# The (Un)Reliability of NVD Vulnerable Versions Data: an Empirical Experiment on Google Chrome Vulnerabilities

arXiv: https://arxiv.org/abs/1302.4133 · HTML: https://mlsanity.com/paper/1302.4133/

## Key facts

- Cited by 3 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 17 Feb 2013.

## Built on by (most cited first, 3 of 3)

- [Enhancing Vulnerability Reports with Automated and Augmented Description Summarization](https://mlsanity.com/paper/2504.20726/) (2025)
- [FixV2W: Correcting Invalid CVE-CWE Mappings with Knowledge Graph Embeddings](https://mlsanity.com/paper/2604.22176/) (2026)
- [TraceVIC: Causal Reasoning over Code Evolution for Identifying Vulnerability-Inducing Commits](https://mlsanity.com/paper/2609.26711/) (2026)

## Abstract (arXiv)

NVD is one of the most popular databases used by researchers to conduct empirical research on data sets of vulnerabilities. Our recent analysis on Chrome vulnerability data reported by NVD has revealed an abnormally phenomenon in the data where almost vulnerabilities were originated from the first versions. This inspires our experiment to validate the reliability of the NVD vulnerable version data. In this experiment, we verify for each version of Chrome that NVD claims vulnerable is actually vulnerable. The experiment revealed several errors in the vulnerability data of Chrome. Furthermore, we have also analyzed how these errors might impact the conclusions of an empirical study on foundational vulnerability. Our results show that different conclusions could be obtained due to the data errors.