Vulnerabilidades em Google
7.001 resultadosAnálise Vexday
Com 4.763 CVEs catalogadas e 77 confirmadas em exploração ativa pelo CISA KEV, a taxa de exploração dos produtos Google é 3,6 vezes superior à média geral do catálogo, sinalizando risco operacional elevado para organizações que dependem desse ecossistema. O volume de 1.225 CVEs surgidas nos últimos 90 dias indica cadência intensa de descobertas, exigindo ciclos de patching ágeis. O tipo de falha mais recorrente é CWE-416 (use-after-free), classe de vulnerabilidade que frequentemente viabiliza execução de código arbitrário e escalada de privilégios. Destaque especial para CVE-2023-4863, com EPSS de 0,9974 — valor próximo ao máximo possível —, indicando probabilidade altíssima de exploração ativa e merecendo tratamento prioritário imediato.
CVE-2026-56975MEDIUMIn Cellular Modem, there is a possible denial of service due to improper input validation. This could lead to remote (proximal/adjacent) denEPSS 0.1%CVE-2025-13635MEDIUMInappropriate implementation in Downloads in Google Chrome prior to 143.0.7499.41 allowed a local attacker to perform UI spoofing via a crafEPSS 0.1%CVE-2026-17739MEDIUMInsufficient policy enforcement in Extensions in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a user to install a EPSS 0.1%CVE-2026-0027MEDIUMIn smmu_detach_dev of arm-smmu-v3.c, there is a possible out of bounds write due to a use after free. This could lead to local escalation ofEPSS 0.1%CVE-2023-35685HIGHIn DevmemIntMapPages of devicemem_server.c, there is a possible physical page uaf due to a logic error in the code. This could lead to localEPSS 0.1%CVE-2026-11217MEDIUMInappropriate implementation in Fenced Frames in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the rendEPSS 0.1%CVE-2026-83530MEDIUMUncontrolled Memory Allocation in cel-goEPSS 0.1%CVE-2026-11243MEDIUMInappropriate implementation in Downloads in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass navigation restrictionEPSS 0.1%CVE-2023-21342HIGHIn RemoteSpeechRecognitionService of RemoteSpeechRecognitionService.java, there is a possible way to launch an activity from the background EPSS 0.1%CVE-2024-0043HIGHIn multiple locations, there is a possible notification listener grant to an app running in the work profile due to a logic error in the codEPSS 0.1%CVE-2026-11253MEDIUMInappropriate implementation in Permissions in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via EPSS 0.1%CVE-2026-11221MEDIUMInsufficient validation of untrusted input in PointerLock in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromiEPSS 0.1%CVE-2026-0081CRITICALIn NFC, there is a possible way to spoof an NFC event due to a missing permission check. This could lead to local escalation of privilege wiEPSS 0.1%CVE-2026-11181MEDIUMInappropriate implementation in Media Session in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass same origin policyEPSS 0.1%CVE-2026-11677HIGHRace in Network in Google Chrome on Mac prior to 149.0.7827.103 allowed a remote attacker who had compromised the network process to potentiEPSS 0.1%CVE-2024-0047MEDIUMIn writeUserLP of UserManagerService.java, device policies are serialized with an incorrect tag due to a logic error in the code. This couldEPSS 0.1%CVE-2026-11205MEDIUMInsufficient validation of untrusted input in Chrome for iOS in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote attacker who coEPSS 0.1%CVE-2026-13037HIGHUse after free in WebView in Google Chrome on Android prior to 149.0.7827.197 allowed a local attacker to execute arbitrary code inside a saEPSS 0.1%CVE-2026-11232MEDIUMInappropriate implementation in TabGroups in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to perform UI spoofing via malicEPSS 0.1%CVE-2026-76037HIGHLink following in CredentialProvider in Google Chrome on on Windows prior to 151.0.7922.169 allowed a local attacker to potentially execute EPSS 0.1%