MSRXGoogle vulnerabilities being exploited
11 Google flaws were confirmed exploited in the wild in the past 365 days, across 6 products: Brotli, Chromium, Chromium V8, Dawn, Pixel, Skia. If you run any of them, patch these first.
| Added | Exploited vulnerability | Fix by |
|---|---|---|
| 2026-10-27 | CVE-2026-111497 Brotli Google Brotli Unchecked Return Value Vulnerability Google Brotli contains an unchecked return value vulnerability that allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. | 2026-11-10 |
| 2026-09-16 | CVE-2026-58704 Pixel Google Pixel Improper Authorization Vulnerability Google Pixel devices contain an improper authorization vulnerability in the cellular modem. A logic error may allow an attacker to bypass permission checks and escalate privileges. | 2026-09-19 |
| 2026-09-09 | CVE-2026-87491 Chromium V8 Google Chromium V8 Out of Bounds Write Vulnerability Google Chromium V8 contains an out of bounds write vulnerability that allows a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. | 2026-09-23 |
| 2026-09-04 | CVE-2026-85046 Chromium V8 Google Chromium V8 Type Confusion Vulnerability Google Chromium V8 contains a type confusion vulnerability that allows a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. | 2026-09-18 |
| 2026-06-09 | CVE-2026-11645 Chromium V8 Google Chromium V8 Out-of-Bounds Read and Write Vulnerability Google Chromium V8 out-of-bounds read and write vulnerability that could allow a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. | 2026-06-23 |
| 2026-04-01 | CVE-2026-5281 Dawn Google Dawn Use-After-Free Vulnerability Google Dawn contains an use-after-free vulnerability that could allow a remote attacker who had compromised the renderer process to execute arbitrary code via a crafted HTML page. This vulnerability could affect multiple Chromium-based products including, but not limited to, Google Chrome, Microsoft Edge, and Opera. | 2026-04-15 |
| 2026-03-13 | CVE-2026-3910 Chromium V8 Google Chromium V8 Improper Restriction of Operations Within the Bounds of a Memory Buffer Vulnerability Google Chromium V8 contains an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. | 2026-03-27 |
| 2026-03-13 | CVE-2026-3909 Skia Google Skia Out-of-Bounds Write Vulnerability Google Skia contains an out-of-bounds write vulnerability that could allow a remote attacker to perform out of bounds memory access via a crafted HTML page. This vulnerability affects Google Chrome and ChromeOS, Android, Flutter, and possibly other products. | 2026-03-27 |
| 2026-02-17 | CVE-2026-2441 Chromium Google Chromium CSS Use-After-Free Vulnerability Google Chromium CSS contains a use-after-free vulnerability that could allow a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. | 2026-03-10 |
| 2025-12-12 | CVE-2025-14174 Chromium Google Chromium Out of Bounds Memory Access Vulnerability Google Chromium contains an out of bounds memory access vulnerability in ANGLE that could allow a remote attacker to perform out of bounds memory access via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. | 2026-01-02 |
| 2025-11-19 | CVE-2025-13223 Chromium V8 Google Chromium V8 Type Confusion Vulnerability Google Chromium V8 contains a type confusion vulnerability that allows for heap corruption. | 2025-12-10 |
Source: CISA Known Exploited Vulnerabilities catalog 2026.10.29 (live). A listing means some versions are affected: check yours in the advisory. Guidance only.