Zero-Day Statistics: Browser Exploits Are Fading as Attackers Move to the Network Edge

These zero-day statistics come from a full analysis of Google Project Zero’s public “0day In the Wild” tracker: all 412 zero-days it has logged since July 2014. Microsoft accounts for 166, Google 80 and Apple 67. Browsers fell from 52% of tracked zero-days in 2020 to 21% in 2025, while Google’s own threat team says a record 48% of 2025 zero-days hit enterprise products.

Every tracked zero-day, by vendor

Source: Google Project Zero, “0day In the Wild” spreadsheet, all year tabs, retrieved October 2026. Categories assigned by The Uptime Report from the tracker’s Product field. Hover a dot for the CVE.

The strip chart makes the concentration plain. Microsoft, Google and Apple account for 313 of the 412 entries, or 76%. Windows alone has 106 (counting the tracker’s separate “Windows Kernel” rows), and Chrome has 62. The early years are dominated by Adobe Flash and Internet Explorer, with 23 Flash and 23 Internet Explorer zero-days. The last Flash entry is in 2018 and the last Internet Explorer entry in 2022. From 2021 onward, Android chipset and device makers (Samsung, Qualcomm and Arm) appear as rows of their own, with 14 entries in 2021 alone.

*2026 through September 29, 2026. Years are the tracker’s year tabs. Median days to patch uses only entries with a recorded discovery date; see the time to patch section.

Zero-days per year, by product category

Filled bars: Project Zero tracker entries per year tab. Dashed outlines: zero-days counted by Google Threat Intelligence Group (GTIG) in its annual reviews, latest revised figure. *2026 through September 29, 2026.

The tracker peaked at 69 zero-days in 2021, then logged 41, 56, 36 and 43 in the four years after. For 2026, it lists 24 patched from January 1 to September 29, 2026, compared with 37 in the same window of 2025. Because the sheet is maintained by hand, treat the 2026 figure as a floor.

The dashed outlines show the most important caveat in any set of zero-day statistics. Google Threat Intelligence Group (GTIG), whose annual review grew out of a joint report by Google’s Threat Analysis Group and Mandiant, counts more. Its latest figures are 106 for 2021, 63 for 2022, 100 for 2023, 78 for 2024 and 90 for 2025. The public tracker held 65% of Google’s count in 2021 but only 46% in 2024 and 48% in 2025. The tracker’s own notes explain why: it generally covers products Project Zero researches. It logged 15 enterprise, edge or security product zero-days in 2021 and 2022, then 5 of 103 entries since 2024 (3 SharePoint, 1 VMware ESXi, 1 Exchange), and no firewall, VPN or other edge appliance at all. The segment Google says is growing fastest is the one the public sheet no longer tracks.

*2026 is partial. GTIG counts: 106 (2021) and 63 (2022) from the 2023 and 2024 reviews; 100 (2023) and 78 (2024) as revised in the 2025 review (first reported as 97 and 75); 90 (2025).

Three tests: browsers, enterprise products and the network edge

We tested the three claims that come up most often about zero-day trends against three independent sources.

Browsers. In the tracker, browsers made up 40% of zero-days from 2019 to 2021 and 25% in 2024 and 2025. Google Threat Intelligence Group reports the same direction with its fuller data: 17 browser zero-days in 2023, 11 in 2024, and “less than 10%” of the 2025 total. The two sources classify some flaws differently (a Chrome sandbox escape that abuses Windows can be counted as browser or operating system), so the levels differ, but both show a decline.

Enterprise products. Google reported 36 enterprise zero-days in 2023 (37%), 36 in 2024 (46%, revised up from 33 and 44% in its first report), and 43 in 2025 (48%), both record highs. Security and networking products were 18, 20 and 21 of those. Google identified 14 of the 2025 zero-days as affecting edge devices and says that figure likely undercounts, because most edge devices cannot run endpoint detection tools.

The network edge in 2026. Google’s 2026 review is not out yet, so we used CISA’s Known Exploited Vulnerabilities (KEV) catalog for current-year signal. KEV is not a zero-day list: it includes flaws first exploited after a patch existed. To focus on newly disclosed flaws, we counted only KEV additions whose CVE ID year matches the year added. From January 1 to October 8, 2026, 169 such CVEs were added, against 110 in the same window of 2025. Edge, security and networking products were 54 of them (32%), up from 23 (21%). Enterprise products of all kinds made up 81%, and end-user platforms (browsers, operating systems and office apps) just 19%, down from 37%. Our full analysis of the CISA KEV catalog covers the catalog’s ransomware flags and vendor mix in more depth.

CISA KEV catalog version 2026-10-08. Same-year CVE: the year in the CVE ID equals the year the entry was added. Categories assigned by The Uptime Report from KEV vendor and product names. *2026 is year to date, matched to the same calendar window in every row.

How fast zero-days get patched

The tracker records a discovery date for 133 of 412 entries, all from 2015 to 2024 (no 2025 or 2026 entry has one), so we could measure the time from the vendor learning of an exploited flaw to a fix for about a third of the dataset. The median was 9 days, and 48% were fixed within a week. 13 took longer than 90 days.

Vendors with at least four zero-days that have both a discovery date and a patch date in the tracker. Red tick: vendor median.

Speed depends on who ships the fix. Google’s median was 4 days across 53 entries, 47 of them Chrome. Microsoft’s was 24 days across 25 entries. Microsoft’s zero-day fixes follow its monthly cycle: 151 of its 166 tracked zero-days (91%) were patched on a Patch Tuesday (the second Tuesday of the month). Our Patch Tuesday statistics track how many exploited Microsoft CVEs each release carries. The slowest group was Android chipset and device makers: Samsung, Qualcomm and Arm had a combined median of 81 days across 15 zero-days.

A second clock starts once a patch ships. 408 of the 412 tracked zero-days (99%) are in CISA’s KEV catalog. For the 204 patched since KEV launched in November 2021, the median gap from patch to KEV listing was 1 day, 86% were listed within a week, and 7 were listed before a patch was available. Each KEV entry carries a remediation due date for US federal agencies, which makes the catalog a ready-made patch priority list.

The 2026 zero-days so far

The 24 entries in the tracker’s 2026 tab, by patch date:

• CVE-2026-20805 Microsoft Windows 2026-01-13
• CVE-2026-21509 Microsoft Office 2026-01-26
• CVE-2026-21510 Microsoft Office 2026-02-10
• CVE-2026-21513 Microsoft Office 2026-02-10
• CVE-2026-21514 Microsoft Office 2026-02-10
• CVE-2026-21519 Microsoft Windows 2026-02-10
• CVE-2026-21533 Microsoft Windows 2026-02-10
• CVE-2026-20700 Apple iOS 2026-02-11
• CVE-2026-2441 Google Chrome 2026-02-13
• CVE-2026-21385 Qualcomm GPU 2026-03-02
• CVE-2026-3909 Google Chrome 2026-03-12
• CVE-2026-3910 Google Chrome 2026-03-12
• CVE-2026-5281 Google Chrome 2026-03-31
• CVE-2026-34621 Adobe Acrobat Reader 2026-04-12
• CVE-2026-32201 Microsoft SharePoint 2026-04-12
• CVE-2026-42897 Microsoft Exchange 2026-05-14
• CVE-2026-11645 Google Chrome 2026-06-08
• CVE-2026-56155 Microsoft Windows 2026-07-14
• CVE-2026-56164 Microsoft SharePoint 2026-07-14
• CVE-2026-68820 Microsoft Windows 2026-08-11
• CVE-2026-85046 Google Chrome 2026-09-03
• CVE-2026-87491 Google Chrome 2026-09-08
• CVE-2026-85880 Microsoft Windows 2026-09-09
• CVE-2026-86950 Apple iOS 2026-09-29

What this means for MSPs

Put internet-facing appliances on a days-not-weeks clock. Firewalls, VPN gateways, load balancers and email gateways supplied 32% of the 2026-numbered CVEs added to KEV this year, and Google says edge devices are hard to monitor once compromised. Keep a current inventory of every client appliance with a management interface or VPN portal, and track vendor advisories for those products directly rather than waiting for the monthly patch cycle.

Watch your own tools. Remote monitoring and remote support products appear in KEV too: 6 same-year entries for ConnectWise ScreenConnect, N-able N-central, SimpleHelp and BeyondTrust products were added from January 1 to October 8, 2026, after 3 in all of 2025. An exploited flaw in an RMM platform reaches every client it manages.

Keep the browser and OS basics. Browser zero-days are fewer, but Chrome still had 7 tracked entries in 2026, and Google fixed its tracked zero-days in a median of 4 days. Automatic browser updates with an enforced restart close that window. For Windows, the monthly cycle means an exploited flaw can stay open for weeks; exploited Patch Tuesday CVEs belong in the first deployment ring.

Treat Android patch level as a compliance setting. Chipset-level fixes took a median of 81 days to ship. Mobile device management policies that block devices more than one or two security patch levels behind are the practical control.

Not advice. This is an analysis of public vulnerability data, not a patching recommendation for any specific environment.

Frequently asked questions

How common are zero-day attacks?

Google Threat Intelligence Group counted 90 zero-days exploited in the wild in 2025, roughly one every four days, and between 63 and 106 a year since 2021. Project Zero’s public tracker, which covers a narrower set of products, lists 43 for 2025 and 412 since July 2014.

Which vendor has the most zero-days?

Microsoft, with 166 of the 412 zero-days in Project Zero’s tracker (40%), followed by Google with 80 and Apple with 67. Together the three account for 76%. Windows alone accounts for 106, and Chrome for 62.

How many zero-days have there been in 2026?

Project Zero’s tracker lists 24 zero-days patched from January 1 to September 29, 2026, against 37 in the same window of 2025. The tracker is updated by hand and can lag. In CISA’s catalog, 169 vulnerabilities with 2026 CVE IDs were added as known exploited by October 8, 2026, compared with 110 in the same period of 2025.

How long does it take to patch a zero-day?

For the 133 tracked zero-days with a recorded discovery date (2015 to 2024), the median time from discovery to patch was 9 days, and 48% were fixed within a week. Google’s median was 4 days and Microsoft’s 24. Android chipset and device makers (Samsung, Qualcomm, Arm) took a median of 81 days.

Are browser zero-days declining?

Yes. Browsers were 52% of Project Zero’s tracked zero-days in 2020 and 21% in 2025. Google Threat Intelligence Group counted 17 browser zero-days in 2023, 11 in 2024, and less than 10% of its 90 in 2025.

Are attackers targeting enterprise and edge devices more?

Yes. Google Threat Intelligence Group put enterprise products at 37% of zero-days in 2023, 46% in 2024 and a record 48% (43) in 2025. In CISA’s catalog, edge, security and networking products made up 32% of 2026-numbered CVEs added through October 8, up from 21% in the same window of 2025.

Methodology

References

1. Google Project Zero, “0day In the Wild” tracking spreadsheet. Accessed October 2026.
2. Google Project Zero, 0day “In the Wild” introduction. Accessed October 2026.
3. Google Threat Intelligence Group, “Look What You Made Us Patch: 2025 Zero-Days in Review”. Accessed October 2026.
4. Google Threat Intelligence Group, “Hello 0-Days, My Old Friend: A 2024 Zero-Day Exploitation Analysis”. Accessed October 2026.
5. Google TAG and Mandiant, “Trends on Zero-Days Exploited In-the-Wild in 2023”. Accessed October 2026.
6. CISA, Known Exploited Vulnerabilities Catalog (JSON feed). Accessed October 2026.