Qubes OS has a public CVE list now and it is shorter than you think
Fifteen years of a compartmentalised desktop OS, zero remote code execution bugs. The paper tracking every public Qubes vulnerability is out.
A new arXiv paper catalogues every publicly disclosed security issue in Qubes OS since its first release in 2010. The count is eighteen CVEs total. Zero remote code execution vulnerabilities. Zero privilege escalations from a VM to dom0 that did not require local physical access. Qubes isolates every application in its own Xen virtual machine. Your browser runs in one VM, your email client in another, your work documents in a third. Compromising Firefox does not hand an attacker your GPG keys. The architecture forces lateral movement through multiple hypervisor boundaries, which attackers have not crossed in the wild. The paper notes that most of the eighteen issues were GUI bugs or logic errors in Qubes-specific tooling, not Xen hypervisor escapes. One bug let a malicious VM confuse the window manager into drawing fake prompts. Another let a VM exhaust dom0 memory by spamming GUI events. Annoying, patchable, not catastrophic. What stands out is the absence of supply chain compromises. Qubes signs every update with offline keys. The build process is reproducible. If an attacker poisons an upstream package, they still cannot push it to users without stealing the signing key, which lives on an air-gapped machine. The project has been doing deterministic builds since before it was trendy. The downside is hardware compatibility. Qubes needs a machine with VT-d or equivalent IOMMU support to isolate devices. It is fussy about WiFi chipsets. It does not run on most laptops out of the box. The security model assumes you can afford to be picky about hardware, which is true if you are a journalist in a hostile jurisdiction and false if you are not. The paper is a rare public accounting of what a decade and a half of paranoid architecture buys you. Eighteen bugs. No breaches. No one is selling Qubes exploits on the grey market because the return on investment is terrible compared to Windows or macOS.