Definitions. High/Critical memory-safety = Google rated it High or Critical and the advisory title names a memory-safety bug (use after free, out of bounds, heap/stack buffer overflow, type confusion, integer overflow, uninitialized use, double free). It uses only the vendor's own labels, not PatchGap's AI tiers. Exploited in the wild = the advisory says an exploit exists in the wild, or CISA KEV lists the CVE. Middle half = 25th to 75th percentile. For third-party code (HarfBuzz, libexpat, …) the fix date is the upstream commit, which can be public long before Chrome rolls it in; those rows are marked "upstream fix". Method. 22 CVEs whose mapped commit is dated after the advisory (typically a later merge or backport) are excluded from medians. A further 36 are left out because their commit mapping is flagged as unverified, or because the only public commits citing the bug are measurement, test or documentation changes (their dates say nothing about when the code fix became public). Very long windows are where mapping errors concentrate, so check the linked commit before quoting an outlier. Data generated 2026-11-02.