Vendor dossier / #5
Google vulnerabilities in CISA KEV
Answer CISA's KEV catalog lists 75 Google vulnerabilities as of catalog 2026.09.23, 4.4% of all 1,721 entries and rank 5 of 283 vendors. The first was added on 2021-11-03 and the most recent on 2026-09-16; 0 are flagged as used in ransomware campaigns.
- KEV entries
- 754.4% of catalog
- Last 90 days
- +3added
- Ransomware: known
- 00%
- Products
- 25distinct
- First added
- 2021-11-03
- Latest added
- 2026-09-16
- Median days to due
- 21
- Open deadlines
- 1federal
TAdditions per quarter
Table view (by year)
| Year | Added |
|---|---|
| 2021 | 23 |
| 2022 | 21 |
| 2023 | 7 |
| 2024 | 9 |
| 2025 | 7 |
| 2026 | 8 |
QCommon questions
How many Google vulnerabilities are in CISA KEV?
75, as of KEV catalog 2026.09.23 (released 2026-09-23). That is 4.4% of the catalog.
Which Google product has the most KEV entries?
Chromium V8, with 41 entries. 25 products appear in total.
How many Google KEV vulnerabilities are linked to ransomware?
0 of 75 (0%) are flagged by CISA as known to be used in ransomware campaigns.
When was the latest Google vulnerability added to KEV?
2026-09-16 (CVE-2026-58704).
What is the most common weakness in Google KEV entries?
CWE-843 (Type confusion), listed on 20 entries.
PProducts
| Product | Entries | Share of vendor |
|---|---|---|
| Chromium V8 | 41 | 54.7% |
| Chromium | 6 | 8% |
| Pixel | 2 | 2.7% |
| Chromium Mojo | 2 | 2.7% |
| Chromium Skia | 2 | 2.7% |
| Chromium Intents | 2 | 2.7% |
| Chromium Blink | 2 | 2.7% |
| Dawn | 1 | 1.3% |
| Skia | 1 | 1.3% |
| Chromium WebRTC | 1 | 1.3% |
| Chromium libvpx | 1 | 1.3% |
| Chromium WebP | 1 | 1.3% |
| Chromium Network Service | 1 | 1.3% |
| Chromium GPU | 1 | 1.3% |
| Chromium PopupBlocker | 1 | 1.3% |
| Chrome Blink | 1 | 1.3% |
| Chrome WebAudio | 1 | 1.3% |
| Chromium Animation | 1 | 1.3% |
| Chrome Media | 1 | 1.3% |
| Chromium Portals | 1 | 1.3% |
| Chromium Indexed DB API | 1 | 1.3% |
| Chromium WebGL | 1 | 1.3% |
| Chrome | 1 | 1.3% |
| Chrome for Android UI | 1 | 1.3% |
| Chrome FreeType | 1 | 1.3% |
WWeaknesses
| CWE | Entries | Share of vendor |
|---|---|---|
| CWE-843 Type confusion | 20 | 26.7% |
| CWE-787 Out-of-bounds write | 19 | 25.3% |
| CWE-416 Use after free | 16 | 21.3% |
| CWE-122 Heap-based buffer overflow | 9 | 12% |
| CWE-20 Improper input validation | 5 | 6.7% |
| CWE-125 Out-of-bounds read | 4 | 5.3% |
| CWE-190 Integer overflow | 3 | 4% |
| CWE-119 Memory buffer bounds error | 2 | 2.7% |
| CWE-693 Protection mechanism failure | 1 | 1.3% |
| CWE-358 | 1 | 1.3% |
| CWE-863 Incorrect authorization | 1 | 1.3% |
| CWE-755 | 1 | 1.3% |
| No CWE listed | 3 | 4% |
EAll 75 entries
| CVE | Product | Vulnerability | Added | Due | Ransomware | CWE |
|---|---|---|---|---|---|---|
| CVE-2026-58704 | Pixel | Google Pixel Improper Authorization Vulnerability | Unknown | CWE-693 | ||
| CVE-2026-87491 | Chromium V8 | Google Chromium V8 Out of Bounds Write Vulnerability | Open | Unknown | CWE-787 | |
| CVE-2026-85046 | Chromium V8 | Google Chromium V8 Type Confusion Vulnerability | Unknown | CWE-843 | ||
| CVE-2026-11645 | Chromium V8 | Google Chromium V8 Out-of-Bounds Read and Write Vulnerability | Unknown | CWE-787, CWE-125 | ||
| CVE-2026-5281 | Dawn | Google Dawn Use-After-Free Vulnerability | Unknown | CWE-416 | ||
| CVE-2026-3910 | Chromium V8 | Google Chromium V8 Improper Restriction of Operations Within the Bounds of a Memory Buffer Vulnerability | Unknown | CWE-119 | ||
| CVE-2026-3909 | Skia | Google Skia Out-of-Bounds Write Vulnerability | Unknown | CWE-787 | ||
| CVE-2026-2441 | Chromium | Google Chromium CSS Use-After-Free Vulnerability | Unknown | CWE-416 | ||
| CVE-2025-14174 | Chromium | Google Chromium Out of Bounds Memory Access Vulnerability | Unknown | none listed | ||
| CVE-2025-13223 | Chromium V8 | Google Chromium V8 Type Confusion Vulnerability | Unknown | CWE-843 | ||
| CVE-2025-10585 | Chromium V8 | Google Chromium V8 Type Confusion Vulnerability | Unknown | CWE-843 | ||
| CVE-2025-6558 | Chromium | Google Chromium ANGLE and GPU Improper Input Validation Vulnerability | Unknown | CWE-20 | ||
| CVE-2025-6554 | Chromium V8 | Google Chromium V8 Type Confusion Vulnerability | Unknown | CWE-843 | ||
| CVE-2025-5419 | Chromium V8 | Google Chromium V8 Out-of-Bounds Read and Write Vulnerability | Unknown | CWE-125, CWE-787 | ||
| CVE-2025-2783 | Chromium Mojo | Google Chromium Mojo Sandbox Escape Vulnerability | Unknown | none listed | ||
| CVE-2024-7965 | Chromium V8 | Google Chromium V8 Inappropriate Implementation Vulnerability | Unknown | CWE-358 | ||
| CVE-2024-7971 | Chromium V8 | Google Chromium V8 Type Confusion Vulnerability | Unknown | CWE-843 | ||
| CVE-2024-5274 | Chromium V8 | Google Chromium V8 Type Confusion Vulnerability | Unknown | CWE-843 | ||
| CVE-2024-4947 | Chromium V8 | Google Chromium V8 Type Confusion Vulnerability | Unknown | CWE-843 | ||
| CVE-2024-4761 | Chromium V8 | Google Chromium V8 Out-of-Bounds Memory Write Vulnerability | Unknown | CWE-787 | ||
| CVE-2024-4671 | Chromium | Google Chromium Visuals Use-After-Free Vulnerability | Unknown | CWE-416 | ||
| CVE-2023-4762 | Chromium V8 | Google Chromium V8 Type Confusion Vulnerability | Unknown | CWE-843 | ||
| CVE-2024-0519 | Chromium V8 | Google Chromium V8 Out-of-Bounds Memory Access Vulnerability | Unknown | CWE-787 | ||
| CVE-2023-7024 | Chromium WebRTC | Google Chromium WebRTC Heap Buffer Overflow Vulnerability | Unknown | CWE-787 | ||
| CVE-2023-6345 | Chromium Skia | Google Skia Integer Overflow Vulnerability | Unknown | CWE-190 | ||
| CVE-2023-5217 | Chromium libvpx | Google Chromium libvpx Heap Buffer Overflow Vulnerability | Unknown | CWE-787 | ||
| CVE-2023-4863 | Chromium WebP | Google Chromium WebP Heap-Based Buffer Overflow Vulnerability | Unknown | CWE-787 | ||
| CVE-2023-3079 | Chromium V8 | Google Chromium V8 Type Confusion Vulnerability | Unknown | CWE-843 | ||
| CVE-2023-2136 | Chromium Skia | Google Chrome Skia Integer Overflow Vulnerability | Unknown | CWE-190 | ||
| CVE-2023-2033 | Chromium V8 | Google Chromium V8 Type Confusion Vulnerability | Unknown | CWE-843 | ||
| CVE-2022-3038 | Chromium Network Service | Google Chromium Network Service Use-After-Free Vulnerability | Unknown | CWE-416 | ||
| CVE-2022-4262 | Chromium V8 | Google Chromium V8 Type Confusion Vulnerability | Unknown | CWE-122, CWE-843 | ||
| CVE-2022-4135 | Chromium GPU | Google Chromium GPU Heap Buffer Overflow Vulnerability | Unknown | CWE-787 | ||
| CVE-2022-3723 | Chromium V8 | Google Chromium V8 Type Confusion Vulnerability | Unknown | CWE-122, CWE-843 | ||
| CVE-2022-3075 | Chromium Mojo | Google Chromium Mojo Insufficient Data Validation Vulnerability | Unknown | CWE-20 | ||
| CVE-2022-2856 | Chromium Intents | Google Chromium Intents Insufficient Input Validation Vulnerability | Unknown | CWE-20 | ||
| CVE-2021-30533 | Chromium PopupBlocker | Google Chromium PopupBlocker Security Bypass Vulnerability | Unknown | CWE-863 | ||
| CVE-2019-5825 | Chromium V8 | Google Chromium V8 Out-of-Bounds Write Vulnerability | Unknown | CWE-787 | ||
| CVE-2018-6065 | Chromium V8 | Google Chromium V8 Integer Overflow Vulnerability | Unknown | CWE-190, CWE-787 | ||
| CVE-2018-17480 | Chromium V8 | Google Chromium V8 Out-of-Bounds Write Vulnerability | Unknown | CWE-787 | ||
| CVE-2018-17463 | Chromium V8 | Google Chromium V8 Remote Code Execution Vulnerability | Unknown | none listed | ||
| CVE-2017-5070 | Chromium V8 | Google Chromium V8 Type Confusion Vulnerability | Unknown | CWE-843 | ||
| CVE-2017-5030 | Chromium V8 | Google Chromium V8 Memory Corruption Vulnerability | Unknown | CWE-125 | ||
| CVE-2016-5198 | Chromium V8 | Google Chromium V8 Out-of-Bounds Memory Vulnerability | Unknown | CWE-125, CWE-787 | ||
| CVE-2016-1646 | Chromium V8 | Google Chromium V8 Out-of-Bounds Read Vulnerability | Unknown | CWE-119 | ||
| CVE-2019-5786 | Chrome Blink | Google Chrome Blink Use-After-Free Vulnerability | Unknown | CWE-416 | ||
| CVE-2019-13720 | Chrome WebAudio | Google Chrome WebAudio Use-After-Free Vulnerability | Unknown | CWE-416 | ||
| CVE-2022-1364 | Chromium V8 | Google Chromium V8 Type Confusion Vulnerability | Unknown | CWE-843 | ||
| CVE-2021-39793 | Pixel | Google Pixel Out-of-Bounds Write Vulnerability | Unknown | CWE-787 | ||
| CVE-2022-1096 | Chromium V8 | Google Chromium V8 Type Confusion Vulnerability | Unknown | CWE-843 | ||
| CVE-2022-0609 | Chromium Animation | Google Chromium Animation Use-After-Free Vulnerability | Unknown | CWE-416 | ||
| CVE-2020-6572 | Chrome Media | Google Chrome Media Use-After-Free Vulnerability | Unknown | CWE-416 | ||
| CVE-2021-4102 | Chromium V8 | Google Chromium V8 Use-After-Free Vulnerability | Unknown | CWE-416 | ||
| CVE-2021-38003 | Chromium V8 | Google Chromium V8 Memory Corruption Vulnerability | Unknown | CWE-122, CWE-755 | ||
| CVE-2021-38000 | Chromium Intents | Google Chromium Intents Improper Input Validation Vulnerability | Unknown | CWE-20 | ||
| CVE-2021-37976 | Chromium | Google Chromium Information Disclosure Vulnerability | Unknown | CWE-862 | ||
| CVE-2021-37975 | Chromium V8 | Google Chromium V8 Use-After-Free Vulnerability | Unknown | CWE-416 | ||
| CVE-2021-37973 | Chromium Portals | Google Chromium Portals Use-After-Free Vulnerability | Unknown | CWE-416 | ||
| CVE-2021-30633 | Chromium Indexed DB API | Google Chromium Indexed DB API Use-After-Free Vulnerability | Unknown | CWE-416 | ||
| CVE-2021-30632 | Chromium V8 | Google Chromium V8 Out-of-Bounds Write Vulnerability | Unknown | CWE-122 | ||
| CVE-2021-30563 | Chromium V8 | Google Chromium V8 Type Confusion Vulnerability | Unknown | CWE-122, CWE-843 | ||
| CVE-2021-30554 | Chromium WebGL | Google Chromium WebGL Use-After-Free Vulnerability | Unknown | CWE-416 | ||
| CVE-2021-30551 | Chromium V8 | Google Chromium V8 Type Confusion Vulnerability | Unknown | CWE-122, CWE-843 | ||
| CVE-2021-21224 | Chromium V8 | Google Chromium V8 Type Confusion Vulnerability | Unknown | CWE-843 | ||
| CVE-2021-21220 | Chromium V8 | Google Chromium V8 Improper Input Validation Vulnerability | Unknown | CWE-20, CWE-122 | ||
| CVE-2021-21206 | Chromium Blink | Google Chromium Blink Use-After-Free Vulnerability | Unknown | CWE-416 | ||
| CVE-2021-21193 | Chromium Blink | Google Chromium Blink Use-After-Free Vulnerability | Unknown | CWE-416 | ||
| CVE-2021-21166 | Chromium | Google Chromium Race Condition Vulnerability | Unknown | CWE-122, CWE-362 | ||
| CVE-2021-21148 | Chromium V8 | Google Chromium V8 Heap Buffer Overflow Vulnerability | Unknown | CWE-122 | ||
| CVE-2020-6418 | Chromium V8 | Google Chromium V8 Type Confusion Vulnerability | Unknown | CWE-843 | ||
| CVE-2020-16017 | Chrome | Google Chrome Use-After-Free Vulnerability | Unknown | CWE-416 | ||
| CVE-2020-16013 | Chromium V8 | Google Chromium V8 Incorrect Implementation Vulnerabililty | Unknown | CWE-787 | ||
| CVE-2020-16010 | Chrome for Android UI | Google Chrome for Android UI Heap Buffer Overflow Vulnerability | Unknown | CWE-787 | ||
| CVE-2020-16009 | Chromium V8 | Google Chromium V8 Type Confusion Vulnerability | Unknown | CWE-787, CWE-843 | ||
| CVE-2020-15999 | Chrome FreeType | Google Chrome FreeType Heap Buffer Overflow Vulnerability | Unknown | CWE-787 |
Cite this
CISA's Known Exploited Vulnerabilities catalog lists 75 Google vulnerabilities (4.4% of all entries). Source: Telemetry analysis of the CISA Known Exploited Vulnerabilities catalog, version 2026.09.23 (released 2026-09-23). https://glide-telemetry.pages.dev/vendors/google/
Source: CISA KEV catalog v2026.09.23, released 2026-09-23. Windows end 2026-09-23. Vendor names are CISA's vendorProject strings; Telemetry states no facts about Google beyond this data.