Being exploited right now.
CVEs that CISA lists as exploited in real attacks, newest additions first.
-
CVE-2026-125350
Use after free in XML in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
These CVEs appear in CISA's Known Exploited Vulnerabilities (KEV) catalog, which means attackers are using them in real attacks. Each entry shows severity, exploit odds, fix status and a timeline.