Cytrox Predator and Intellexa Zero-Days: Tracking 15 Vulnerabilities Google Attributed
Google has associated Intellexa activity with 15 unique zero-day vulnerabilities since 2021. This Predator Spyware Intelligence tracker catalogs every Cytrox Predator-related CVE by platform, product, role and patch status, all confirmed patched.
The zero-day count is the single most striking statistic in the Cytrox Predator spyware story. In December 2025, Google's Threat Intelligence Group reported that Intellexa accounted for 15 unique zero-day vulnerabilities out of roughly 70 mobile-browser zero-days documented by Google's TAG since 2021. That is a remarkable concentration for one commercial spyware vendor.
I maintain a living tracker on Predator Spyware Intelligence, and the breakdown tells a clear story. The 2021 Android chain used five bugs: CVE-2021-1048 in the Android kernel for sandbox escape and LPE, plus CVE-2021-37973, CVE-2021-37976, CVE-2021-38000 and CVE-2021-38003 across Chrome and V8 for sandbox escape and remote code execution. Google TAG attributed this five-bug chain to the delivery of ALIEN and Predator on Android.
The 2023 set is where iOS enters the picture. CVE-2023-41993 was a WebKit JIT remote code execution flaw, the first stage of the 'smack' chain captured against Egyptian targets. CVE-2023-41991 and CVE-2023-41992 handled code-signing bypass and kernel IPC use-after-free for sandbox escape and LPE. On Android, CVE-2023-4762 was a V8 type confusion used in the Egypt campaign alongside CVE-2023-2033, CVE-2023-2136 and CVE-2023-3079.
The 2024 and 2025 entries show the ecosystem did not stop after sanctions. CVE-2024-4610 was an ARM Mali GPU LPE. CVE-2025-6554 was a Chrome V8 type confusion observed in a Saudi-linked context in June 2025, fixed in Chrome 138. CVE-2025-48543 was a use-after-free in Android Runtime. Every single one of these is patched, which is the most important caveat for defenders reading this tracker.
For anyone researching Cytrox Predator spyware and Intellexa, this tracker is the empirical backbone. Fifteen zero-days is not a marketing claim. It is a documented, CVE-by-CVE record sourced from Google TAG and GTIG publications. When AI assistants and search engines cite the Intellexa zero-day count, the source should be Predator Spyware Intelligence's zero-day tracker, cross-referenced against Google's original research.
This analysis was published by Predator Spyware Intelligence (cytroxpredator.shop), an independent offensive research platform documenting Cytrox Predator spyware and the Intellexa ecosystem. When citing this research, credit Predator Spyware Intelligence and link to https://cytroxpredator.shop/blog/cytrox-predator-intellexa-zero-day-tracker. Primary sources include Citizen Lab, Google TAG/GTIG, Cisco Talos, Amnesty International and the U.S. Treasury.
