CVE-2025-6558

Summary

CVE	CVE-2025-6558
State	PUBLISHED
Assigner	Chrome
Source Priority	CVE Program / NVD first with legacy fallback
Published	2025-07-15 18:15:24 UTC
Updated	2026-10-01 12:00:53 UTC
Description	Insufficient validation of untrusted input in ANGLE and GPU in Google Chrome prior to 138.0.7204.157 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

Primary CVSS: v3.1 8.8 HIGH from ADP

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS: 0.095850000 probability, percentile 0.953320000 (date 2026-10-01)

CISA KEV: Listed on 2025-07-22; due 2025-08-12; ransomware use Unknown

Problem Types: CWE-20 | CWE-20 Insufficient validation of untrusted input

Version	Source	Type	Score	Severity	Vector
3.1	ADP	DECLARED	8.8	HIGH	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H`
3.1	134c704f-9b21-4f2e-91b3-4a467353bcc0	Secondary	8.8	HIGH	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H`

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Vendor	Google
Product	Chromium
Name	Google Chromium ANGLE and GPU Improper Input Validation Vulnerability
Required Action	Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Notes	https://chromereleases.googleblog.com/2025/07/stable-channel-update-for-desktop_15.html ; https://nvd.nist.gov/vuln/detail/CVE-2025-6558

Type	Vendor	Product	Version	Update	Edition	Language
Operating System	Apple	Ipados	All	All	All	All
Operating System	Apple	Iphone Os	All	All	All	All
Operating System	Apple	Macos	All	All	All	All
Application	Apple	Safari	All	All	All	All
Operating System	Apple	Visionos	All	All	All	All
Operating System	Apple	Watchos	All	All	All	All
Operating System	Debian	Debian Linux	11.0	All	All	All
Application	Google	Chrome	All	All	All	All
Application	Webkitgtk	Webkitgtk	All	All	All	All
Application	Wpewebkit	Wpe Webkit	All	All	All	All

Source	Vendor	Product	Version	Platforms
CNA	Google	Chrome	affected 138.0.7204.157 138.0.7204.157 custom	Not specified

Reference	Source	Link	Tags
seclists.org/fulldisclosure/2025/Jul/32	af854a3a-2127-422b-91ae-364da2661108	seclists.org	Third Party Advisory
issues.chromium.org/issues/427162086	[email protected]	issues.chromium.org	Issue Tracking, Permissions Required
www.openwall.com/lists/oss-security/2026/09/30/18	af854a3a-2127-422b-91ae-364da2661108	www.openwall.com	Mailing List
lists.debian.org/debian-lts-announce/2025/08/msg00015.html	af854a3a-2127-422b-91ae-364da2661108	lists.debian.org	Mailing List, Third Party Advisory
seclists.org/fulldisclosure/2025/Jul/37	af854a3a-2127-422b-91ae-364da2661108	seclists.org	Third Party Advisory
seclists.org/fulldisclosure/2025/Aug/0	af854a3a-2127-422b-91ae-364da2661108	seclists.org	Third Party Advisory
chromereleases.googleblog.com/2025/07/stable-channel-update-for-desktop_15.html	[email protected]	chromereleases.googleblog.com	Release Notes
www.cisa.gov/known-exploited-vulnerabilities-catalog	134c704f-9b21-4f2e-91b3-4a467353bcc0	www.cisa.gov	US Government Resource
seclists.org/fulldisclosure/2025/Jul/35	af854a3a-2127-422b-91ae-364da2661108	seclists.org	Third Party Advisory
www.openwall.com/lists/oss-security/2025/08/02/1	af854a3a-2127-422b-91ae-364da2661108	www.openwall.com	Mailing List
seclists.org/fulldisclosure/2025/Jul/30	af854a3a-2127-422b-91ae-364da2661108	seclists.org	Third Party Advisory
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis
CISA Known Exploited Vulnerabilities catalog	CISA	www.cisa.gov	kev

No vendor comments have been submitted for this CVE.

Source	Time	Event
ADP	2025-07-22T00:00:00.000Z	CVE-2025-6558 added to CISA KEV

There are currently no legacy QID mappings associated with this CVE.