CVE-2025-6558KEV · OVERDUECWE-20

Google Chromium ANGLE and GPU Improper Input Validation Vulnerability

High · published July 15, 2025

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 8.8. It is confirmed in active exploitation. It sits in the 95.9th percentile for exploit probability.

437
days past CISA
deadline
CVSS v3.1
8.8
EPSS
11%
Percentile
95.9
In the wild
Confirmed
What it is

🚨 A seemingly harmless HTML page could become an escape route for attackers! With CVE-2025-6558, researchers found a way to bypass Chrome's defenses—yikes! ⚡ Think of it like a sneaky fox that finds a hole in the fence to escape the farm. The HTML page acts as that crafty fox, slipping through the cracks of Chrome's sandbox and accessing areas it shouldn't! If exploited, this vulnerability could allow an attacker to break free from the browser's secure environment, potentially accessing sensitive data or executing harmful code. The consequences could be absolutely devastating, leading to complete compromise of the user’s system!

Put simply

Think of it like a sneaky fox that finds a hole in the fence to escape the farm. The HTML page acts as that crafty fox, slipping through the cracks of Chrome's sandbox and accessing areas it shouldn't! This issue arises from insufficient validation of untrusted input in ANGLE and GPU components in Google Chrome. An attacker can craft a malicious HTML page that manipulates how Chrome processes data, leading to a sandbox escape.

What to do

If exploited, this vulnerability could allow an attacker to break free from the browser's secure environment, potentially accessing sensitive data or executing harmful code. The consequences could be absolutely devastating, leading to complete compromise of the user’s system! Update Google Chrome immediately to version 138.0.7204.157 or later to close this security gap. Encourage users to review their extension permissions and be cautious about opening unfamiliar web pages. You've got this! Stay vigilant and update your browser to keep your digital fortress secure! 🛡️

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.10927 · 95.9th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2025-07-15T22:15Z
KEV added
2025-07-22 · due 2025-08-12
Affected products (10)
ProductVersionsFixed in
google/chrome< 138.0.7204.157138.0.7204.157
debian/debian_linuxall versions—
apple/safari< 18.618.6
apple/ipados< 18.618.6
apple/iphone_os< 18.618.6
apple/macos< 15.615.6
apple/visionos< 2.62.6
apple/watchos< 11.611.6
wpewebkit/wpe_webkit< 2.48.52.48.5
webkitgtk/webkitgtk< 2.48.52.48.5
References (11)
EPSS history
Timeline
  • 22 JUL 00:00Z
    Added to CISA KEV — remediate by Aug 12
    kev
  • 15 JUL 18:12Z
    Insufficient validation of untrusted input in ANGLE and GPU in Google Chrome prior to 138.0.7204.157 allowed a remote attacker to potentially perform a sandbox…
    cvelistv5