How many CVEs does Google have?

Google has 15,651 published CVE records since 2003, including 2,737 in the last two years.

How many Google CVEs are in CISA KEV?

Yes — 110 of Google's CVEs are listed in CISA's Known Exploited Vulnerabilities catalog, confirmed exploited in the wild and carrying a CISA remediation deadline.

Which Google products have the most CVEs?

The Google products with the most published CVEs are Android, Chrome, chrome os, Tensorflow, pixel.

What are the most common weakness types in Google CVEs?

Google's CVEs most often map to these CWE weakness types: CWE-787 (Out-of-bounds Write), CWE-125 (Out-of-bounds Read), CWE-416 (Use After Free), CWE-20 (Improper Input Validation).

Are there public exploits for Google vulnerabilities?

Yes — 665 of Google's CVEs have a known public exploit.

How many critical Google vulnerabilities are there?

Google has 1,688 critical and 7,231 high-severity CVEs.

What is the average severity of Google CVEs?

The average CVSS base score across Google's scored CVEs is 7.1.

RadicalNotion.AI

Log in Start free

Log in

Log in Start free

15,651 CVEs

110 in CISA KEV

Google Vulnerabilities

Name: Google vulnerability dataset (CVEs)
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

CVE security advisories and vulnerability history for Google.

15,651

Total CVEs

Published

110

In CISA KEV

Exploited in the wild

665

Public exploits

PoC or exploit code

7.1

Avg CVSS

2003–2026

Overview

Google has 15,651 published CVE records since 2003, of which 110 are in CISA's Known Exploited Vulnerabilities catalog and 665 have a known public exploit. The average CVSS base score across scored CVEs is 7.1.

This page aggregates every publicly disclosed vulnerability (CVE) affecting Google products, with severity breakdowns, the most-affected products, the most common weakness types, and the latest disclosures.

Security scorecard

A quick read on Google's vulnerability posture, as a share of its 15,651 published CVEs.

Average CVSS: 7.1
Critical / high: 57%
Actively exploited (KEV): 1%
Public exploit available: 4%
Patch available: 48%

Severity and exploitation

How the CVSS severity of Google's CVEs breaks down, plus how many are exploited in the wild or have public exploit code.

Critical1,688

High7,231

Medium6,428

Low304

In CISA’s Known Exploited Vulnerabilities catalog

110

110 of Google's CVEs are confirmed exploited in the wild.

Public exploits

665

665 of Google's CVEs have a known public exploit available.

Most affected products

The Google products with the most published CVEs. Follow any product to browse its versions and vulnerabilities.

Common weakness types

The CWE weakness categories most often found in Google CVEs. Follow any weakness for its full explanation.

CNAs that assign these CVEs

The CVE Numbering Authorities that publish Google CVE records.

Disclosure activity by year

How many Google CVEs were published each year.

2019

899

2020

1,263

2021

1,257

2022

1,812

2023

1,797

2024

909

2025

723

2026

2,014

Latest Google CVEs

The most recently disclosed vulnerabilities affecting Google.

Missing Authorization in Firebase Studio allows Cross-Tenant Source Code Theft
CWE-862
High · CVSS 8.5
EPSS 0.2%2026-07-17
CAI Content Credentials | Insufficiently Protected Credentials (CWE-522)
CWE-522
High · CVSS 7.5
EPSS 0.4%2026-07-14
CAI Content Credentials | Server-Side Request Forgery (SSRF) (CWE-918)
CWE-918
High · CVSS 8.2
EPSS 0.2%2026-07-14
CAI Content Credentials | Uncontrolled Resource Consumption (CWE-400)
CWE-400
Medium · CVSS 6.2
EPSS 0.2%2026-07-14
CAI Content Credentials | Integer Underflow (Wrap or Wraparound) (CWE-191)
CWE-191
Medium · CVSS 6.2
EPSS 0.2%2026-07-14
CAI Content Credentials | Untrusted Search Path (CWE-426)
CWE-426
High · CVSS 7.4
EPSS 0.1%2026-07-14
CAI Content Credentials | Improper Input Validation (CWE-20)
CWE-20
Medium · CVSS 6.8
EPSS 0.2%2026-07-14
CAI Content Credentials | Improper Input Validation (CWE-20)
CWE-20
High · CVSS 7.5
EPSS 0.4%2026-07-14
CAI Content Credentials | Improper Input Validation (CWE-20)
CWE-20
Medium · CVSS 6.2
EPSS 0.2%2026-07-14
CAI Content Credentials | Integer Overflow or Wraparound (CWE-190)
CWE-190
Medium · CVSS 6.2
EPSS 0.2%2026-07-14
CAI Content Credentials | Integer Underflow (Wrap or Wraparound) (CWE-191)
CWE-191
Medium · CVSS 6.2
EPSS 0.2%2026-07-14
CAI Content Credentials | Improper Input Validation (CWE-20)
CWE-20
High · CVSS 7.5
EPSS 0.4%2026-07-14

Track new Google CVEs as they are disclosed and get AI-written analysis and remediation guidance.

Monitor Google CVEs

Other vendors

Browse vulnerabilities for other tracked vendors.

linux20,234 CVEs Apple14,759 CVEs Oracle10,707 CVEs Debian10,221 CVEs IBM8,380 CVEs Red Hat7,778 CVEs Adobe7,522 CVEs Cisco6,845 CVEs

Browse all vendors

Frequently asked questions

Common questions about Google vulnerabilities.

How many CVEs does Google have?: Google has 15,651 published CVE records since 2003, including 2,737 in the last two years.
How many Google CVEs are in CISA KEV?: Yes — 110 of Google's CVEs are listed in CISA's Known Exploited Vulnerabilities catalog, confirmed exploited in the wild and carrying a CISA remediation deadline.
Which Google products have the most CVEs?: The Google products with the most published CVEs are Android, Chrome, chrome os, Tensorflow, pixel.
What are the most common weakness types in Google CVEs?: Google's CVEs most often map to these CWE weakness types: CWE-787 (Out-of-bounds Write), CWE-125 (Out-of-bounds Read), CWE-416 (Use After Free), CWE-20 (Improper Input Validation).
Are there public exploits for Google vulnerabilities?: Yes — 665 of Google's CVEs have a known public exploit.
How many critical Google vulnerabilities are there?: Google has 1,688 critical and 7,231 high-severity CVEs.
What is the average severity of Google CVEs?: The average CVSS base score across Google's scored CVEs is 7.1.

References

Vulnerability data is sourced from the CVE Program; severity, KEV, and exploit signals are aggregated by RadicalNotion.AI.

Track Google vulnerabilities

Monitor new Google vulnerabilities as they are disclosed, with AI-written analysis and remediation guidance.

Start free See pricing