VendorsPlatform
Google makes the Chrome browser, the Android and ChromeOS operating systems, Pixel devices and the Google Cloud platform.
- Response trend, 6 months
- Not enough history
- Open now
- None
- Latest incident
- 15 Sep 2026
- Incidents on record
- 19 (19 not yet reviewed)
Response to exploited bugs
Not rated. No reviewed zero-days yet.
Fixing privately reported bugs
65 range 50–80rank 20 of 20
Provisional 8 private reports, published on 6 dates. Not enough yet for a firm grade.
What a grade means. B means the vendor met the public norm, such as a first fix within 7 days of the first public report or a private fix within 120 days. Taking half the norm time scores 92, an A. Taking twice the norm time scores 43, a D−. How grades work
Why these grades
Every clock starts at the first public report.
- Response to exploited bugs: not rated. No reviewed exploited zero-days in the last 36 months, so this grade does not apply yet.
- Fixing privately reported bugs: C (65), provisional. Median 299 days from private report to ZDI's public advisory (8 cases). 7 of 8 took longer than ZDI's 120-day deadline. ZDI published 3 before a fix was available. ZDI also does this when a vendor declines to fix. 5 of 8 concern Chrome.
- 19 more exploited incidents await researcher review and are not graded.
Response to exploited bugs: sub-scores
- Time to first advisoryNo reviewed zero-days in the last 36 monthsNR0 cases, not used
- Time to first fixNo reviewed zero-days in the last 36 monthsNR0 cases, not used
- Time to fix all versionsNo reviewed zero-days in the last 36 monthsNR0 cases, not used
- OpennessAdvisories available by RSS626 cases, low confidence, not used for this vendor
Fixing privately reported bugs: sub-score
- Private fix speedMedian 299 days from private report to ZDI's public advisory (8 cases, 3 published without a fix)65C8 cases, low confidence, weight 100%
Response fingerprint
Compressed time scale
Counts toward the response grade 0
No incidents count toward the grade yet.
Not graded 19: n-days, unreviewed timelines and end-of-life products
- 15 Sep 2026Google Pixel Improper Authorization VulnerabilityNot graded: unreviewedNo response moments recorded
- 8 Sep 2026Google Chromium V8 Out of Bounds Write VulnerabilityNot graded: unreviewed
- 3 Sep 2026Google Chromium V8 Type Confusion VulnerabilityNot graded: unreviewed
- 8 Jun 2026Google Chromium V8 Out-of-Bounds Read and Write VulnerabilityNot graded: unreviewed
- 1 Jun 2026Android Framework Integer Overflow VulnerabilityNot graded: unreviewed
- 31 Mar 2026Google Dawn Use-After-Free VulnerabilityNot graded: unreviewed
- 12 Mar 2026Google Chromium V8 Improper Restriction of Operations Within the Bounds of a Memory Buffer VulnerabilityNot graded: unreviewed
- 12 Mar 2026Google Skia Out-of-Bounds Write VulnerabilityNot graded: unreviewed
- 13 Feb 2026Google Chromium CSS Use-After-Free VulnerabilityNot graded: unreviewed
- 1 Dec 2025Android Framework Information Disclosure VulnerabilityNot graded: unreviewed
- 1 Dec 2025Android Framework Privilege Escalation VulnerabilityNot graded: unreviewed
- 17 Nov 2025Google Chromium V8 Type Confusion VulnerabilityNot graded: unreviewed
- 17 Sep 2025Google Chromium V8 Type Confusion VulnerabilityNot graded: unreviewed
- 2 Sep 2025Android Runtime Use-After-Free VulnerabilityNot graded: unreviewed
- 15 Jul 2025Google Chromium ANGLE and GPU Improper Input Validation VulnerabilityNot graded: unreviewed
- 30 Jun 2025Google Chromium V8 Type Confusion VulnerabilityNot graded: unreviewed
- 2 Jun 2025Google Chromium V8 Out-of-Bounds Read and Write VulnerabilityNot graded: unreviewed
- 25 Mar 2025Google Chromium Mojo Sandbox Escape VulnerabilityNot graded: unreviewed
- 7 Nov 2024Android Framework Privilege Escalation VulnerabilityNot graded: unreviewedNo response moments recorded
- Vendor silent
- Vendor statement, no fix
- Fixed for some versions
- Open, no fix
- Open, partly fixed
- Fixed when disclosed
- Date only, no time of day
One row per exploited incident, newest first. A tick at the start means a fix existed when the bug went public.
Exploited incidents
19 in 24 months, 0 with known ransomware use
| First report | Incident | CVSS | Silence | First fix | All fixed | Status | Grade |
|---|---|---|---|---|---|---|---|
| 15 Sep 2026 | Google Pixel Improper Authorization VulnerabilityCVE-2026-58704 | 8.8 | – | not dated | not dated | Unknown | Not graded: unreviewed |
| 8 Sep 2026 | Google Chromium V8 Out of Bounds Write VulnerabilityCVE-2026-87491 | 8.8 | 0h | 0h | <1h | Fixed | Not graded: unreviewed |
| 3 Sep 2026 | Google Chromium V8 Type Confusion VulnerabilityCVE-2026-85046 | 8.8 | 0h | 0h | <1h | Fixed | Not graded: unreviewed |
| 8 Jun 2026 | Google Chromium V8 Out-of-Bounds Read and Write VulnerabilityCVE-2026-11645 | 8.8 | 0h | 0h | <1h | Fixed | Not graded: unreviewed |
| 1 Jun 2026 | Android Framework Integer Overflow VulnerabilityCVE-2025-48595 | 8.4 | same day | same day | same day | Fixed | Not graded: unreviewed |
| 31 Mar 2026 | Google Dawn Use-After-Free VulnerabilityCVE-2026-5281 | 8.8 | 0h | 0h | 0h | Fixed | Not graded: unreviewed |
| 12 Mar 2026 | Google Chromium V8 Improper Restriction of Operations Within the Bounds of a Memory Buffer VulnerabilityCVE-2026-3910 | 8.8 | 0h | 0h | 0h | Fixed | Not graded: unreviewed |
| 12 Mar 2026 | Google Skia Out-of-Bounds Write VulnerabilityCVE-2026-3909 | 8.8 | 0h | 0h | 0h | Fixed | Not graded: unreviewed |
| 13 Feb 2026 | Google Chromium CSS Use-After-Free VulnerabilityCVE-2026-2441 | 8.8 | 0h | 0h | 0h | Fixed | Not graded: unreviewed |
| 1 Dec 2025 | Android Framework Information Disclosure VulnerabilityCVE-2025-48633 | 5.5 | same day | same day | same day | Fixed | Not graded: unreviewed |
| 1 Dec 2025 | Android Framework Privilege Escalation VulnerabilityCVE-2025-48572 | 7.8 | same day | same day | same day | Fixed | Not graded: unreviewed |
| 17 Nov 2025 | Google Chromium V8 Type Confusion VulnerabilityCVE-2025-13223 | 8.8 | 0h | 0h | 0h | Fixed | Not graded: unreviewed |
Show 7 more incidents
| First report | Incident | CVSS | Silence | First fix | All fixed | Status | Grade |
|---|---|---|---|---|---|---|---|
| 17 Sep 2025 | Google Chromium V8 Type Confusion VulnerabilityCVE-2025-10585 | 8.8 | 0h | 0h | 0h | Fixed | Not graded: unreviewed |
| 2 Sep 2025 | Android Runtime Use-After-Free VulnerabilityCVE-2025-48543 | 8.8 | same day | same day | same day | Fixed | Not graded: unreviewed |
| 15 Jul 2025 | Google Chromium ANGLE and GPU Improper Input Validation VulnerabilityCVE-2025-6558 | 8.8 | 0h | 0h | 0h | Fixed | Not graded: unreviewed |
| 30 Jun 2025 | Google Chromium V8 Type Confusion VulnerabilityCVE-2025-6554 | 8.1 | 0h | 0h | 0h | Fixed | Not graded: unreviewed |
| 2 Jun 2025 | Google Chromium V8 Out-of-Bounds Read and Write VulnerabilityCVE-2025-5419 | 8.8 | 0h | 0h | 0h | Fixed | Not graded: unreviewed |
| 25 Mar 2025 | Google Chromium Mojo Sandbox Escape VulnerabilityCVE-2025-2783 | 8.3 | 0h | 0h | 0h | Fixed | Not graded: unreviewed |
| 7 Nov 2024 | Android Framework Privilege Escalation VulnerabilityCVE-2024-43093 | 7.3 | – | not dated | not dated | Fixed | Not graded: unreviewed |
Private reports
Median 299 days, 88% over 120 days, 3 published unpatched
Bugs reported privately to Google by ZDI or Project Zero.
120-day deadlinemedian 299d
| Published | Advisory | Product | Days from report to fix or to publication. Tick: ZDI's 120-day deadline. | Patch at publication |
|---|---|---|---|---|
| 5 Aug 2025 | ZDI-25-775 | Chrome | 306to publication | No, published unpatched |
| 5 Aug 2025 | ZDI-25-774 | Drive | 389to publication | No, published unpatched |
| 5 Aug 2025 | ZDI-25-773 | Drive | 396to publication | No, published unpatched |
| 30 Jan 2025 | ZDI-25-060CVE-2024-9954 | Chrome | 127to publication | Yes |
| 12 Jan 2025 | ZDI-24-366, ZDI-25-027CVE-2024-2886, CVE-2024-2887 | Chrome | 292to publication | Yes |
| 1 Aug 2024 | ZDI-24-1041CVE-2023-7261 | Chrome | 461to publication | Yes |
| 22 Apr 2024 | ZDI-24-369 | cAdvisor | 147to publication | Yes |
| 15 Apr 2024 | ZDI-24-367CVE-2024-3159 | Chrome | 19to publication | Yes |
Grade history
Response to exploited bugs: score at the end of each month.
Not rated at any point in this period.
Channels
Get Google's own alerts
- RSSChrome Releases: Stable updates (Atom)Add the advisory feed to a feed reader or chat integration.
- RSSGoogle Cloud security bulletins (Atom)Add the advisory feed to a feed reader or chat integration.
- XAndroid on XFollow the account and turn on notifications.
- BlogGoogle Online Security BlogSubscribe to the security blog.
- Advisory pageAndroid Security BulletinsCheck the advisory page. It has no push channel.
- Advisory pagePixel Update BulletinsCheck the advisory page. It has no push channel.
What we watch
- RSSChrome Releases: Stable updates (Atom)
- Advisory pageAndroid Security Bulletins
- Advisory pagePixel Update Bulletins
- RSSGoogle Cloud security bulletins (Atom)
- BlogGoogle Online Security Blog
See sources and health for when each was last read.
Grade not rated.