cyber.hendryadrian.com
Security Report · bleepingcomputer.com

Google Tracked 90 Zero-Day Vulnerabilities Exploited in 2025

· Original article ↗

Summary

Google Threat Intelligence Group tracked 90 zero-day vulnerabilities exploited in 2025, up 15% from 2024. Nearly half targeted enterprise products; commercial spyware vendors surpassed state-sponsored groups, and GTIG expects exploitation to remain high in 2026.

Key points

  • GTIG tracked 90 zero-days exploited in 2025, a 15% increase from 2024; 47 targeted end-user platforms and 43 targeted enterprise products.
  • Memory safety issues accounted for 35% of the exploited vulnerabilities. Security appliances, networking infrastructure, VPNs, and virtualization platforms were among the most-targeted enterprise systems.
  • Microsoft was the most-targeted vendor, with 25 zero-days, followed by Google with 11 and Apple with eight.
  • For the first time in GTIG's tracking, commercial spyware vendors were the largest users of zero-days, surpassing state-sponsored espionage groups.
  • China-linked espionage groups exploited 10 zero-days, while financially motivated actors accounted for nine.
  • GTIG expects zero-day exploitation to remain high in 2026, citing the potential for AI tools to speed vulnerability discovery and exploit development.
  • Google recommends reducing attack surface and privilege exposure, monitoring for anomalous behavior, and maintaining rapid patching and incident-response processes.

Article Details

Publisher
Google Threat Intelligence Group
Report Period
2025
Scope
Zero-day vulnerabilities reported as actively exploited during 2025, including target categories, affected vendors, and threat-actor trends.
Sample Size
90 exploited zero-day vulnerabilities tracked by GTIG.
Key Statistics
  • GTIG tracked 90 exploited zero-days in 2025, a 15% increase from 78 in 2024; it tracked 100 in 2023.
  • Of the 90 zero-days, 47 targeted end-user platforms and 43 targeted enterprise products.
  • Memory-safety issues accounted for 35% of exploited zero-days.
  • GTIG counted 24 zero-days targeting desktop operating systems, 15 targeting mobile platforms, and eight targeting web browsers.
  • Microsoft was the most-targeted vendor with 25 zero-days, followed by Google (11), Apple (8), Cisco and Fortinet (4 each), and Ivanti and VMware (3 each).
Recommendations
  • Reduce attack surfaces and privilege exposure.
  • Continuously monitor systems for anomalous behavior.
  • Maintain rapid patching and incident-response processes.

Vendors

AppleMicrosoft was the top vendor targeted with zero days last year (25), followed by Google with 11, Apple with eight, and Cisco and Fortinet with four each, and Ivanti and VMware with three each.Ciscothe top vendor targeted with zero days last year (25), followed by Google with 11, Apple with eight, and Cisco and Fortinet with four each, and Ivanti and VMware with three each.Fortinettargeted with zero days last year (25), followed by Google with 11, Apple with eight, and Cisco and Fortinet with four each, and Ivanti and VMware with three each.GoogleGoogle Threat Intelligence Group tracked 90 zero-day vulnerabilities actively exploited in 2025, nearly half of which targeted enterprise software and appliances.Ivantilast year (25), followed by Google with 11, Apple with eight, and Cisco and Fortinet with four each, and Ivanti and VMware with three each.MicrosoftCommercial spyware vendors overtook state-sponsored groups in zero-day use, Microsoft was the most-targeted vendor, and the report highlights campaigns like Brickstorm while warning exploitation will likely remain highVMware(25), followed by Google with 11, Apple with eight, and Cisco and Fortinet with four each, and Ivanti and VMware with three each.

Related Articles