inappropriate implementation in Prompts in Google Chrome prior to 113.0.5672.63 allowed a remote attacker to obfuscate main origin data via a crafted HTML page. (Chromium security severity: Medium)
CVE-2023-2136
Crítica · 9.6
KEV Alta · 59 CWE-190 19/04/2023
Google Chrome Skia Integer Overflow Vulnerability
Integer overflow in Skia in Google Chrome prior to 112.0.5615.137 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
CVE-2023-2033
Alta · 8.8
KEV Alta · 62 Exploit público CWE-843 14/04/2023
Google Chromium V8 Type Confusion Vulnerability
Type confusion in V8 in Google Chrome prior to 112.0.5615.121 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVE-2023-20963
Alta · 7.8
KEV Alta · 58 Exploit público CWE-295 24/03/2023
Android Framework Privilege Escalation Vulnerability
In WorkSource, there is a possible parcel mismatch. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-12 Android-12L Android-13Android ID: A-220302519
CVE-2023-20627
Média · 6.7
CWE-131 07/03/2023
In pqframework, there is a possible out of bounds write due to a missing bounds check…
In pqframework, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07629585; Issue ID: ALPS07629585.
CVE-2023-0704
Média · 6.5
CWE-602 07/02/2023
Insufficient policy enforcement in DevTools in Google Chrome prior to 110.0.5481.77 allowed a...
Insufficient policy enforcement in DevTools in Google Chrome prior to 110.0.5481.77 allowed a remote attacker to bypass same origin policy and proxy settings via a crafted HTML page. (Chromium security severity: Low)
CVE-2023-0698
Alta · 8.8
CWE-125 07/02/2023
Out of bounds read in WebRTC in Google Chrome prior to 110.0.5481.77 allowed a remote attacker to...
Out of bounds read in WebRTC in Google Chrome prior to 110.0.5481.77 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: High)
CVE-2023-0697
Média · 6.5
07/02/2023
Inappropriate implementation in Full screen mode in Google Chrome on Android prior to 110.0.5481...
Inappropriate implementation in Full screen mode in Google Chrome on Android prior to 110.0.5481.77 allowed a remote attacker to spoof the contents of the security UI via a crafted HTML page. (Chromium security severity: High)
CVE-2022-20572
Média · 6.7
CWE-862 16/12/2022
In verity_target of dm-verity-target.c, there is a possible way to modify read-only files due to...
In verity_target of dm-verity-target.c, there is a possible way to modify read-only files due to a missing permission check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-234475629References: Upstream kernel
CVE-2022-20566
Alta · 7.8
CWE-416 16/12/2022
In l2cap_chan_put of l2cap_core, there is a possible use after free due to improper locking. This...
In l2cap_chan_put of l2cap_core, there is a possible use after free due to improper locking. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-165329981References: Upstream kernel
CVE-2022-4262
Alta · 8.8
KEV Alta · 62 Exploit público CWE-843 02/12/2022
Google Chromium V8 Type Confusion Vulnerability
Type confusion in V8 in Google Chrome prior to 108.0.5359.94 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)