Chrome 2025 in-the-wild zero-days
CVE-2025-2783 (Mojo sandbox escape, Mar 2025, Operation ForumTroll; KEV 27 Mar)
- Disclosed
What happened
- CVE-2025-4664, CVE-2025-5419, CVE-2025-6554 (KEV 2 Jul), CVE-2025-6558, CVE-2025-10585, CVE-2025-13223
Live scores
Live scores
CVE-2025-2783- EPSS
- 0.092
some chance of attack soon - VEDAS
- 0.982
strong exploit evidence - On CISA KEV
- Yes, since 2025-03-27
- Detection rule
- None yet
Thin horizontal line: the “likely” (EPSS 0.10) or “strong” (VEDAS 0.90) threshold. Shaded “no data” areas are periods when cve-scores did not publish.
Live scores
CVE-2025-4664- EPSS
- 0.054
some chance of attack soon - VEDAS
- 0.975
strong exploit evidence - On CISA KEV
- Not listed
- Detection rule
- None yet
Live scores
CVE-2025-5419- EPSS
- 0.075
some chance of attack soon - VEDAS
- 0.975
strong exploit evidence - On CISA KEV
- Yes, since 2025-06-05
- Detection rule
- None yet
Thin horizontal line: the “likely” (EPSS 0.10) or “strong” (VEDAS 0.90) threshold. Shaded “no data” areas are periods when cve-scores did not publish.
Live scores
CVE-2025-6554- EPSS
- 0.141
likely to be attacked soon - VEDAS
- 0.982
strong exploit evidence - On CISA KEV
- Yes, since 2025-07-02
- Detection rule
- None yet
Thin horizontal line: the “likely” (EPSS 0.10) or “strong” (VEDAS 0.90) threshold. Shaded “no data” areas are periods when cve-scores did not publish.
Live scores
CVE-2025-6558- EPSS
- 0.109
likely to be attacked soon - VEDAS
- 0.975
strong exploit evidence - On CISA KEV
- Yes, since 2025-07-22
- Detection rule
- None yet
Thin horizontal line: the “likely” (EPSS 0.10) or “strong” (VEDAS 0.90) threshold. Shaded “no data” areas are periods when cve-scores did not publish. The vertical line is the day CISA added it to its exploited list.
Live scores
CVE-2025-10585- EPSS
- 0.090
some chance of attack soon - VEDAS
- 0.981
strong exploit evidence - On CISA KEV
- Yes, since 2025-09-23
- Detection rule
- None yet
Thin horizontal line: the “likely” (EPSS 0.10) or “strong” (VEDAS 0.90) threshold. Shaded “no data” areas are periods when cve-scores did not publish. The vertical line is the day CISA added it to its exploited list.
Sources
This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.