Vendor

Google

As of , 75 Google vulnerabilities are on CISA's list of exploited vulnerabilities; 8 were added in 2026. Patch first: CVE-2026-58704.

Patch first

Patch first
#VulnerabilityProductOur groupListedDeadlineEPSS
1CVE-2026-58704Improper AuthorizationGoogle PixelPatch nowForensic triage required by CISA0.01
2CVE-2018-17463Remote Code ExecutionGoogle Chromium V8Patch this weekMetasploit module; EPSS 0.85; verified Exploit-DB entry0.85
3CVE-2019-5825Out-of-Bounds WriteGoogle Chromium V8Patch this weekMetasploit module; EPSS 0.56; verified Exploit-DB entry0.56
4CVE-2019-5786Use-After-FreeGoogle Chrome BlinkPatch this weekMetasploit module; EPSS 0.61; verified Exploit-DB entry0.61
5CVE-2020-6418Type ConfusionGoogle Chromium V8Patch this weekMetasploit module; EPSS 0.79; verified Exploit-DB entry0.79
6CVE-2021-21220Improper Input ValidationGoogle Chromium V8Patch this weekMetasploit module; EPSS 0.700.70
7CVE-2018-6065Integer OverflowGoogle Chromium V8Patch this weekEPSS 0.60; verified Exploit-DB entry0.60
8CVE-2026-2441CSS Use-After-FreeGoogle ChromiumPatch this weekEPSS 0.550.55
9CVE-2023-4863Heap-Based Buffer OverflowGoogle Chromium WebPPatch this weekEPSS 0.990.99
10CVE-2020-15999Heap Buffer OverflowGoogle Chrome FreeTypePatch this weekEPSS 0.640.64
11CVE-2021-21224Type ConfusionGoogle Chromium V8Patch this weekEPSS 0.840.84
12CVE-2021-30551Type ConfusionGoogle Chromium V8Patch this weekEPSS 0.650.65
13CVE-2021-30632Out-of-Bounds WriteGoogle Chromium V8Patch this weekEPSS 0.630.63
14CVE-2026-85046Type ConfusionGoogle Chromium V8Patch soon0.49
15CVE-2023-4762Type ConfusionGoogle Chromium V8Patch soon0.41
16CVE-2023-5217Heap Buffer OverflowGoogle Chromium libvpxPatch soon0.49
17CVE-2023-3079Type ConfusionGoogle Chromium V8Patch soon0.32
18CVE-2023-2033Type ConfusionGoogle Chromium V8Patch soon0.41
19CVE-2022-4135Heap Buffer OverflowGoogle Chromium GPUPatch soon0.32
20CVE-2016-1646Out-of-Bounds ReadGoogle Chromium V8Patch soon0.48
21CVE-2016-5198Out-of-Bounds MemoryGoogle Chromium V8Patch soon0.34
22CVE-2017-5030Memory CorruptionGoogle Chromium V8Patch soon0.41
23CVE-2017-5070Type ConfusionGoogle Chromium V8Patch soon0.32
24CVE-2018-17480Out-of-Bounds WriteGoogle Chromium V8Patch soon0.36
25CVE-2019-13720Use-After-FreeGoogle Chrome WebAudioPatch soon0.49

The next 50, from number 26

Products

  • Chromium V841 entries
  • Chromium7 entries
  • Chromium Blink2 entries
  • Chromium Intents2 entries
  • Chromium Mojo2 entries
  • Chromium Skia2 entries
  • Pixel2 entries
  • Chrome1 entry
  • Chrome Blink1 entry
  • Chrome for Android UI1 entry
  • Chrome FreeType1 entry
  • Chrome Media1 entry
  • Chrome WebAudio1 entry
  • Chromium Animation1 entry
  • Chromium GPU1 entry
  • Chromium Indexed DB API1 entry
  • Chromium libvpx1 entry
  • Chromium Network Service1 entry
  • Chromium PopupBlocker1 entry
  • Chromium Portals1 entry
  • Chromium WebGL1 entry
  • Chromium WebP1 entry
  • Chromium WebRTC1 entry
  • Dawn1 entry
  • Skia1 entry

Added each year

1020302021: 232320212022: 212120222023: 7720232024: 9920242025: 8820252026: 882026
Entries CISA added each year, removed ones included. Source: CISA KEV.
Show the numbers
Periodentries added
202123
202221
20237
20249
20258
20268

Used in ransomware

Changes CISA made to these entries

  1. CVE-2026-3909 Google SkiaEdited: notes.
  2. CVE-2025-4664 Google ChromiumRemoved from CISA's list.
  3. CVE-2024-4761 Google Chromium V8Renamed from Chromium Visuals to Chromium V8.
  4. CVE-2020-6572 Google Chrome MediaEdited: name.

Every change we recorded

Removed from CISA's list

Removed from CISA's list
VulnerabilityProductOur groupListedDeadlineEPSS
CVE-2025-4664Loader Insufficient Policy EnforcementGoogle ChromiumRemoved from CISA's list0.06