ABCDEFGHIJKLMNOPQRSTUVWXYZ
1
0day "In the Wild"
2
Last updated: 2023-04-20
3
4
This spreadsheet is used to track cases of zero-day exploits that were detected "in the wild". This means the
vulnerability was detected in real attacks against users as a zero-day vulnerability (i.e. not known to the
public or the vendor at the time of detection). This data is collected from a range of public sources. We include
relevant links to third-party analysis and attribution, but we do this only for your information; their inclusion does
not mean we endorse or validate the content there.
5
6
An introduction to this spreadsheet is available on the Project Zero blog:
7
https://googleprojectzero.blogspot.com/p/0day.html
8
9
Some additional notes on how the data is processed:
10
 - Scope for inclusion: there are some 0day exploits (such as CVE-2017-12824) in areas that aren't active
research targets for Project Zero. Generally this list includes targets that Project Zero has previously
investigated (i.e. there are bug reports in our issue tracker) or will investigate in the near future.
11
 - Security supported: this list does not include exploits for software that is explicitly EOL at the time of
discovery (such as the ExplodingCan exploit for IIS on Windows Server 2003, surfaced in 2017).
12
 - Post-disclosure: this list does not include CVEs that were opportunistically exploited by attackers in the gap
between public disclosure (or "full disclosure") and a patch becoming available to users (such as
CVE-2015-0072, CVE-2018-8414 or CVE-2018-8440).
13
 - Reasonable inference: this list includes exploits that were not discovered in an active breach, but were
leaked or discovered in a form that suggests with high confidence that they were probably used "in the wild"
at some point (e.g. Equation Group and Hacking Team leaks).
14
 - Date resolution: we only set the date of discovery when the reporter specifies one. If a discovery is
indicated as being made in "late April" or "early March", we record that as if no date was provided.
15
 - Time range: data collection starts from the day we announced Project Zero -- July 15, 2014.
16
17
For additions, corrections, questions, or comments, please contact [email protected]
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100