Google GTIG Tracked 90 Zero-Days in 2025 as Enterprise Exploitation Reached a Record Share

Mar 6, 2026 · Original article ↗

Summary

Google GTIG tracked 90 zero-days exploited in 2025; 43 (48%) affected enterprise technologies, a record share. OS and mobile exploitation rose, browser exploitation fell, and commercial surveillance vendors were attributed more zero-days than state groups.

Key points

GTIG tracked 90 vulnerabilities exploited as zero-days in 2025, within the 60–100 range seen in recent years. The dataset may change as past incidents are discovered; all included vulnerabilities have patches available.
Enterprise technologies accounted for 43 zero-days (48%), a record share. Security and networking products made up 21 of those cases.
Operating systems were the most exploited category, with 39 zero-days (44%); mobile exploitation rose to 15 from 9 in 2024, while browser exploitation fell below 10%.
For the first time in GTIG’s tracking, commercial surveillance vendors were attributed more zero-days than traditional state-sponsored espionage groups. PRC-nexus groups remained the most prolific state actors, with at least 10 attributed zero-days and a focus on edge and networking devices.
GTIG described a SonicWall SMA 1000 exploit chain combining authentication bypass, remote code execution, and a zero-day privilege-escalation flaw. It also analyzed Samsung DNG image exploits, while noting it had not confirmed zero-day exploitation of CVE-2025-21042.
GTIG said BRICKSTORM-linked intrusions targeting technology companies may have sought intellectual property that could support future zero-day development; this is presented as a possibility, not a confirmed outcome.
GTIG forecast that AI could accelerate vulnerability discovery and exploit development, and recommended asset inventory, segmentation, timely patching, monitoring, and response planning.

Article Details

Publisher: Google Threat Intelligence Group (GTIG)
Report Period: 2025 (data cutoff: 2025-12-31)
Scope: GTIG analysis of zero-day vulnerabilities exploited in the wild and disclosed in 2025, based on original research and open-source reporting. GTIG notes the dataset may not include all exploitation and could be revised.
Sample Size: 90 zero-day vulnerabilities tracked by GTIG; the report says all included vulnerabilities had patches available.
Key Statistics: GTIG tracked 90 zero-day vulnerabilities exploited in the wild in 2025, compared with 78 in 2024 and 100 in 2023.
43 zero-days (48%) affected enterprise software and appliances, up from 36 (46%) in 2024.
Operating systems accounted for 39 zero-days (44%) in 2025.
Mobile OS exploitation accounted for 15 zero-days in 2025, compared with 9 in 2024.
GTIG attributed nine zero-days to likely or confirmed financially motivated threat groups in 2025.
Recommendations: Segment DMZs, firewalls, and VPNs from critical assets, including core networks and domain controllers.
Maintain a real-time asset inventory and a Software Bill of Materials to locate affected systems and libraries.
Apply patches promptly; when a patch is unavailable, isolate affected systems or use stop-gap measures such as disabling services or blocking ports.
Monitor application execution flow, establish baselines for system processes, and flag anomalous kernel-level behavior.
For personal devices, enable Android Advanced Protection Mode or iOS Lockdown Mode and avoid links or attachments from unknown contacts.