CVE-2025-6558

Details

Insufficient validation of untrusted input in ANGLE and GPU in Google Chrome prior to 138.0.7204.157 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

Affected Packages

Google Chrome

Windows 10 (1507)Windows 10 (1607) / Server 2016Windows 10 (1809) / Server 2019Windows 10 (1903)Windows 10 (1909)

Fixed in:

138.0.7204.157

References

WEBhttp://seclists.org/fulldisclosure/2025/Aug/0 WEBhttp://seclists.org/fulldisclosure/2025/Jul/30 WEBhttp://seclists.org/fulldisclosure/2025/Jul/32 WEBhttp://seclists.org/fulldisclosure/2025/Jul/35 WEBhttp://seclists.org/fulldisclosure/2025/Jul/37 WEBhttp://www.openwall.com/lists/oss-security/2025/08/02/1 WEBhttps://chromereleases.googleblog.com/2025/07/stable-channel-update-for-desktop_15.html WEBhttps://issues.chromium.org/issues/427162086 WEBhttps://lists.debian.org/debian-lts-announce/2025/08/msg00015.html WEBhttps://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-6558 ADVISORYhttps://www.cve.org/CVERecord?id=CVE-2025-6558

CVE-2025-6558

Details

Affected Packages

References

CVSS Analysis

Weakness Type (CWE)

Ecosystems(20)

Timeline