Google says 90 zero-days exploited in 2025 as commercial vendor activity grows

Google Threat Intelligence Group reported 90 zero-day vulnerabilities exploited in 2025, attributing 42 with many used by commercial surveillance vendors and state-sponsored groups; state actors preferentially targeted edge devices and security appliances while commercial vendors focused on mobile devices and browsers, and financially motivated groups also exploited several high-impact bugs.