CVE-2025-6558

Published: Jul 15, 2025Modified: Jun 17, 2026CISA KEV

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

Insufficient validation of untrusted input in ANGLE and GPU in Google Chrome prior to 138.0.7204.157 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

Affected (10)

Products: Google: Chrome · Debian: Debian Linux · Apple: Ipados, Iphone Os, Macos, Safari, Visionos, Watchos · +2 more

Show all products

Google: Chrome · Debian: Debian Linux · Apple: Ipados, Iphone Os, Macos, Safari, Visionos, Watchos · Wpewebkit: Wpe Webkit · Webkitgtk: Webkitgtk

1 product

1 product

6 products

1 product

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Google Chrome	Before 138.0.7204.157

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 11.0

Configuration C

6 vulnerable

Vulnerable Software	Affected Versions
Apple Ipados	Before 18.6
Apple Iphone Os	Before 18.6
Apple Macos	Before 15.6
Apple Safari	Before 18.6
Apple Visionos	Before 2.6
Apple Watchos	Before 11.6

Configuration D

1 vulnerable

Vulnerable Software	Affected Versions
Wpewebkit Wpe Webkit	Before 2.48.0

Configuration E

1 vulnerable

Vulnerable Software	Affected Versions
Webkitgtk Webkitgtk	Before 2.48.0

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (10)

https://chromereleases.googleblog.com/2025/07/stable-channel-update-for-desktop_15.html

Source: chrome-cve-admin@google.com

Release Notes

https://issues.chromium.org/issues/427162086

Source: chrome-cve-admin@google.com

Issue TrackingPermissions Required

http://seclists.org/fulldisclosure/2025/Aug/0