Back to the data Susceptible Components™

Attackers keep coming back to the same components.

41% of the 1,484 flaws exploited from 2021 to 2025 hit just 39 products. Each one was exploited in three or more separate years.

Scroll to meet one of them

Meet one of them.

This is V8, the JavaScript engine inside Chrome, Edge and most of the apps on your laptop. In 2016 its first flaw lands on CISA's list of exploited vulnerabilities.

A flaw. Fixed in days.

CVE-2016-1646, an out-of-bounds read. Google shipped the fix, you updated, the flaw was gone. Vulnerable, then not. End of story?

Then it happened again. 41 times.

Year 2016 · 1 exploited flaw so far

Each one struck the same component and stayed in its record. Every flaw got its patch. The component never changed.

Forty-one fire drills.

Every exploited flaw is an emergency: test the fix, push it to every laptop, confirm it took. In days, because attackers are already using it. In 2021 alone, nine of them: one every six weeks.

Each green dot is one patch that held. And the 42nd flaw is coming. It always has.

Same hole. New flaw.

Sort the 41 by kind. 20 are the same hole: type confusion, a memory-safety weakness in how the engine handles its objects. Each flaw was new. The hole was not.

Vulnerable is a flaw. Susceptible is a component.

One component. Everywhere.

V8 is not just Chrome. It runs inside Edge, Node.js and every desktop app built on Electron. A flaw in V8 is a flaw in all of them, on every laptop you own.

Three ways in. One door.

A link someone clicks. A poisoned package in a build. A page inside a desktop app. Three different attacks, and the same component on every path. That is a choke point: harden it once, and every path through it closes.

AI killed the grace period.

Finding a flaw took months of human effort. Now AI finds them in days, and attackers weaponise them at machine speed. Flaws land faster than you can fix them. Patching flaw by flaw, ranked by severity, falls behind.

To fight it, move at AI speed too: decide about the component before the next flaw lands.

Patch the flaw, or harden the component.

BeforePatch by flaw

41 patches in eleven years. Each one closed a flaw. The risk came back with the next one, every time.

20162026 risk

AfterHarden the component

Judge the component by what it keeps doing, and act on it once. Severity scores the flaw. Susceptibility scores the door.

one decisionevery path through it closes risk

It has company.

Five components. 142 exploited flaws between them. Tap one for its story.

    Susceptibility,
    not severity.

    Severity asks how bad this flaw is. Susceptibility asks what this component will do next. Ranking patches by severity cannot keep up with AI-speed attacks. Score the component, not the flaw.

    See how Reclaim applies itExplore the full data

    Tap anywhere to send an attack at it. The full data, the scoring method and the 2024 to 2025 test are one click away.