Skip to content
Noroxi

Google records

17,990 published records for vendor Google. 115 of them have been exploited in the wild (listed in CISA KEV) and 137 have a ready-made attack tool.

Filter by product ↓

Researcher profile

Entered KEV
115 · 0.6%
Weaponized
137 · 0.8%
Pre-auth RCE
2,293
With a fix record
44.9%
Median publish → KEV
26 days

Pre-auth RCE: flaws that let an attacker run code over the network without an account. Median publish → KEV: the typical time between a record being published and CISA listing it as exploited.

Records by year

  1. 16
  2. 17
  3. 18
  4. 19
  5. 20
  6. 21
  7. 22
  8. 23
  9. 24
  10. 25
  11. 26

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

10,000+ records
  • CVE-2014-0497
    99Now

    Integer underflow in Adobe Flash Player before 11.7.700.261 and 11.8.x through 12.0.x before 12.0.0.44 on Windows and Mac OS X, and before 1

    CriticalCVSS 9.8KEVWeaponizedEPSS 99%

    adobe · flash playerFeb 5, 2014

  • CVE-2023-4863
    95Now

    Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of bo

    HighCVSS 8.8KEVWeaponizedEPSS 99%

    google · chromeSep 12, 2023

  • CVE-2011-0611
    95Now

    Adobe Flash Player before 10.2.154.27 on Windows, Mac OS X, Linux, and Solaris and 10.2.156.12 and earlier on Android; Adobe AIR before 2.6.

    HighCVSS 8.8KEVWeaponizedEPSS 99%

    adobe · flash playerApr 13, 2011

  • CVE-2026-111497
    91Now

    Out-of-Bounds Write in Google Brotli Decoder

    CriticalCVSS 9.2KEVWeaponizedEPSS 82%

    google · brotliOct 22, 2026

  • CVE-2018-17463
    90Now

    Incorrect side effect annotation in V8 in Google Chrome prior to 70.0.3538.64 allowed a remote attacker to execute arbitrary code inside a s

    HighCVSS 8.8KEVWeaponizedEPSS 84%

    google · chromeNov 14, 2018

  • CVE-2021-21224
    90Now

    Type confusion in V8 in Google Chrome prior to 90.0.4430.85 allowed a remote attacker to execute arbitrary code inside a sandbox via a craft

    HighCVSS 8.8KEVWeaponizedEPSS 84%

    google · chromeApr 26, 2021

  • CVE-2012-0754
    89Now

    Adobe Flash Player before 10.3.183.15 and 11.x before 11.1.102.62 on Windows, Mac OS X, Linux, and Solaris; before 11.1.111.6 on Android 2.x

    HighCVSS 8.1KEVWeaponizedEPSS 91%

    adobe · flash playerFeb 16, 2012

  • CVE-2020-6418
    89Now

    Type confusion in V8 in Google Chrome prior to 80.0.3987.122 allowed a remote attacker to potentially exploit heap corruption via a crafted

    HighCVSS 8.8KEVWeaponizedEPSS 78%

    google · chromeFeb 27, 2020

  • CVE-2018-4878
    88Now

    A use-after-free vulnerability was discovered in Adobe Flash Player before 28.0.0.161.

    HighCVSS 7.8KEVWeaponizedEPSS 90%

    adobe · flash playerFeb 6, 2018

  • CVE-2018-15982
    88Now

    Flash Player versions 31.0.0.153 and earlier, and 31.0.0.108 and earlier have a use after free vulnerability.

    HighCVSS 7.8KEVWeaponizedEPSS 89%

    adobe · flash playerJan 18, 2019

  • CVE-2020-15999
    87Now

    Heap buffer overflow in Freetype in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploit heap corruption vi

    CriticalCVSS 9.6KEVWeaponizedEPSS 63%

    google · chromeNov 2, 2020

  • CVE-2022-2294
    86Now

    Heap buffer overflow in WebRTC in Google Chrome prior to 103.0.5060.114 allowed a remote attacker to potentially exploit heap corruption via

    HighCVSS 8.8KEVWeaponizedEPSS 70%

    google · chromeJul 27, 2022

  • CVE-2021-21220
    86Now

    Insufficient validation of untrusted input in V8 in Google Chrome prior to 89.0.4389.128 allowed a remote attacker to potentially exploit he

    HighCVSS 8.8KEVWeaponizedEPSS 70%

    google · chromeApr 26, 2021

  • CVE-2015-8651
    85Now

    Integer overflow in Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 on

    HighCVSS 8.8KEVWeaponizedEPSS 67%

    adobe · air sdkDec 28, 2015

  • CVE-2021-30551
    84Now

    Type confusion in V8 in Google Chrome prior to 91.0.4472.101 allowed a remote attacker to potentially exploit heap corruption via a crafted

    HighCVSS 8.8KEVWeaponizedEPSS 64%

    google · chromeJun 15, 2021

  • CVE-2021-30632
    84Now

    Out of bounds write in V8 in Google Chrome prior to 93.0.4577.82 allowed a remote attacker to potentially exploit heap corruption via a craf

    HighCVSS 8.8KEVWeaponizedEPSS 63%

    google · chromeOct 8, 2021

  • CVE-2019-2215
    83Now

    A use-after-free in binder.c allows an elevation of privilege from an application to the Linux Kernel.

    HighCVSS 7.8KEVWeaponizedEPSS 72%

    google · androidOct 11, 2019

  • CVE-2018-6065
    83Now

    Integer overflow in computing the required allocation size when instantiating a new javascript object in V8 in Google Chrome prior to 65.0.3

    HighCVSS 8.8KEVWeaponizedEPSS 60%

    google · chromeNov 14, 2018

  • CVE-2016-0984
    81Now

    Use-after-free vulnerability in Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2

    HighCVSS 8.8KEVWeaponizedEPSS 54%

    adobe · flash playerFeb 10, 2016

  • CVE-2026-2441
    81Now

    Use after free in CSS in Google Chrome prior to 145.0.7632.75 allowed a remote attacker to execute arbitrary code inside a sandbox via a cra

    HighCVSS 8.8KEVWeaponizedEPSS 54%

    google · chromeFeb 13, 2026

  • CVE-2011-0609
    80Now

    Unspecified vulnerability in Adobe Flash Player 10.2.154.13 and earlier on Windows, Mac OS X, Linux, and Solaris; 10.1.106.16 and earlier on

    HighCVSS 7.8KEVWeaponizedEPSS 63%

    adobe · flash playerMar 15, 2011

  • CVE-2019-13720
    80Now

    Use after free in WebAudio in Google Chrome prior to 78.0.3904.87 allowed a remote attacker to potentially exploit heap corruption via a cra

    HighCVSS 8.8KEVWeaponizedEPSS 49%

    google · chromeNov 25, 2019

  • CVE-2023-5217
    80Now

    Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a remote attacker to poten

    HighCVSS 8.8KEVWeaponizedEPSS 49%

    google · chromeSep 28, 2023

  • CVE-2020-16009
    79This week

    Inappropriate implementation in V8 in Google Chrome prior to 86.0.4240.183 allowed a remote attacker to potentially exploit heap corruption

    HighCVSS 8.8KEVWeaponizedEPSS 48%

    google · chromeNov 2, 2020

  • CVE-2016-1646
    79This week

    The Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, does not properly cons

    HighCVSS 8.8KEVWeaponizedEPSS 48%

    google · chromeMar 29, 2016