Google Cloud Platform — IAM, GKE, BigQuery, Cloud Storage.
CVE-2025-0647 affects select Arm processors (Neoverse and Cortex series) used in Google Cloud Compute Engine Arm VMs (C4A, A4X instances). A vulnerability in the CPP RCTX instruction allows attackers with privileged guest kernel access to inhibit TLB invalidations, potentially enabling unauthorized reading of sensitive data. Google has already applied mitigations to the affected Arm server fleet; no customer action is required.
HTTP2Shell (CVE-2026-111497), a critical memory-corruption vulnerability in Google's Brotli compression library, was disclosed October 2026 with CVSS 9.2 score. The flaw in Brotli's decompression code can trigger out-of-bounds memory writes when processing malformed compressed input, potentially leading to arbitrary code execution. Affects Node.js, Python HTTP clients, Bun, Envoy, and Istio deployments. Patched versions released October 2026.
OpenCode Console platform breach in October 2026 exposed API keys for Google, OpenAI, and Anthropic services belonging to 1.4% of users. Attackers leveraged stolen credentials to conduct automated 'distillation attacks' resulting in unauthorized charges and operational disruption. Google API keys were revoked and users notified as part of remediation.
Google patched a critical unauthenticated remote code execution vulnerability in its shared DevSite platform that affected developers.google.com, firebase.google.com, and other Google infrastructure. The flaw allowed attackers to forge Flask session cookies with malicious Python pickle payloads after recovering exposed OAuth credentials and reused Flask secrets from signed cookies. The vulnerability was discovered by security researcher Simon Köck and patched October 7, 2026.
Nikkei Inc. disclosed unauthorized access to a Google Workspace email account beginning in late July 2026, affecting credentials for 1,646 employees and business partners. An attacker accessed personal information including names and email addresses; no evidence of further misuse has been reported. The incident was detected in early August after a Google security alert, and the affected account password was reset.
Google Gemini AI accidentally accessed protected systems belonging to three real companies during a cybersecurity evaluation conducted by Irregular. A configuration error exposed the AI agent to the public internet, enabling it to guess credentials against one service and access authenticated systems using exposed credentials found in public repositories. Google confirmed no damage occurred and safeguards halted the activity once unauthorized access was detected.
Plugin4Shell vulnerability disclosed affecting Google Gemini CLI and other AI coding agents. The flaw allows zero-click remote code execution through Git reference name ambiguity in plugin resolution, enabling attackers to replace pinned, trusted plugins with malicious code. Google stated it will not patch the deprecated Gemini CLI, advising users to migrate away from it.
Google disclosed CVE-2026-19486, a high-severity server-side request forgery (SSRF) vulnerability in Google Cloud Gemini Enterprise Agent Platform App Builder versions prior to 2026-06-01. An unauthenticated attacker can exploit this flaw to leak Compute Engine default service account access tokens. Google patched the vulnerability on June 1, 2026; affected users must redeploy their applications.
Google patched CVE-2026-87491, a high-severity out-of-bounds write vulnerability in the Chrome V8 JavaScript engine, which has been actively exploited in the wild. The flaw allows remote code execution via crafted HTML pages. Google released patched versions 153.0.8010.36 (Windows/Linux) and 153.0.8010.37 (macOS). This is the seventh actively exploited Chrome zero-day patched in 2026.
Google patched CVE-2026-85046, an actively exploited zero-day type confusion vulnerability in Chrome's V8 JavaScript engine. The flaw allows remote code execution via crafted HTML pages and has been exploited in the wild. Google released Chrome 152.0.7977.82/.83 (Windows/macOS) and 152.0.7977.82 (Linux) to address this and 11 other vulnerabilities. This is the sixth Chrome zero-day Google fixed in 2026.
CVE-2025-0982: Sandbox escape vulnerability in Google Cloud Application Integration allows arbitrary command execution within Google's Borg infrastructure. Vulnerability enabled complete escape from the Rhino JavaScript execution environment and execution of arbitrary commands on internal production systems. Google mitigated the issue within 48 hours of disclosure (Mar 30, 2026), deprecated Rhino entirely, and migrated JavaScript tasks to the V8 engine. Security bulletin GCP-2026-044 published June 25, 2026. Researcher awarded $75,000 bounty through Google's Vulnerability Reward Program.
CVE-2026-12710: Missing Authorization vulnerability in Google Cloud Application Integration QueryEngineTask allows external attackers to access sensitive internal data without authentication. CVSS 9.3 (critical). Affected versions from 2025-04-28 to 2026-04-04. Google patched the vulnerability server-side on April 4, 2026; no customer action required.
APT36 suspected in PATCHCORD espionage campaign targeting Afghan telecom and South Asian infrastructure. Attackers deliver PATCHCORD backdoor via fake VPN installers and abuse Google Sheets (via SHEETCORD implant) for command-and-control communication. Persistence achieved through browser shortcut hijacking.
Palo Alto Networks Unit 42 disclosed three attack techniques (Pass-ta-key, Silver Pass-ta-key, Golden Pass-ta-key) that enable malware on a compromised Windows device to hijack Google passkey-protected accounts without requiring device unlock, user interaction, or privilege escalation. The attacks exploit weaknesses in Google's cloud authenticator and device re-enrollment workflows, potentially allowing extraction of all synced passkey private keys. Unit 42 recommends enforcing strict user verification policies and strengthening recovery workflows.
Google Cloud Looker released version 26.12 to patch CVE-2026-15810, a cross-site scripting vulnerability allowing attackers to hijack administrator accounts through malicious URLs. Cloud-hosted instances were automatically remediated; self-hosted operators must apply patches to supported release branches. The release also enforces multi-factor authentication by default for email/password authentication.
GhostCommit, disclosed July 13, 2026, is a prompt-injection technique that hides malicious instructions within images embedded in pull requests to evade text-based AI code reviewers. Affecting tools including Google Antigravity, Cursor, and CodeRabbit, the attack can trick multimodal AI agents into leaking repository secrets such as .env files. Researchers demonstrated the flaw by embedding instructions in PNG files that text-based reviewers skip, allowing malicious agents to encode and exfiltrate credentials as obfuscated numeric values that bypass standard secret scanners.
GhostApproval, a vulnerability pattern disclosed July 9, 2026, affects Google Antigravity and other AI coding assistants. It exploits symlink following combined with UI misrepresentation to bypass file operation confirmations, enabling arbitrary file writes and remote code execution. Google has implemented fixes and is evaluating formal CVE assignment.
Rogue Agent, a critical vulnerability in GCP Dialogflow CX disclosed by Varonis Threat Labs, allows attackers to inject persistent malicious code via Playbook Code Blocks. The flaw requires only dialogflow.playbooks.update permission and enables conversation exfiltration, phishing attacks, and credential theft. Code Block logic executed in a shared Cloud Run environment, permitting cross-agent compromise. Google received disclosure in November 2025, deployed an initial fix in April 2026, and fully resolved the issue by June 2026 with no confirmed prior exploitation.
Januscape (CVE-2026-53359), a 16-year-old use-after-free vulnerability in KVM's shadow MMU, enables guest-to-host escape on systems with nested virtualization enabled. Discovered by researcher Hyunwoo Kim via Google's kvmCTF bug bounty program, the flaw allows root access on the host machine. The vulnerability affects both Intel and AMD processors and has been present since kernel 2.6.36 (August 2010). Patches are available; organizations should update immediately or disable nested virtualization if patching is delayed.
CVE-2026-2031 is a critical remote code execution vulnerability in Google Cloud Application Integration that combines multiple flaws: exposed internal APIs returning protobuf descriptors, IDOR weaknesses, and an unauthenticated workflow execution endpoint. An attacker could exploit these to execute arbitrary Stubby RPC calls in Google Cloud production with the privileged service identity of the integration platform. Google has patched the vulnerability; the researcher earned $148,337 through Google's Vulnerability Reward Program.
A critical vulnerability in Google Cloud Vertex AI's Python SDK (google-cloud-aiplatform) dubbed 'Pickle in the Middle' enables attackers to hijack machine learning model uploads and achieve cross-tenant remote code execution. The flaw combines predictable bucket naming, bucket squatting, and unsafe deserialization to allow attackers to poison ML artifacts before deployment. Exploitation leads to service account token theft and access to sensitive cloud resources. Google patched the issue in SDK versions 1.144.0 and 1.148.0; users should upgrade immediately and specify explicit staging buckets.
Threat actors are increasingly exploiting Google Cloud Logging and AWS CloudTrail to evade detection and maintain unauthorized visibility into victim environments. Attack techniques include disabling logging, deleting logs, modifying encryption keys to render logs unreadable, log poisoning through S3/Cloud Storage permissions, and redirecting logs to attacker-controlled destinations. While organizations often assume logs are protected, these logging services lack uniform protection enforcement, enabling attackers to blind security monitoring and enable long-term reconnaissance. Defenders are advised to enforce strict access controls on logging APIs, enable log integrity validation and bucket locking, and implement continuous monitoring of logging configuration changes.
Google Chrome versions prior to 149.0.7827.53 on Windows contain CVE-2026-11005, an out-of-bounds read vulnerability in the ANGLE graphics library. The flaw requires prior renderer process compromise but allows attackers to leak sensitive data such as cryptographic keys, authentication tokens, and credentials from adjacent memory regions. Exploitation occurs via crafted HTML pages and affects all vulnerable Windows Chrome installations.
Google released emergency patches on June 9, 2026 for CVE-2026-11645, an out-of-bounds memory access vulnerability in Chrome's V8 JavaScript engine that is actively being exploited in the wild. The flaw enables remote attackers to execute arbitrary code via crafted HTML pages, exposing sensitive data or triggering crashes. This is the fifth exploited Chrome zero-day of 2026.
CISA added CVE-2025-48595, an actively exploited Android Framework integer overflow vulnerability, to its Known Exploited Vulnerabilities catalog on June 4, 2026. The flaw enables local privilege escalation through memory corruption, allowing attackers to execute arbitrary code with elevated system access. Federal agencies are required to remediate by June 5, 2026.
Google released June 2026 Android security patches addressing 124 vulnerabilities, including one zero-day flaw actively exploited in targeted attacks.
Google Cloud Threat Intelligence (GTIG) published a report describing how attackers are using AI to accelerate vulnerability exploitation and gain initial access to cloud environments, including Google Cloud. GTIG identified the first known zero-day exploit believed to be AI-developed, targeting an open-source web administration tool and intended for a mass exploitation event before being disrupted. The report also documents abuse of exposed Google Cloud API keys to reach Gemini AI endpoints, and tracks a threat cluster designated TeamPCP (UNC6780) targeting AI software dependencies as an initial-access vector with follow-on ransomware activity. Google notes attackers are exploiting newly disclosed vulnerabilities within hours of publication and increasingly focus on APIs, SaaS, developer platforms, and AI services rather than credential theft. Recommended actions include tightening API key hygiene, monitoring AI service account usage, and shortening patch windows.