Google known exploited vulnerabilities
CISA lists 75 Google CVEs as exploited in the wild. 10 were added in the last 12 months (latest 2026-09-16), and 0 are known to be used in ransomware campaigns.
Year = when CISA added the CVE to the catalog (KEV started in November 2021).
Patch first: highest EPSS right now
EPSS is FIRST's estimate of the chance a CVE is exploited in the next 30 days.
- CVE-2023-4863 (Chromium WebP): EPSS 100.0%, added 2023-09-13
- CVE-2018-17463 (Chromium V8): EPSS 84.6%, added 2022-06-08
- CVE-2021-21224 (Chromium V8): EPSS 84.2%, added 2021-11-03
- CVE-2020-6418 (Chromium V8): EPSS 78.8%, added 2021-11-03
- CVE-2021-21220 (Chromium V8): EPSS 70.4%, added 2021-11-03
Most affected Google products
Chromium V8 (41), Chromium (6), Pixel (2), Chromium Mojo (2), Chromium Skia (2), Chromium Intents (2), Chromium Blink (2), Dawn (1), Skia (1), Chromium WebRTC (1), Chromium libvpx (1), Chromium WebP (1).
All Google CVEs in KEV (latest 60)
| CVE | Product | Flaw | Added | Federal due | EPSS | Ransomware |
|---|---|---|---|---|---|---|
| CVE-2026-58704 | Pixel | Pixel Improper Authorization | 2026-09-16 | 2026-09-19 | 0.6% | – |
| CVE-2026-87491 | Chromium V8 | Chromium V8 Out of Bounds Write | 2026-09-09 | 2026-09-23 | 3.1% | – |
| CVE-2026-85046 | Chromium V8 | Chromium V8 Type Confusion | 2026-09-04 | 2026-09-18 | 48.9% | – |
| CVE-2026-11645 | Chromium V8 | Chromium V8 Out-of-Bounds Read and Write | 2026-06-09 | 2026-06-23 | 2.2% | – |
| CVE-2026-5281 | Dawn | Dawn Use-After-Free | 2026-04-01 | 2026-04-15 | 0.7% | – |
| CVE-2026-3910 | Chromium V8 | Chromium V8 Improper Restriction of Operations Within the Bounds of a Memory Buffer | 2026-03-13 | 2026-03-27 | 1.0% | – |
| CVE-2026-3909 | Skia | Skia Out-of-Bounds Write | 2026-03-13 | 2026-03-27 | 0.7% | – |
| CVE-2026-2441 | Chromium | Chromium CSS Use-After-Free | 2026-02-17 | 2026-03-10 | 55.1% | – |
| CVE-2025-14174 | Chromium | Chromium Out of Bounds Memory Access | 2025-12-12 | 2026-01-02 | 22.3% | – |
| CVE-2025-13223 | Chromium V8 | Chromium V8 Type Confusion | 2025-11-19 | 2025-12-10 | 5.0% | – |
| CVE-2025-10585 | Chromium V8 | Chromium V8 Type Confusion | 2025-09-23 | 2025-10-14 | 5.4% | – |
| CVE-2025-6558 | Chromium | Chromium ANGLE and GPU Improper Input Validation | 2025-07-22 | 2025-08-12 | 9.6% | – |
| CVE-2025-6554 | Chromium V8 | Chromium V8 Type Confusion | 2025-07-02 | 2025-07-23 | 12.6% | – |
| CVE-2025-5419 | Chromium V8 | Chromium V8 Out-of-Bounds Read and Write | 2025-06-05 | 2025-06-26 | 7.8% | – |
| CVE-2025-2783 | Chromium Mojo | Chromium Mojo Sandbox Escape | 2025-03-27 | 2025-04-17 | 9.2% | – |
| CVE-2024-7965 | Chromium V8 | Chromium V8 Inappropriate Implementation | 2024-08-28 | 2024-09-18 | 18.5% | – |
| CVE-2024-7971 | Chromium V8 | Chromium V8 Type Confusion | 2024-08-26 | 2024-09-16 | 21.1% | – |
| CVE-2024-5274 | Chromium V8 | Chromium V8 Type Confusion | 2024-05-28 | 2024-06-18 | 7.5% | – |
| CVE-2024-4947 | Chromium V8 | Chromium V8 Type Confusion | 2024-05-20 | 2024-06-10 | 15.2% | – |
| CVE-2024-4761 | Chromium V8 | Chromium V8 Out-of-Bounds Memory Write | 2024-05-16 | 2024-06-06 | 11.0% | – |
| CVE-2024-4671 | Chromium | Chromium Visuals Use-After-Free | 2024-05-13 | 2024-06-03 | 8.3% | – |
| CVE-2023-4762 | Chromium V8 | Chromium V8 Type Confusion | 2024-02-06 | 2024-02-27 | 41.4% | – |
| CVE-2024-0519 | Chromium V8 | Chromium V8 Out-of-Bounds Memory Access | 2024-01-17 | 2024-02-07 | 3.8% | – |
| CVE-2023-7024 | Chromium WebRTC | Chromium WebRTC Heap Buffer Overflow | 2024-01-02 | 2024-01-23 | 6.7% | – |
| CVE-2023-6345 | Chromium Skia | Skia Integer Overflow | 2023-11-30 | 2023-12-21 | 16.5% | – |
| CVE-2023-5217 | Chromium libvpx | Chromium libvpx Heap Buffer Overflow | 2023-10-02 | 2023-10-23 | 49.0% | – |
| CVE-2023-4863 | Chromium WebP | Chromium WebP Heap-Based Buffer Overflow | 2023-09-13 | 2023-10-04 | 100.0% | – |
| CVE-2023-3079 | Chromium V8 | Chromium V8 Type Confusion | 2023-06-07 | 2023-06-28 | 32.1% | – |
| CVE-2023-2136 | Chromium Skia | Chrome Skia Integer Overflow | 2023-04-21 | 2023-05-12 | 5.7% | – |
| CVE-2023-2033 | Chromium V8 | Chromium V8 Type Confusion | 2023-04-17 | 2023-05-08 | 40.8% | – |
| CVE-2022-3038 | Chromium Network Service | Chromium Network Service Use-After-Free | 2023-03-30 | 2023-04-20 | 24.7% | – |
| CVE-2022-4262 | Chromium V8 | Chromium V8 Type Confusion | 2022-12-05 | 2022-12-26 | 16.0% | – |
| CVE-2022-4135 | Chromium GPU | Chromium GPU Heap Buffer Overflow | 2022-11-28 | 2022-12-19 | 31.9% | – |
| CVE-2022-3723 | Chromium V8 | Chromium V8 Type Confusion | 2022-10-28 | 2022-11-18 | 7.9% | – |
| CVE-2022-3075 | Chromium Mojo | Chromium Mojo Insufficient Data Validation | 2022-09-08 | 2022-09-29 | 5.8% | – |
| CVE-2022-2856 | Chromium Intents | Chromium Intents Insufficient Input Validation | 2022-08-18 | 2022-09-08 | 4.5% | – |
| CVE-2021-30533 | Chromium PopupBlocker | Chromium PopupBlocker Security Bypass | 2022-06-27 | 2022-07-18 | 16.6% | – |
| CVE-2019-5825 | Chromium V8 | Chromium V8 Out-of-Bounds Write | 2022-06-08 | 2022-06-22 | 55.9% | – |
| CVE-2018-6065 | Chromium V8 | Chromium V8 Integer Overflow | 2022-06-08 | 2022-06-22 | 60.3% | – |
| CVE-2018-17480 | Chromium V8 | Chromium V8 Out-of-Bounds Write | 2022-06-08 | 2022-06-22 | 35.6% | – |
| CVE-2018-17463 | Chromium V8 | Chromium V8 Remote Code Execution | 2022-06-08 | 2022-06-22 | 84.6% | – |
| CVE-2017-5070 | Chromium V8 | Chromium V8 Type Confusion | 2022-06-08 | 2022-06-22 | 32.1% | – |
| CVE-2017-5030 | Chromium V8 | Chromium V8 Memory Corruption | 2022-06-08 | 2022-06-22 | 40.6% | – |
| CVE-2016-5198 | Chromium V8 | Chromium V8 Out-of-Bounds Memory | 2022-06-08 | 2022-06-22 | 34.2% | – |
| CVE-2016-1646 | Chromium V8 | Chromium V8 Out-of-Bounds Read | 2022-06-08 | 2022-06-22 | 48.1% | – |
| CVE-2019-5786 | Chrome Blink | Chrome Blink Use-After-Free | 2022-05-23 | 2022-06-13 | 61.1% | – |
| CVE-2019-13720 | Chrome WebAudio | Chrome WebAudio Use-After-Free | 2022-05-23 | 2022-06-13 | 49.1% | – |
| CVE-2022-1364 | Chromium V8 | Chromium V8 Type Confusion | 2022-04-15 | 2022-05-06 | 13.7% | – |
| CVE-2021-39793 | Pixel | Pixel Out-of-Bounds Write | 2022-04-11 | 2022-05-02 | 0.7% | – |
| CVE-2022-1096 | Chromium V8 | Chromium V8 Type Confusion | 2022-03-28 | 2022-04-18 | 24.2% | – |
| CVE-2022-0609 | Chromium Animation | Chromium Animation Use-After-Free | 2022-02-15 | 2022-03-01 | 22.9% | – |
| CVE-2020-6572 | Chrome Media | Chrome Media Use-After-Free | 2022-01-10 | 2022-07-10 | 10.6% | – |
| CVE-2021-4102 | Chromium V8 | Chromium V8 Use-After-Free | 2021-12-15 | 2021-12-29 | 7.8% | – |
| CVE-2021-38003 | Chromium V8 | Chromium V8 Memory Corruption | 2021-11-03 | 2021-11-17 | 38.6% | – |
| CVE-2021-38000 | Chromium Intents | Chromium Intents Improper Input Validation | 2021-11-03 | 2021-11-17 | 4.9% | – |
| CVE-2021-37976 | Chromium | Chromium Information Disclosure | 2021-11-03 | 2021-11-17 | 19.9% | – |
| CVE-2021-37975 | Chromium V8 | Chromium V8 Use-After-Free | 2021-11-03 | 2021-11-17 | 34.9% | – |
| CVE-2021-37973 | Chromium Portals | Chromium Portals Use-After-Free | 2021-11-03 | 2021-11-17 | 11.7% | – |
| CVE-2021-30633 | Chromium Indexed DB API | Chromium Indexed DB API Use-After-Free | 2021-11-03 | 2021-11-17 | 33.2% | – |
| CVE-2021-30632 | Chromium V8 | Chromium V8 Out-of-Bounds Write | 2021-11-03 | 2021-11-17 | 63.2% | – |
Federal due dates bind US federal civilian agencies (CISA binding operational directives); everyone else can use them as a priority hint. Sources: CISA KEV, FIRST EPSS.
Read next: Which CVEs to patch first this week · All vendors