// tag

Google

Security incidents tagged Google. Newest first.

## 7 Google incidents in the last year

through Oct 22, 2026

crit 4 · high 3 · med 2 · low 1 · upd ½severity-weighted: critical 4 · high 3 · medium 2 · low 1 · update ½lessmore

show 7 older incidents

Sep 16highGoogle Pixel: Google Pixel Improper Authorization Vulnerabilitypatched
› Google Pixel patched
Google Pixel devices contain an improper authorization vulnerability in the cellular modem. A logic error may allow an attacker to bypass permission checks and escalate privileges. Added to CISA KEV on 2026-09-16.
open incident →CVE-2026-58704
Sep 9highChrome zero-day CVE-2026-87491 (V8 OOB write)patched
› Google Chrome / Chromium V8 patched
September 9 2026 Chrome 153 patched CVE-2026-87491, a V8 out-of-bounds write Google said was exploited in the wild — the seventh Chrome zero-day of 2026. Fixed in 153.0.8010.36/.37. CISA KEV listed.
open incident →CVE-2026-87491
Sep 4highChrome zero-day CVE-2026-85046 (V8 type confusion)patched
› Google Chrome / Chromium V8 patched
September 4 2026 Chrome update patched CVE-2026-85046, a V8 type confusion zero-day Google said was exploited in the wild. Fixed in Chrome 152.0.7977.82/.83. Later added to CISA KEV.
open incident →CVE-2026-85046

Jun 1highChrome zero-day CVE-2026-11645 (V8 OOB)patched
› Google Chrome / Chromium V8 patched
June 2026 Chrome emergency update patched CVE-2026-11645, an out-of-bounds read/write in V8 exploited in the wild (fifth Chrome zero-day of 2026 at the time). Stable builds 149.0.7827.102/.103.
open incident →CVE-2026-11645

Apr 1highChrome zero-day CVE-2026-5281 (Dawn / WebGPU UAF)patched
› Google Chrome / Chromium Dawn patched
April 2026 Chrome patch for CVE-2026-5281, a use-after-free in Dawn (WebGPU), actively exploited in the wild.
open incident →CVE-2026-5281

Mar 1highChrome zero-days CVE-2026-3909 (Skia) and CVE-2026-3910 (V8)patched
› Google Chrome / Chromium patched
March 2026 Chrome updates fixed two actively exploited zero-days: CVE-2026-3909 (out-of-bounds write in Skia) and CVE-2026-3910 (inappropriate implementation in V8).
open incident →CVE-2026-3909 · CVE-2026-3910

Feb 13highChrome zero-day CVE-2026-2441 (CSS use-after-free)patched
› Google Chrome / Chromium patched
First actively exploited Chrome zero-day of 2026. Google patched CVE-2026-2441, a high-severity use-after-free in CSS (CSSFontFeatureValuesMap), in mid-February Chrome 145 updates. Google stated an exploit existed in the wild.
open incident →CVE-2026-2441