By year
02
03
04
05
06
07
08
09
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
Bars are flaws published each year; the red part is the share attackers have used.
Exploited Google flaws
These are on CISA’s Known Exploited Vulnerabilities list, newest first. If you run any of these products, these come before everything else.
- CVE-2026-111497 Google Brotli Unchecked Return ValueExploited since Oct 27, 2026 · CVSS 9.2
- CVE-2026-58704 Google Pixel Improper AuthorizationExploited since Sep 16, 2026 · CVSS 8.8
- CVE-2026-87491 Google Chromium V8 Out of Bounds WriteExploited since Sep 9, 2026 · CVSS 8.8
- CVE-2026-85046 Google Chromium V8 Type ConfusionExploited since Sep 4, 2026 · CVSS 8.8
- CVE-2026-11645 Google Chromium V8 Out-of-Bounds Read and WriteExploited since Jun 9, 2026 · CVSS 8.8
- CVE-2026-5281 Google Dawn Use-After-FreeExploited since Apr 1, 2026 · CVSS 8.8
- CVE-2026-3910 Google Chromium V8 Improper Restriction of Operations Within the Bounds of a Memory BufferExploited since Mar 13, 2026 · CVSS 8.8
- CVE-2026-3909 Google Skia Out-of-Bounds WriteExploited since Mar 13, 2026 · CVSS 8.8
- CVE-2026-2441 Google Chromium CSS Use-After-FreeExploited since Feb 17, 2026 · CVSS 8.8
- CVE-2025-14174 Google Chromium Out of Bounds Memory AccessExploited since Dec 12, 2025 · CVSS 8.8
- CVE-2025-13223 Google Chromium V8 Type ConfusionExploited since Nov 19, 2025 · CVSS 8.8
- CVE-2025-10585 Google Chromium V8 Type ConfusionExploited since Sep 23, 2025 · CVSS 9.8
- CVE-2025-6558 Google Chromium ANGLE and GPU Improper Input ValidationExploited since Jul 22, 2025 · CVSS 8.8
- CVE-2025-6554 Google Chromium V8 Type ConfusionExploited since Jul 2, 2025 · CVSS 8.1
- CVE-2025-5419 Google Chromium V8 Out-of-Bounds Read and WriteExploited since Jun 5, 2025 · CVSS 8.8
- CVE-2025-2783 Google Chromium Mojo Sandbox EscapeExploited since Mar 27, 2025 · CVSS 8.3
- CVE-2024-7965 Google Chromium V8 Inappropriate ImplementationExploited since Aug 28, 2024 · CVSS 8.8
- CVE-2024-7971 Google Chromium V8 Type ConfusionExploited since Aug 26, 2024 · CVSS 9.6
- CVE-2024-5274 Google Chromium V8 Type ConfusionExploited since May 28, 2024 · CVSS 9.6
- CVE-2024-4947 Google Chromium V8 Type ConfusionExploited since May 20, 2024 · CVSS 9.6
- CVE-2024-4761 Google Chromium V8 Out-of-Bounds Memory WriteExploited since May 16, 2024 · CVSS 8.8
- CVE-2024-4671 Google Chromium Visuals Use-After-FreeExploited since May 13, 2024 · CVSS 9.6
- CVE-2023-4762 Google Chromium V8 Type ConfusionExploited since Feb 6, 2024 · CVSS 8.8
- CVE-2024-0519 Google Chromium V8 Out-of-Bounds Memory AccessExploited since Jan 17, 2024 · CVSS 8.8
- CVE-2023-7024 Google Chromium WebRTC Heap Buffer OverflowExploited since Jan 2, 2024 · CVSS 8.8
- CVE-2023-6345 Google Skia Integer OverflowExploited since Nov 30, 2023 · CVSS 9.6
- CVE-2023-5217 Google Chromium libvpx Heap Buffer OverflowExploited since Oct 2, 2023 · CVSS 8.8
- CVE-2023-4863 Google Chromium WebP Heap-Based Buffer OverflowExploited since Sep 13, 2023 · CVSS 8.8
- CVE-2023-3079 Google Chromium V8 Type ConfusionExploited since Jun 7, 2023 · CVSS 8.8
- CVE-2023-2136 Google Chrome Skia Integer OverflowExploited since Apr 21, 2023 · CVSS 9.6
- CVE-2023-2033 Google Chromium V8 Type ConfusionExploited since Apr 17, 2023 · CVSS 8.8
- CVE-2022-3038 Google Chromium Network Service Use-After-FreeExploited since Mar 30, 2023 · CVSS 8.8
- CVE-2022-4262 Google Chromium V8 Type ConfusionExploited since Dec 5, 2022 · CVSS 8.8
- CVE-2022-4135 Google Chromium GPU Heap Buffer OverflowExploited since Nov 28, 2022 · CVSS 9.6
- CVE-2022-3723 Google Chromium V8 Type ConfusionExploited since Oct 28, 2022 · CVSS 8.8
- CVE-2022-3075 Google Chromium Mojo Insufficient Data ValidationExploited since Sep 8, 2022 · CVSS 9.6
- CVE-2022-2856 Google Chromium Intents Insufficient Input ValidationExploited since Aug 18, 2022 · CVSS 6.5
- CVE-2021-30533 Google Chromium PopupBlocker Security BypassExploited since Jun 27, 2022 · CVSS 6.5
- CVE-2016-1646 Google Chromium V8 Out-of-Bounds ReadExploited since Jun 8, 2022 · CVSS 8.8
- CVE-2019-5825 Google Chromium V8 Out-of-Bounds WriteExploited since Jun 8, 2022 · CVSS 6.5
- CVE-2018-17480 Google Chromium V8 Out-of-Bounds WriteExploited since Jun 8, 2022 · CVSS 8.8
- CVE-2018-6065 Google Chromium V8 Integer OverflowExploited since Jun 8, 2022 · CVSS 8.8
- CVE-2018-17463 Google Chromium V8 Remote Code ExecutionExploited since Jun 8, 2022 · CVSS 8.8
- CVE-2017-5070 Google Chromium V8 Type ConfusionExploited since Jun 8, 2022 · CVSS 8.8
- CVE-2017-5030 Google Chromium V8 Memory CorruptionExploited since Jun 8, 2022 · CVSS 8.8
- CVE-2016-5198 Google Chromium V8 Out-of-Bounds MemoryExploited since Jun 8, 2022 · CVSS 8.8
- CVE-2019-5786 Google Chrome Blink Use-After-FreeExploited since May 23, 2022 · CVSS 6.5
- CVE-2019-13720 Google Chrome WebAudio Use-After-FreeExploited since May 23, 2022 · CVSS 8.8
- CVE-2022-1364 Google Chromium V8 Type ConfusionExploited since Apr 15, 2022 · CVSS 8.8
- CVE-2021-39793 Google Pixel Out-of-Bounds WriteExploited since Apr 11, 2022 · CVSS 7.8
- CVE-2022-1096 Google Chromium V8 Type ConfusionExploited since Mar 28, 2022 · CVSS 8.8
- CVE-2022-0609 Google Chromium Animation Use-After-FreeExploited since Feb 15, 2022 · CVSS 8.8
- CVE-2020-6572 Google Chrome Media Use-After-FreeExploited since Jan 10, 2022 · CVSS 8.8
- CVE-2021-4102 Google Chromium V8 Use-After-FreeExploited since Dec 15, 2021 · CVSS 8.8
- CVE-2021-21206 Google Chromium Blink Use-After-FreeExploited since Nov 3, 2021 · CVSS 8.8
- CVE-2021-21193 Google Chromium Blink Use-After-FreeExploited since Nov 3, 2021 · CVSS 8.8
- CVE-2021-21166 Google Chromium Race ConditionExploited since Nov 3, 2021 · CVSS 8.8
- CVE-2021-21148 Google Chromium V8 Heap Buffer OverflowExploited since Nov 3, 2021 · CVSS 8.8
- CVE-2020-16017 Google Chrome Use-After-FreeExploited since Nov 3, 2021 · CVSS 9.6
- CVE-2020-16013 Google Chromium V8 Incorrect Implementation VulnerabililtyExploited since Nov 3, 2021 · CVSS 8.8
Latest high and critical flaws
- CVE-2026-118359 Memory corruption in V8 in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a craftedHigh 8.8 · Oct 27, 2026
- CVE-2026-118358 Memory corruption in WebAudio in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a cHigh 8.8 · Oct 27, 2026
- CVE-2026-118357 Use after free in FileSystem in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crHigh 8.8 · Oct 27, 2026
- CVE-2026-118356 Use after free in WTF in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.High 8.8 · Oct 27, 2026
- CVE-2026-118355 Improper input validation in Command in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandboxCritical 9.6 · Oct 27, 2026
- CVE-2026-118354 Improper input validation in Skia in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox viaHigh 8.8 · Oct 27, 2026
- CVE-2026-118353 Use after free in Paint in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.High 8.8 · Oct 27, 2026
- CVE-2026-118352 Memory corruption in Cache in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafHigh 8.8 · Oct 27, 2026
- CVE-2026-118351 Memory corruption in Skia in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML pageHigh 8.8 · Oct 27, 2026
- CVE-2026-118350 Use after free in Turbolev in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML pagHigh 8.8 · Oct 27, 2026
- CVE-2026-118349 Memory corruption in Payments in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML High 8.8 · Oct 27, 2026
- CVE-2026-118348 Improper input validation in Skia in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox viaHigh 8.8 · Oct 27, 2026
- CVE-2026-118347 Use after free in FileSystem in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML pHigh 8.8 · Oct 27, 2026
- CVE-2026-118346 Use after free in Compositing in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a cHigh 8.8 · Oct 27, 2026
- CVE-2026-118345 Use after free in PDFium in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafteHigh 8.8 · Oct 27, 2026
- CVE-2026-118344 Use after free in Layout in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.High 8.8 · Oct 27, 2026
- CVE-2026-118343 Improper input validation in ReadingList in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandHigh 8.8 · Oct 27, 2026
- CVE-2026-118342 Out of bounds write in Editing in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via aCritical 9.6 · Oct 27, 2026
- CVE-2026-118341 Use after free in Modularization in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTHigh 8.8 · Oct 27, 2026
- CVE-2026-118340 Memory corruption in Skia in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafCritical 9.6 · Oct 27, 2026
- CVE-2026-118339 Use after free in Animation in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML paHigh 8.8 · Oct 27, 2026
- CVE-2026-118338 Use after free in Animation in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a craHigh 8.8 · Oct 27, 2026
- CVE-2026-118336 Improper input validation in Headless in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandboxHigh 8.8 · Oct 27, 2026
- CVE-2026-118335 Improper input validation in Metrics in Google Chrome on on Mac prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside thHigh 8.8 · Oct 27, 2026
- CVE-2026-118334 Use after free in ImageCapture in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTMLHigh 8.8 · Oct 27, 2026
Part of our vulnerability database: the whole National Vulnerability Database plus CISA’s exploited list, refreshed twice a day. This is general guidance, not a review of your systems.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.