CVE-2025-6558

Description

Insufficient validation of untrusted input in ANGLE and GPU in Google Chrome prior to 138.0.7204.157 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

Scoring

• CVSS: 8.8 (HIGH, 3.1)
• EPSS exploitation probability: Not yet available
• EPSS percentile: Not yet available

CISA KEV status

• Added to KEV: 2025-07-22
• Remediation due date: 2025-08-12
• Known ransomware campaign use: Unknown

Weakness types (CWE)

• CWE-20

References

• https://chromereleases.googleblog.com/2025/07/stable-channel-update-for-desktop_15.html
• https://issues.chromium.org/issues/427162086
• http://seclists.org/fulldisclosure/2025/Aug/0
• http://seclists.org/fulldisclosure/2025/Jul/30
• http://seclists.org/fulldisclosure/2025/Jul/32
• http://seclists.org/fulldisclosure/2025/Jul/35
• http://seclists.org/fulldisclosure/2025/Jul/37
• http://www.openwall.com/lists/oss-security/2025/08/02/1
• http://www.openwall.com/lists/oss-security/2026/09/30/18
• https://lists.debian.org/debian-lts-announce/2025/08/msg00015.html

More from Google

• CVE-2026-111497 — Brotli
• CVE-2026-58704 — Pixel
• CVE-2026-87491 — Chromium V8
• CVE-2026-85046 — Chromium V8
• CVE-2026-11645 — Chromium V8