Vulnerabilidades en Google
6748 resultadosAnálisis Vexday
Com 4.763 CVEs catalogadas e 77 confirmadas em exploração ativa pelo CISA KEV, a taxa de exploração dos produtos Google é 3,6 vezes superior à média geral do catálogo, sinalizando risco operacional elevado para organizações que dependem desse ecossistema. O volume de 1.225 CVEs surgidas nos últimos 90 dias indica cadência intensa de descobertas, exigindo ciclos de patching ágeis. O tipo de falha mais recorrente é CWE-416 (use-after-free), classe de vulnerabilidade que frequentemente viabiliza execução de código arbitrário e escalada de privilégios. Destaque especial para CVE-2023-4863, com EPSS de 0,9974 — valor próximo ao máximo possível —, indicando probabilidade altíssima de exploração ativa e merecendo tratamento prioritário imediato.
CVE-2026-17774HIGHInsufficient validation of untrusted input in Variations in Google Chrome prior to 151.0.7922.72 allowed an attacker in a privileged networkEPSS 0.2%CVE-2025-12729MEDIUMInappropriate implementation in Omnibox in Google Chrome on Android prior to 142.0.7444.137 allowed a remote attacker who convinced a user tEPSS 0.2%CVE-2026-102329MEDIUMCross-site scripting in WebUI in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to bypass web origin policy into a privilegeEPSS 0.2%CVE-2023-6339CRITICALGoogle Nest WiFi Pro root code-execution & user-data compromiseEPSS 0.2%CVE-2023-21284—In multiple functions of DevicePolicyManager.java, there is a possible way to prevent enabling the Find my Device feature due to improper inEPSS 0.2%CVE-2024-54317MEDIUMWordPress Web Stories plugin <= 1.37.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-1260HIGHInvalid Memory Access in Sentencepiece,EPSS 0.2%CVE-2023-21288—In visitUris of Notification.java, there is a possible way to reveal images across users due to a missing permission check. This could lead EPSS 0.2%CVE-2026-103621MEDIUMInteger overflow in Compositing in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to leak cross-origin data via a crafted HTEPSS 0.2%CVE-2026-0129MEDIUMIn RtcpByePacket::decodeByePacket, there is a possible due to a missing bounds check. This could lead to remote information disclosure withEPSS 0.2%CVE-2026-11701MEDIUMInappropriate implementation in Guest View in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to perform UI spoofing via a cEPSS 0.2%CVE-2026-103629MEDIUMInteger overflow in Skia in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to leak cross-origin data via a crafted HTML pageEPSS 0.2%CVE-2025-24959LOWEnvironment Variable Injection for dotenv API in zxEPSS 0.2%CVE-2026-11685MEDIUMInappropriate implementation in MediaCapture in Google Chrome on Mac prior to 149.0.7827.103 allowed a remote attacker to leak cross-origin EPSS 0.2%CVE-2026-11233MEDIUMInsufficient policy enforcement in FoldableAPIs in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the reEPSS 0.2%CVE-2026-11247LOWInsufficient policy enforcement in CustomTabs in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to leak cross-oriEPSS 0.2%CVE-2026-11695MEDIUMInappropriate implementation in Passwords in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to leak cross-origin data via aEPSS 0.2%CVE-2026-11678MEDIUMInteger overflow in libyuv in Google Chrome prior to 149.0.7827.103 allowed a remote attacker who had compromised the renderer process to obEPSS 0.2%CVE-2026-11234MEDIUMInappropriate implementation in FoldableAPIs in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the rendeEPSS 0.2%CVE-2026-11261MEDIUMInappropriate implementation in PDF in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer proceEPSS 0.2%