Patchfirst: Google vulnerabilitieshttps://patchfirst.co/vendor/google/New and newly exploited Google CVEs, with CISA KEV, EPSS and ATT&CK context. Newest 50 by publication or KEV listing.en-gb360Sat, 31 Oct 2026 05:11:25 GMTCVE-2026-119261: Improper input validation in Skia in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially…https://patchfirst.co/cve/CVE-2026-119261/CVE-2026-119261Fri, 30 Oct 2026 00:00:00 GMTGoogle · Chrome. Not in CISA KEV. EPSS 0.2% (higher than 11.6% of CVEs). CVSS 9.6 CRITICAL. Priority 9.7 of 100.CVE-2026-119263: Memory corruption in GarbageCollection in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to…https://patchfirst.co/cve/CVE-2026-119263/CVE-2026-119263Fri, 30 Oct 2026 00:00:00 GMTGoogle · Chrome. Not in CISA KEV. EPSS 0.2% (higher than 9.7% of CVEs). CVSS 9.6 CRITICAL. Priority 9.3 of 100.[KEV] CVE-2026-111497: Google Brotli Unchecked Return Value Vulnerabilityhttps://patchfirst.co/cve/CVE-2026-111497/CVE-2026-111497#kevTue, 27 Oct 2026 00:00:00 GMTGoogle · Brotli. In CISA KEV since 2026-10-27. ENISA EUVD lists it as exploited. EPSS 82.6% (higher than 99.67% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1005 Data from Local System; T1059 Command and Scripting Interpreter; T1499.004 Application or System Exploitation. Priority 79.8 of 100.kevpublic-exploitT1190T1005T1059T1499.004CVE-2026-118306: Memory corruption in FileSystem in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially…https://patchfirst.co/cve/CVE-2026-118306/CVE-2026-118306Tue, 27 Oct 2026 00:00:00 GMTGoogle · Chrome. Not in CISA KEV. EPSS 0.4% (higher than 30.7% of CVEs). CVSS 9.6 CRITICAL. Priority 14.2 of 100.CVE-2026-118305: Memory corruption in Turbolev in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute…https://patchfirst.co/cve/CVE-2026-118305/CVE-2026-118305Tue, 27 Oct 2026 00:00:00 GMTGoogle · Chrome. Not in CISA KEV. EPSS 0.4% (higher than 30.7% of CVEs). CVSS 9.6 CRITICAL. Priority 14.2 of 100.CVE-2026-118340: Memory corruption in Skia in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute…https://patchfirst.co/cve/CVE-2026-118340/CVE-2026-118340Tue, 27 Oct 2026 00:00:00 GMTGoogle · Chrome. Not in CISA KEV. EPSS 0.4% (higher than 29.1% of CVEs). CVSS 9.6 CRITICAL. Priority 13.9 of 100.CVE-2026-118321: Improper input validation in Core in Google Chrome on on Android prior to 156.0.8078.73 allowed a remote attacker to…https://patchfirst.co/cve/CVE-2026-118321/CVE-2026-118321Tue, 27 Oct 2026 00:00:00 GMTGoogle · Chrome. Not in CISA KEV. EPSS 0.4% (higher than 29.1% of CVEs). CVSS 9.6 CRITICAL. Priority 13.9 of 100.CVE-2026-118312: Memory corruption in Paint in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute…https://patchfirst.co/cve/CVE-2026-118312/CVE-2026-118312Tue, 27 Oct 2026 00:00:00 GMTGoogle · Chrome. Not in CISA KEV. EPSS 0.3% (higher than 23.6% of CVEs). CVSS 9.6 CRITICAL. Priority 12.8 of 100.CVE-2026-118310: Improper input validation in Views in Google Chrome on on Windows prior to 156.0.8078.73 allowed a remote attacker to…https://patchfirst.co/cve/CVE-2026-118310/CVE-2026-118310Tue, 27 Oct 2026 00:00:00 GMTGoogle · Chrome. Not in CISA KEV. EPSS 0.3% (higher than 23.6% of CVEs). CVSS 9.6 CRITICAL. Priority 12.8 of 100.CVE-2026-118309: Improper input validation in UI in Google Chrome on on Android prior to 156.0.8078.73 allowed a remote attacker to…https://patchfirst.co/cve/CVE-2026-118309/CVE-2026-118309Tue, 27 Oct 2026 00:00:00 GMTGoogle · Chrome. Not in CISA KEV. EPSS 0.3% (higher than 23.6% of CVEs). CVSS 9.6 CRITICAL. Priority 12.8 of 100.CVE-2026-118308: Use after free in SVG in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute…https://patchfirst.co/cve/CVE-2026-118308/CVE-2026-118308Tue, 27 Oct 2026 00:00:00 GMTGoogle · Chrome. Not in CISA KEV. EPSS 0.3% (higher than 23.6% of CVEs). CVSS 9.6 CRITICAL. Priority 12.8 of 100.CVE-2026-118355: Improper input validation in Command in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially…https://patchfirst.co/cve/CVE-2026-118355/CVE-2026-118355Tue, 27 Oct 2026 00:00:00 GMTGoogle · Chrome. Not in CISA KEV. EPSS 0.3% (higher than 22.2% of CVEs). CVSS 9.6 CRITICAL. Priority 12.5 of 100.CVE-2026-118342: Out of bounds write in Editing in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially…https://patchfirst.co/cve/CVE-2026-118342/CVE-2026-118342Tue, 27 Oct 2026 00:00:00 GMTGoogle · Chrome. Not in CISA KEV. EPSS 0.3% (higher than 22.2% of CVEs). CVSS 9.6 CRITICAL. Priority 12.5 of 100.CVE-2026-118332: Improper input validation in Compositing in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to…https://patchfirst.co/cve/CVE-2026-118332/CVE-2026-118332Tue, 27 Oct 2026 00:00:00 GMTGoogle · Chrome. Not in CISA KEV. EPSS 0.3% (higher than 22.2% of CVEs). CVSS 9.6 CRITICAL. Priority 12.5 of 100.CVE-2026-118316: Improper input validation in V8 in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially…https://patchfirst.co/cve/CVE-2026-118316/CVE-2026-118316Tue, 27 Oct 2026 00:00:00 GMTGoogle · Chrome. Not in CISA KEV. EPSS 0.3% (higher than 22.2% of CVEs). CVSS 9.6 CRITICAL. Priority 12.5 of 100.CVE-2026-118337: Improper access control in Forms in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to bypass web…https://patchfirst.co/cve/CVE-2026-118337/CVE-2026-118337Tue, 27 Oct 2026 00:00:00 GMTGoogle · Chrome. Not in CISA KEV. EPSS 0.2% (higher than 9.2% of CVEs). CVSS 9.3 CRITICAL. Priority 9.7 of 100.CVE-2026-118333: Missing authorization in Video in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to bypass web origin…https://patchfirst.co/cve/CVE-2026-118333/CVE-2026-118333Tue, 27 Oct 2026 00:00:00 GMTGoogle · Chrome. Not in CISA KEV. EPSS 0.2% (higher than 9.2% of CVEs). CVSS 9.3 CRITICAL. Priority 9.7 of 100.CVE-2026-113263: Use after free in Core in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially…https://patchfirst.co/cve/CVE-2026-113263/CVE-2026-113263Tue, 20 Oct 2026 00:00:00 GMTGoogle · Chrome. Not in CISA KEV. EPSS 0.5% (higher than 40.3% of CVEs). CVSS 9.6 CRITICAL. Public exploit code exists. Priority 21.7 of 100.public-exploitCVE-2026-113072: Memory corruption in CSS in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute…https://patchfirst.co/cve/CVE-2026-113072/CVE-2026-113072Tue, 20 Oct 2026 00:00:00 GMTGoogle · Chrome. Not in CISA KEV. EPSS 0.5% (higher than 42.8% of CVEs). CVSS 9.6 CRITICAL. Priority 17.2 of 100.CVE-2026-113336: Memory corruption in Compositing in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially…https://patchfirst.co/cve/CVE-2026-113336/CVE-2026-113336Tue, 20 Oct 2026 00:00:00 GMTGoogle · Chrome. Not in CISA KEV. EPSS 0.5% (higher than 42.4% of CVEs). CVSS 9.6 CRITICAL. Priority 17.1 of 100.CVE-2026-113328: Improper input validation in Privacy in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially…https://patchfirst.co/cve/CVE-2026-113328/CVE-2026-113328Tue, 20 Oct 2026 00:00:00 GMTGoogle · Chrome. Not in CISA KEV. EPSS 0.5% (higher than 42.5% of CVEs). CVSS 9.6 CRITICAL. Priority 17.1 of 100.CVE-2026-113300: Out of bounds write in Forms in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute…https://patchfirst.co/cve/CVE-2026-113300/CVE-2026-113300Tue, 20 Oct 2026 00:00:00 GMTGoogle · Chrome. Not in CISA KEV. EPSS 0.5% (higher than 42.5% of CVEs). CVSS 9.6 CRITICAL. Priority 17.1 of 100.CVE-2026-113252: Improper input validation in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to…https://patchfirst.co/cve/CVE-2026-113252/CVE-2026-113252Tue, 20 Oct 2026 00:00:00 GMTGoogle · Chrome. Not in CISA KEV. EPSS 0.5% (higher than 42.5% of CVEs). CVSS 9.6 CRITICAL. Priority 17.1 of 100.CVE-2026-113235: Improper input validation in Passwords in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to…https://patchfirst.co/cve/CVE-2026-113235/CVE-2026-113235Tue, 20 Oct 2026 00:00:00 GMTGoogle · Chrome. Not in CISA KEV. EPSS 0.5% (higher than 42.5% of CVEs). CVSS 9.6 CRITICAL. Priority 17.1 of 100.CVE-2026-113089: Improper input validation in PrintPreview in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to…https://patchfirst.co/cve/CVE-2026-113089/CVE-2026-113089Tue, 20 Oct 2026 00:00:00 GMTGoogle · Chrome. Not in CISA KEV. EPSS 0.5% (higher than 42.5% of CVEs). CVSS 9.6 CRITICAL. Priority 17.1 of 100.CVE-2026-113023: Improper input validation in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to…https://patchfirst.co/cve/CVE-2026-113023/CVE-2026-113023Tue, 20 Oct 2026 00:00:00 GMTGoogle · Chrome. Not in CISA KEV. EPSS 0.5% (higher than 42.5% of CVEs). CVSS 9.6 CRITICAL. Priority 17.1 of 100.CVE-2026-113020: Improper input validation in Date in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially…https://patchfirst.co/cve/CVE-2026-113020/CVE-2026-113020Tue, 20 Oct 2026 00:00:00 GMTGoogle · Chrome. Not in CISA KEV. EPSS 0.5% (higher than 42.5% of CVEs). CVSS 9.6 CRITICAL. Priority 17.1 of 100.CVE-2026-113014: Use after free in PerformanceAPIs in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially…https://patchfirst.co/cve/CVE-2026-113014/CVE-2026-113014Tue, 20 Oct 2026 00:00:00 GMTGoogle · Chrome. Not in CISA KEV. EPSS 0.5% (higher than 42.5% of CVEs). CVSS 9.6 CRITICAL. Priority 17.1 of 100.CVE-2026-105772: Path Traversal (CWE-22) in FileArtifactService in Google ADK TypeScript (@google/adk) versions 0.4.0 before 0.6.0…https://patchfirst.co/cve/CVE-2026-105772/CVE-2026-105772Tue, 20 Oct 2026 00:00:00 GMTGoogle · ADK TypeScript (@google/adk). Not in CISA KEV. EPSS 0.5% (higher than 43.7% of CVEs). CVSS 9.1 CRITICAL. Priority 17.0 of 100.CVE-2026-113342: Memory corruption in Network in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary…https://patchfirst.co/cve/CVE-2026-113342/CVE-2026-113342Tue, 20 Oct 2026 00:00:00 GMTGoogle · Chrome. Not in CISA KEV. EPSS 0.5% (higher than 41.1% of CVEs). CVSS 9.6 CRITICAL. Priority 16.8 of 100.CVE-2026-113283: Memory corruption in CredentialProvider in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote…https://patchfirst.co/cve/CVE-2026-113283/CVE-2026-113283Tue, 20 Oct 2026 00:00:00 GMTGoogle · Chrome. Not in CISA KEV. EPSS 0.5% (higher than 41.1% of CVEs). CVSS 9.6 CRITICAL. Priority 16.8 of 100.CVE-2026-113270: Use after free in Internals in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary…https://patchfirst.co/cve/CVE-2026-113270/CVE-2026-113270Tue, 20 Oct 2026 00:00:00 GMTGoogle · Chrome. Not in CISA KEV. EPSS 0.5% (higher than 41.1% of CVEs). CVSS 9.6 CRITICAL. Priority 16.8 of 100.CVE-2026-113261: Use after free in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially…https://patchfirst.co/cve/CVE-2026-113261/CVE-2026-113261Tue, 20 Oct 2026 00:00:00 GMTGoogle · Chrome. Not in CISA KEV. EPSS 0.5% (higher than 41.1% of CVEs). CVSS 9.6 CRITICAL. Priority 16.8 of 100.CVE-2026-113189: Use after free in Core in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code…https://patchfirst.co/cve/CVE-2026-113189/CVE-2026-113189Tue, 20 Oct 2026 00:00:00 GMTGoogle · Chrome. Not in CISA KEV. EPSS 0.5% (higher than 41.1% of CVEs). CVSS 9.6 CRITICAL. Priority 16.8 of 100.CVE-2026-113186: Memory corruption in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary…https://patchfirst.co/cve/CVE-2026-113186/CVE-2026-113186Tue, 20 Oct 2026 00:00:00 GMTGoogle · Chrome. Not in CISA KEV. EPSS 0.5% (higher than 41.1% of CVEs). CVSS 9.6 CRITICAL. Priority 16.8 of 100.CVE-2026-113222: Use after free in V8 in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute…https://patchfirst.co/cve/CVE-2026-113222/CVE-2026-113222Tue, 20 Oct 2026 00:00:00 GMTGoogle · Chrome. Not in CISA KEV. EPSS 0.5% (higher than 40.3% of CVEs). CVSS 9.6 CRITICAL. Priority 16.7 of 100.CVE-2026-113171: Memory corruption in Prompts in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to…https://patchfirst.co/cve/CVE-2026-113171/CVE-2026-113171Tue, 20 Oct 2026 00:00:00 GMTGoogle · Chrome. Not in CISA KEV. EPSS 0.5% (higher than 40.3% of CVEs). CVSS 9.6 CRITICAL. Priority 16.7 of 100.CVE-2026-113169: Memory corruption in WebAppInstalls in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to…https://patchfirst.co/cve/CVE-2026-113169/CVE-2026-113169Tue, 20 Oct 2026 00:00:00 GMTGoogle · Chrome. Not in CISA KEV. EPSS 0.5% (higher than 40.3% of CVEs). CVSS 9.6 CRITICAL. Priority 16.7 of 100.CVE-2026-113138: Memory corruption in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially…https://patchfirst.co/cve/CVE-2026-113138/CVE-2026-113138Tue, 20 Oct 2026 00:00:00 GMTGoogle · Chrome. Not in CISA KEV. EPSS 0.5% (higher than 40.3% of CVEs). CVSS 9.6 CRITICAL. Priority 16.7 of 100.CVE-2026-113126: Memory corruption in PolicyContainer in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially…https://patchfirst.co/cve/CVE-2026-113126/CVE-2026-113126Tue, 20 Oct 2026 00:00:00 GMTGoogle · Chrome. Not in CISA KEV. EPSS 0.5% (higher than 40.3% of CVEs). CVSS 9.6 CRITICAL. Priority 16.7 of 100.CVE-2026-113116: Use after free in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute…https://patchfirst.co/cve/CVE-2026-113116/CVE-2026-113116Tue, 20 Oct 2026 00:00:00 GMTGoogle · Chrome. Not in CISA KEV. EPSS 0.5% (higher than 40.3% of CVEs). CVSS 9.6 CRITICAL. Priority 16.7 of 100.CVE-2026-113056: Memory corruption in PerformanceAPIs in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially…https://patchfirst.co/cve/CVE-2026-113056/CVE-2026-113056Tue, 20 Oct 2026 00:00:00 GMTGoogle · Chrome. Not in CISA KEV. EPSS 0.5% (higher than 40.3% of CVEs). CVSS 9.6 CRITICAL. Priority 16.7 of 100.CVE-2026-113007: Memory corruption in Permissions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially…https://patchfirst.co/cve/CVE-2026-113007/CVE-2026-113007Tue, 20 Oct 2026 00:00:00 GMTGoogle · Chrome. Not in CISA KEV. EPSS 0.5% (higher than 40.3% of CVEs). CVSS 9.6 CRITICAL. Priority 16.7 of 100.CVE-2026-112992: Memory corruption in Canvas in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute…https://patchfirst.co/cve/CVE-2026-112992/CVE-2026-112992Tue, 20 Oct 2026 00:00:00 GMTGoogle · Chrome. Not in CISA KEV. EPSS 0.5% (higher than 40.3% of CVEs). CVSS 9.6 CRITICAL. Priority 16.7 of 100.CVE-2026-113211: Memory corruption in ServiceWorker in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially…https://patchfirst.co/cve/CVE-2026-113211/CVE-2026-113211Tue, 20 Oct 2026 00:00:00 GMTGoogle · Chrome. Not in CISA KEV. EPSS 0.5% (higher than 39.2% of CVEs). CVSS 9.6 CRITICAL. Priority 16.5 of 100.CVE-2026-113084: Improper input validation in Permissions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to…https://patchfirst.co/cve/CVE-2026-113084/CVE-2026-113084Tue, 20 Oct 2026 00:00:00 GMTGoogle · Chrome. Not in CISA KEV. EPSS 0.4% (higher than 36.7% of CVEs). CVSS 9.6 CRITICAL. Priority 16.0 of 100.CVE-2026-113078: Improper input validation in Compositing in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to…https://patchfirst.co/cve/CVE-2026-113078/CVE-2026-113078Tue, 20 Oct 2026 00:00:00 GMTGoogle · Chrome. Not in CISA KEV. EPSS 0.4% (higher than 36.7% of CVEs). CVSS 9.6 CRITICAL. Priority 16.0 of 100.CVE-2026-103091: Missing Authorization (CWE-862) and Initialization of a Resource with an Insecure Default (CWE-1188) in the MCP proxy…https://patchfirst.co/cve/CVE-2026-103091/CVE-2026-103091Mon, 19 Oct 2026 00:00:00 GMTGoogle · SAM. Not in CISA KEV. EPSS 0.6% (higher than 50.7% of CVEs). CVSS 9.3 CRITICAL. Priority 18.2 of 100.CVE-2026-102503: Missing Authentication for Critical Function (CWE-306) and Missing Authorization (CWE-862) in the /libp2p-http ingress…https://patchfirst.co/cve/CVE-2026-102503/CVE-2026-102503Mon, 19 Oct 2026 00:00:00 GMTGoogle · SAM. Not in CISA KEV. EPSS 0.4% (higher than 37.2% of CVEs). CVSS 9.3 CRITICAL. Priority 15.5 of 100.CVE-2026-110916: Improper input validation in Desktop in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to potentially…https://patchfirst.co/cve/CVE-2026-110916/CVE-2026-110916Thu, 15 Oct 2026 00:00:00 GMTGoogle · Chrome. Not in CISA KEV. EPSS 0.4% (higher than 30.1% of CVEs). CVSS 9.6 CRITICAL. Priority 14.9 of 100.