- Exploited flaws
- 76in 26 products
- Added to CISA's list in 2026
- 97 in 2025
- Used by ransomware
- 0of 76, says CISA
- Disclosure to CISA's list
- 4 daysmedian; 31 of 45 listed within 30 days
Exploited flaws by the year they were disclosed
The year in each CVE ID, roughly when the flaw became public. Recent years can still grow: flaws are often exploited, and listed, years later.
Hover or tab through a year for its count.
Show as a table
| Year disclosed | Exploited flaws |
|---|---|
| 2016 | 2 |
| 2017 | 2 |
| 2018 | 3 |
| 2019 | 3 |
| 2020 | 7 |
| 2021 | 19 |
| 2022 | 9 |
| 2023 | 8 |
| 2024 | 7 |
| 2025 | 7 |
| 2026 | 9 |
Products exploited more than once
| Product | Flaws | First listed | Latest |
|---|---|---|---|
| Chromium V8 | 41 | 2021-11-03 | 2026-09-09 |
| Chromium | 6 | 2021-11-03 | 2026-02-17 |
| Chromium Blink | 2 | 2021-11-03 | 2021-11-03 |
| Chromium Intents | 2 | 2021-11-03 | 2022-08-18 |
| Chromium Mojo | 2 | 2022-09-08 | 2025-03-27 |
| Chromium Skia | 2 | 2023-04-21 | 2023-11-30 |
| Pixel | 2 | 2022-04-11 | 2026-09-16 |
Latest on CISA's list
- Google Brotli Unchecked Return Value Vulnerability
- Google Pixel Improper Authorization Vulnerability
- Google Chromium V8 Out of Bounds Write Vulnerability
- Google Chromium V8 Type Confusion Vulnerability
- Google Chromium V8 Out-of-Bounds Read and Write Vulnerability
- Google Dawn Use-After-Free Vulnerability
- Google Chromium V8 Improper Restriction of Operations Within the Bounds of a Memory Buffer Vulnerability
- Google Skia Out-of-Bounds Write Vulnerability
- Google Chromium CSS Use-After-Free Vulnerability
- Google Chromium Out of Bounds Memory Access Vulnerability
In the news
- Google's Gemini 4 Carbon Leads Benchmarks for Finding, Exploiting, and Patching Vulnerabilities
- Google to Allow One-Tap Android App Installs From Approved Third-Party Stores Outside U.S.
- Google Says Gmail and Photos Data Shared With AI Search Could Be Used for Targeted Ads
- Google Chrome adds Gemini-powered scam detection, warns users of ClickFix attacks
- UAT-11985 Uses Fake Event Invites to Target Taiwan Research Affiliates With Google AitM Phishing
From CISA's Known Exploited Vulnerabilities catalogue. "Disclosure to CISA's list" uses NVD's publication date and leaves out the 2021-11-03 launch, when CISA added hundreds of older flaws at once; CISA often lists a flaw after attacks have begun, so it's an upper limit on how fast exploitation came.