Google patched CVE-2026-85046, an actively exploited zero-day type confusion vulnerability in Chrome's V8 JavaScript engine. The flaw allows remote code execution via crafted HTML pages and has been exploited in the wild. Google released Chrome 152.0.7977.82/.83 (Windows/macOS) and 152.0.7977.82 (Linux) to address this and 11 other vulnerabilities. This is the sixth Chrome zero-day Google fixed in 2026.
CVE-2025-0982: Sandbox escape vulnerability in Google Cloud Application Integration allows arbitrary command execution within Google's Borg infrastructure. Vulnerability enabled complete escape from the Rhino JavaScript execution environment and execution of arbitrary commands on internal production systems. Google mitigated the issue within 48 hours of disclosure (Mar 30, 2026), deprecated Rhino entirely, and migrated JavaScript tasks to the V8 engine. Security bulletin GCP-2026-044 published June 25, 2026. Researcher awarded $75,000 bounty through Google's Vulnerability Reward Program.
CVE-2026-12710: Missing Authorization vulnerability in Google Cloud Application Integration QueryEngineTask allows external attackers to access sensitive internal data without authentication. CVSS 9.3 (critical). Affected versions from 2025-04-28 to 2026-04-04. Google patched the vulnerability server-side on April 4, 2026; no customer action required.
APT36 suspected in PATCHCORD espionage campaign targeting Afghan telecom and South Asian infrastructure. Attackers deliver PATCHCORD backdoor via fake VPN installers and abuse Google Sheets (via SHEETCORD implant) for command-and-control communication. Persistence achieved through browser shortcut hijacking.
Palo Alto Networks Unit 42 disclosed three attack techniques (Pass-ta-key, Silver Pass-ta-key, Golden Pass-ta-key) that enable malware on a compromised Windows device to hijack Google passkey-protected accounts without requiring device unlock, user interaction, or privilege escalation. The attacks exploit weaknesses in Google's cloud authenticator and device re-enrollment workflows, potentially allowing extraction of all synced passkey private keys. Unit 42 recommends enforcing strict user verification policies and strengthening recovery workflows.
Google Cloud Looker released version 26.12 to patch CVE-2026-15810, a cross-site scripting vulnerability allowing attackers to hijack administrator accounts through malicious URLs. Cloud-hosted instances were automatically remediated; self-hosted operators must apply patches to supported release branches. The release also enforces multi-factor authentication by default for email/password authentication.
GhostCommit, disclosed July 13, 2026, is a prompt-injection technique that hides malicious instructions within images embedded in pull requests to evade text-based AI code reviewers. Affecting tools including Google Antigravity, Cursor, and CodeRabbit, the attack can trick multimodal AI agents into leaking repository secrets such as .env files. Researchers demonstrated the flaw by embedding instructions in PNG files that text-based reviewers skip, allowing malicious agents to encode and exfiltrate credentials as obfuscated numeric values that bypass standard secret scanners.
GhostApproval, a vulnerability pattern disclosed July 9, 2026, affects Google Antigravity and other AI coding assistants. It exploits symlink following combined with UI misrepresentation to bypass file operation confirmations, enabling arbitrary file writes and remote code execution. Google has implemented fixes and is evaluating formal CVE assignment.
Rogue Agent, a critical vulnerability in GCP Dialogflow CX disclosed by Varonis Threat Labs, allows attackers to inject persistent malicious code via Playbook Code Blocks. The flaw requires only dialogflow.playbooks.update permission and enables conversation exfiltration, phishing attacks, and credential theft. Code Block logic executed in a shared Cloud Run environment, permitting cross-agent compromise. Google received disclosure in November 2025, deployed an initial fix in April 2026, and fully resolved the issue by June 2026 with no confirmed prior exploitation.
Januscape (CVE-2026-53359), a 16-year-old use-after-free vulnerability in KVM's shadow MMU, enables guest-to-host escape on systems with nested virtualization enabled. Discovered by researcher Hyunwoo Kim via Google's kvmCTF bug bounty program, the flaw allows root access on the host machine. The vulnerability affects both Intel and AMD processors and has been present since kernel 2.6.36 (August 2010). Patches are available; organizations should update immediately or disable nested virtualization if patching is delayed.
CVE-2026-2031 is a critical remote code execution vulnerability in Google Cloud Application Integration that combines multiple flaws: exposed internal APIs returning protobuf descriptors, IDOR weaknesses, and an unauthenticated workflow execution endpoint. An attacker could exploit these to execute arbitrary Stubby RPC calls in Google Cloud production with the privileged service identity of the integration platform. Google has patched the vulnerability; the researcher earned $148,337 through Google's Vulnerability Reward Program.
A critical vulnerability in Google Cloud Vertex AI's Python SDK (google-cloud-aiplatform) dubbed 'Pickle in the Middle' enables attackers to hijack machine learning model uploads and achieve cross-tenant remote code execution. The flaw combines predictable bucket naming, bucket squatting, and unsafe deserialization to allow attackers to poison ML artifacts before deployment. Exploitation leads to service account token theft and access to sensitive cloud resources. Google patched the issue in SDK versions 1.144.0 and 1.148.0; users should upgrade immediately and specify explicit staging buckets.
Threat actors are increasingly exploiting Google Cloud Logging and AWS CloudTrail to evade detection and maintain unauthorized visibility into victim environments. Attack techniques include disabling logging, deleting logs, modifying encryption keys to render logs unreadable, log poisoning through S3/Cloud Storage permissions, and redirecting logs to attacker-controlled destinations. While organizations often assume logs are protected, these logging services lack uniform protection enforcement, enabling attackers to blind security monitoring and enable long-term reconnaissance. Defenders are advised to enforce strict access controls on logging APIs, enable log integrity validation and bucket locking, and implement continuous monitoring of logging configuration changes.
Google Chrome versions prior to 149.0.7827.53 on Windows contain CVE-2026-11005, an out-of-bounds read vulnerability in the ANGLE graphics library. The flaw requires prior renderer process compromise but allows attackers to leak sensitive data such as cryptographic keys, authentication tokens, and credentials from adjacent memory regions. Exploitation occurs via crafted HTML pages and affects all vulnerable Windows Chrome installations.
Google released emergency patches on June 9, 2026 for CVE-2026-11645, an out-of-bounds memory access vulnerability in Chrome's V8 JavaScript engine that is actively being exploited in the wild. The flaw enables remote attackers to execute arbitrary code via crafted HTML pages, exposing sensitive data or triggering crashes. This is the fifth exploited Chrome zero-day of 2026.
CISA added CVE-2025-48595, an actively exploited Android Framework integer overflow vulnerability, to its Known Exploited Vulnerabilities catalog on June 4, 2026. The flaw enables local privilege escalation through memory corruption, allowing attackers to execute arbitrary code with elevated system access. Federal agencies are required to remediate by June 5, 2026.
Google released June 2026 Android security patches addressing 124 vulnerabilities, including one zero-day flaw actively exploited in targeted attacks.
Google Cloud Threat Intelligence (GTIG) published a report describing how attackers are using AI to accelerate vulnerability exploitation and gain initial access to cloud environments, including Google Cloud. GTIG identified the first known zero-day exploit believed to be AI-developed, targeting an open-source web administration tool and intended for a mass exploitation event before being disrupted. The report also documents abuse of exposed Google Cloud API keys to reach Gemini AI endpoints, and tracks a threat cluster designated TeamPCP (UNC6780) targeting AI software dependencies as an initial-access vector with follow-on ransomware activity. Google notes attackers are exploiting newly disclosed vulnerabilities within hours of publication and increasingly focus on APIs, SaaS, developer platforms, and AI services rather than credential theft. Recommended actions include tightening API key hygiene, monitoring AI service account usage, and shortening patch windows.