Cyber: Google Says 90 Zero-days Were Exploited In Attacks Last Year
Google Threat Intelligence Group (GTIG) tracked 90 zero-day vulnerabilities actively exploited throughout 2025, almost half of them in enterprise software and appliances.
The figure is a 15% increase compared to 2024, when 78 zero-days were exploited in the wild, but lower than the record 100 zero days tracked in 2023.
Zero-day vulnerabilities are security issues in software products that attackers exploit, usually before the vendor learns about them and develops a patch. They are highly valued by threat actors because they often enable initial access, remote code execution, or privilege escalation.
A report from GTIG today notes that of the 90 zero-days tracked as exploited in 2025, 47 of them targeted end-user platforms, and 43 targeted enterprise products.
The type of exploited flaws includes remote code execution, privilege escalation, injection and deserialization flaws, authorization bypasses, and memory corruption (use-after-free) bugs. Google reports that memory safety issues accounted for 35% of all exploited zero-day vulnerabilities last year.
The most targeted enterprise systems were security appliances, networking infrastructure, VPNs, and virtualization platforms, as these provide privileged network access and often lack EDR monitoring.
GTIG reports that bugs in operating systems were the most exploited category last year, with attacks leveraging 24 zero-day vulnerabilities in desktop OSs and 15 in mobile platforms.
Zero-day exploits in web browsers dropped to eight, a sharp decline compared to previous years.
Google’s analysts speculate this might be due to increased security hardening in this software category, though it may also be a case of threat actors using more advanced evasion tactics and being better at hiding malicious activity.
According to GTIG researchers, Microsoft was the top vendor targeted with zero days last year (25), followed by Google with 11, Apple with eight, and Cisco and Fortinet with four each, and Ivanti and VMware with three each.
Source: BleepingComputer
