MEIFP – Most Exploited Internet-Facing Products

Google

Products: Android · AngularJS · Chrome · ChromeOS · Web Designer App · https://github.com/google/nftables · libvpx · libwebp

26.0

Score

CVEs

Active

PoC

KEV

#104

Rank

Period:

Product:

CVE ID	Published	CVSS	Exploit	KEV	AC	PR	Auto	Score(hover)	Affected Products	Description
CVE-2025-2336	2025-06-04	4.8v3.1	POC	—	High	None	no	0.0	AngularJS	Improper sanitization of the value of the 'href' and 'xlink:href' attributes in '<image>' SVG elements in AngularJS's 'ngSanitize' module allows attackers to bypass common image source restrictions. This can lead to a form of Content Spoofing https://owasp.org/www-community/attacks/Content_Spoofing
CVE-2025-0716	2025-04-29	4.8v3.1	POC	—	High	None	no	0.0	AngularJS	Improper sanitization of the value of the 'href' and 'xlink:href' attributes in '<image>' SVG elements in AngularJS allows attackers to bypass common image source restrictions. This can lead to a form of Content Spoofing https://owasp.org/www-community/attacks/Content_Spoofing and also negatively
CVE-2025-1566	2025-04-16	7.5v3.1	POC	—	Low	None	YES	0.0	ChromeOS	DNS Leak in Native System VPN in Google ChromeOS Dev Channel on ChromeOS 16002.23.0 allows network observers to expose plaintext DNS queries via failure to properly tunnel DNS traffic during VPN state transitions.
CVE-2024-8372	2024-09-09	4.8v3.1	POC	—	High	None	no	0.0	AngularJS	Improper sanitization of the value of the 'srcset' attribute in AngularJS allows attackers to bypass common image source restrictions, which can also lead to a form of Content Spoofing https://owasp.org/www-community/attacks/Content_Spoofing . This issue affects AngularJS versions 1.3.0-rc.4 and g
CVE-2024-8373	2024-09-09	4.8v3.1	POC	—	High	None	no	0.0	AngularJS	Improper sanitization of the value of the [srcset] attribute in <source> HTML elements in AngularJS allows attackers to bypass common image source restrictions, which can also lead to a form of Content Spoofing https://owasp.org/www-community/attacks/Content_Spoofing . This issue affects all versi
CVE-2024-6284	2024-07-03	6.3v4.0	POC	—	High	None	no	0.0	https://github.com/google/nftables	In https://github.com/google/nftables IP addresses were encoded in the wrong byte order, resulting in an nftables configuration which does not work as intended (might block or not block the desired addresses). This issue affects: https://pkg.go.dev/github.com/google/nftables@v0.1.0 The bug was
CVE-2024-32896	2024-06-13	8.1v3.1	ACTIVE		High	None	no	26.0	Android	there is a possible way to bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.

Each CVE: 10 pts base (Active only), boosted by:

KEV×2.0AC: Low×1.2PR: None×1.3PR: Low×1.1Auto×1.3