Facts
- Country
- United StatesSource: Wikidata
- Founded
- 1998Source: Wikidata
- Sector
- Internet, Information technologySource: Wikidata
- Official website
- about.googleSource: Wikidata
Vulnerabilities
87 CVEs in our records, 1 known exploited (on CISA's KEV list).
- CVE-2026-111497 Exploited added to KEV 27 Oct
Products we track
Security timeline
- Malware reported by Security AffairsYoba malware hides a crypto miner behind fake ChatGPT and Claude desktop apps
- Malware reported by Malwarebytes Labs319 Chrome extensions with 13.4 million installs hijacked users' search settings and routed queries via operator servers
- Security update reported by Chrome ReleasesGoogle updates Chrome Dev channel to version 159.0.8130.0 on Windows, Mac and Linux
- Vulnerability reported by Cyber Security NewsZero-click 'SMS of Death' flaw lets one malformed text crash Android phone service
- Vulnerability reported by CSO OnlineCritical Brotli decoder flaw CVE-2026-111497 (Broccoli2Shell) exploited, added to CISA KEV
- Security update reported by Chrome ReleasesGoogle releases Chrome 156 stable security update fixing 52 flaws, including critical bugs
- Vulnerability reported by Qualys Threat ResearchCISA adds Brotli and Adobe Commerce PolyShell flaws to Known Exploited Vulnerabilities catalogue
Recent news · 13 stories
Google offers $250,000 bug bounty reward for root-in-cloud research
Google has introduced a bug bounty reward of $250,000 for root-in-cloud findings. The top payout is aimed at high-impact architectural research that demonstrates full administrative control.
Vendor article argues penetration testing firms should run AI in-house to protect client data
The article, published as promotional content for PentestPad, says penetration testing firms face pressure to adopt AI and that staff often use it without approval. It argues that uploading client scope documents, vulnerabilities and credentials to cloud AI providers risks breaching confidentiality and compliance obligations, and recommends self-hosted models. PentestPad is presented as a reporting platform that can run on self-hosted or air-gapped infrastructure and exposes its data to agents through MCP.
Torvalds says Linux 7.4 merge window is large, welcomes AI-driven fixes as healthier
The first release candidate for Linux kernel 7.4 is out, with almost 20,000 commits in the merge window against a usual figure of around 15,000. Torvalds says many fixes are for issues found by AI, and that AI-suggested patches are increasingly appearing, though they are often rewritten. Notable additions include improved support for AMD, Apple and Google processors and some virtual machine security tweaks.
Google's 2010 Pac-Man doodle unexpectedly auto-played in Firefox via an extension
Google's 2010 Pac-Man doodle was set to start automatically after ten seconds of inactivity on google.com. The CoolPreviews Firefox extension opened the homepage invisibly when Firefox launched, which triggered unexpected game audio. The developer, Marcin Wichary, pushed a same-day patch adding a mute button and requiring a click before the game and its sounds could start.
Google unveils Gemini 4 Carbon AI model with advanced cybersecurity capabilities
Google has unveiled Gemini 4 Carbon, which it says performs strongly on vulnerability discovery (88.2% on SEC-bench Pro), exploitation (54.8% on ExploitGym) and patching (71.0% on CWE-bench). Access will start with vetted defenders through the Fairwind Program, with no firm date for general availability, and the benchmarks were run without guardrails.
Yoba malware hides a crypto miner behind fake ChatGPT and Claude desktop apps
Check Point Research tracks a campaign called Yoba that uses fake GitHub projects posing as OpenAI and Anthropic desktop apps, delivered via SEO poisoning. Each ZIP pairs a signed Setup.exe with a malicious winmm.dll for DLL sideloading, which installs a multi-stage loader that fetches payloads via Telegram, DNS-over-HTTPS and Catbox, and ends with an XMRig miner routed through Tor.
Google urges users to run a Security Checkup to review Gmail inbox access
Google's Safety and Security blog promotes its Security Checkup tool, which lets users review who has access to their Gmail inbox in around two minutes. The post frames it as a three-step process to protect email accounts. The article provides no details on specific threats or vulnerabilities.
319 Chrome extensions with 13.4 million installs hijacked users' search settings and routed queries via operator servers
Socket researcher John Tuckner identified 319 Chrome extensions, with an estimated 13.4 million installs over a decade, that hijacked default search settings and proxied queries through operator-controlled servers before forwarding them to Yahoo or Bing. The operators could read queries, which were often tied to a unique identifier, and earned referral payments. The extensions were promoted through ads on networks including Google Ads and were listed in the official store, mostly as unlisted entries reachable only by direct link.
Google updates Chrome Dev channel to version 159.0.8130.0 on Windows, Mac and Linux
The Chrome Dev channel has been updated to 159.0.8130.0 for Windows, Mac and Linux. The notice points to the Git log for a partial list of changes and invites users to file bugs for any new issues. It mentions no security fixes or vulnerabilities.
Zero-click 'SMS of Death' flaw lets one malformed text crash Android phone service
A zero-click Android flaw dubbed 'SMS of Death' lets an attacker crash the com.android.phone process with one malformed WAP Push message, dropping active calls and causing one to two seconds without service per message. Around 30 messages in quick succession can corrupt the SMS SQLite database, leaving the phone app crashing on every boot, and carrier retries of unacknowledged messages can re-trigger the problem after a factory reset. Google has marked the report 'Won't Fix' as a non-security issue, according to the researcher's disclosure site.