Google Confirms 90 Zero-Day Vulnerabilities Actively Exploited in 2025

The Google Threat Intelligence Group (GTIG) released its annual analysis, confirming that 90 zero-day vulnerabilities were actively exploited in the wild throughout 2025.

While this marks a slight decrease from the record 100 zero-days in 2023, it represents a noticeable increase from 2024’s total of 78.

According to Google’s researchers, attackers are shifting their focus away from browsers and heavily targeting enterprise infrastructure, mobile operating systems, and edge devices to achieve widespread network access.

Expanding Attack Surfaces

In a significant landscape shift, Commercial Surveillance Vendors (CSVs) overtook traditional state-sponsored espionage groups as the primary drivers of zero-day exploitation.

These vendors continue to develop complex exploit chains to bypass modern security boundaries on mobile devices.

Consequently, mobile zero-day discoveries rebounded to 15 in 2025, forcing attackers to chain multiple bugs together to achieve deep system access. Meanwhile, enterprise technologies accounted for 48% of all exploited zero-days.

Networking and security appliances remain highly vulnerable due to their privileged network positions and lack of built-in endpoint detection capabilities.

State-sponsored groups, specifically PRC-nexus operators like UNC3886 and UNC5221, consistently targeted these edge devices for long-term espionage.

Threat actors are also evolving their ultimate objectives. A 2025 malware campaign known as BRICKSTORM highlighted a new paradigm where state-sponsored attackers targeted technology companies to steal proprietary source code.

This stolen intellectual property accelerates the discovery of future zero-day vulnerabilities, creating a dangerous cycle of exploitation.

Furthermore, financially motivated actors matched previous records by exploiting nine zero-days, proving that advanced exploits are no longer strictly limited to espionage.

As attackers increasingly use AI to accelerate vulnerability discovery and exploit development, organizations must adopt layered defense mechanisms.

GTIG emphasizes that security teams should prepare for eventual compromise by implementing strict network segmentation and maintaining a real-time asset inventory.

A core defense strategy involves tracking a Software Bill of Materials (SBoM) to identify vulnerable components when new zero-days emerge rapidly.

The 2025 threat landscape demonstrates that as vendors secure basic software flaws, threat actors rapidly pivot to more complex, highly privileged enterprise environments.

Security teams must prioritize edge device monitoring, strict access controls, and rapid remediation to defend against these escalating campaigns.

Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.