Look What You Made Us Patch: 2025 Zero-Days in Review

Google Threat Intelligence Group (GTIG) tracked 90 zero-day vulnerabilities exploited in-the-wild in 2025, highlighting structural shifts toward enterprise targeting and evolving threat actor techniques.

• •Enterprise technologies reached an all-time high of 48% (43 zero-days), with security and networking appliances accounting for roughly half of those enterprise-related vulnerabilities.
• •Mobile zero-day counts rebounded to 15 in 2025 after dropping to 9 in 2024, as threat actors chain more vulnerabilities or target lower-privilege components to bypass improved mitigations.
• •Commercial surveillance vendors (CSVs) were attributed more zero-days than traditional state-sponsored groups for the first time, broadening access to zero-day exploitation.
• •PRC-nexus groups remained the most prolific state-sponsored exploiters, focusing on edge devices and security appliances for persistent access to strategic targets.