CVE-2025-6558
Google Chromium ANGLE and GPU Improper Input Valid - [Actively Exploited]
Description
Insufficient validation of untrusted input in ANGLE and GPU in Google Chrome prior to 138.0.7204.157 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
INFO
Published Date :
July 15, 2025, 6:15 p.m.
Last Modified :
July 23, 2025, 1 a.m.
Source :
[email protected]
Remotely Exploitable :
Yes !
Impact Score :
5.9
Exploitability Score :
2.8
CISA KEV (Known Exploited Vulnerabilities)
For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild.
Google Chromium contains an improper input validation vulnerability in ANGLE and GPU. This vulnerability could allow a remote attacker to potentially perform a sandbox escape via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
https://chromereleases.googleblog.com/2025/07/stable-channel-update-for-desktop_15.html ; https://nvd.nist.gov/vuln/detail/CVE-2025-6558
Public PoC/Exploit Available at Github
CVE-2025-6558 has a 7 public PoC/Exploit available at Github.
Go to the Public Exploits tab to see the list.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2025-6558.
| URL | Resource |
|---|---|
| https://chromereleases.googleblog.com/2025/07/stable-channel-update-for-desktop_15.html | Release Notes |
| https://issues.chromium.org/issues/427162086 | Issue Tracking Permissions Required |
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
None
HTML
None
None
None
Python
CISA Bot is a GitHub bot that automatically monitors the Cybersecurity and Infrastructure Security Agency (CISA) Known Exploited Vulnerabilities (KEV) Catalog. When new vulnerabilities are published in the KEV, the bot creates GitHub issues in this repository with detailed information about each vulnerability.
Python
None
Shell Ruby HTML JavaScript SCSS Python
📡 PoC auto collect from GitHub. ⚠️ Be careful Malware.
security cve exploit poc vulnerability
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2025-6558 vulnerability anywhere in the article.
-
europa.eu
Cyber Brief 25-08 - July 2025
Cyber Brief (July 2025)August 4, 2025 - Version: 1TLP:CLEARExecutive summaryWe analysed 287 open source reports for this Cyber Brief1.Relating to cyber policy and law enforcement, the EU, UK, and US h ... Read more
-
seclists.org
APPLE-SA-07-30-2025-1 Safari 18.6
Full Disclosure mailing list archives From: Apple Product Security via Fulldisclosure <fulldisclosure () seclists org> Date: Wed, 30 Jul 2025 12:51:16 -0700 -----BEGIN PGP SIGNED MESSAGE----- Hash: SH ... Read more
-
MacRumors
iOS 18.6 and macOS Sequoia 15.6 Address Chrome Zero-Day Attack
Wednesday July 30, 2025 5:09 pm PDT by Juli CloverThe iOS 18.6, iPadOS 18.6, and macOS Sequoia 15.6 updates that Apple released yesterday address a major zero-day attack that targeted Chrome users, ac ... Read more
-
BleepingComputer
Apple patches security flaw exploited in Chrome zero-day attacks
Apple has released security updates to address a high-severity vulnerability that has been exploited in zero-day attacks targeting Google Chrome users. Tracked as CVE-2025-6558, the security bug is du ... Read more
-
The Hacker News
Apple Patches Safari Vulnerability Also Exploited as Zero-Day in Google Chrome
Jul 30, 2025Ravie LakshmananVulnerability / Zero-Day Apple on Tuesday released security updates for its entire software portfolio, including a fix for a vulnerability that Google said was exploited ... Read more
-
CybersecurityNews
Chrome High-Severity Vulnerabilities Allows Memory Manipulation and Arbitrary Code Execution
Google has issued an urgent security update for its Chrome browser, patching several vulnerabilities, including a high-severity vulnerability that could allow attackers to manipulate memory and execut ... Read more
-
The Hacker News
Fire Ant Exploits VMware Flaws to Compromise ESXi Hosts and vCenter Environments
Jul 24, 2025Ravie LakshmananVirtualization / Network Security Virtualization and networking infrastructure have been targeted by a threat actor codenamed Fire Ant as part of a prolonged cyber espion ... Read more
-
The Hacker News
Sophos and SonicWall Patch Critical RCE Flaws Affecting Firewalls and SMA 100 Devices
Jul 24, 2025Ravie LakshmananNetwork Security / Vulnerability Sophos and SonicWall have alerted users of critical security flaws in Sophos Firewall and Secure Mobile Access (SMA) 100 Series appliance ... Read more
-
The Hacker News
Storm-2603 Exploits SharePoint Flaws to Deploy Warlock Ransomware on Unpatched Systems
Jul 24, 2025Ravie LakshmananVulnerability / Ransomware Microsoft has revealed that one of the threat actors behind the active exploitation of SharePoint flaws is deploying Warlock ransomware on targ ... Read more
-
CybersecurityNews
CISA warns of Google Chromium 0-Day Input Validation Vulnerability Exploited in Attacks
CISA has issued an urgent warning about a critical vulnerability in Google Chromium that threat actors are actively exploiting. The vulnerability, designated as CVE-2025-6558, poses a significant secu ... Read more
-
The Hacker News
Threat Actor Mimo Targets Magento and Docker to Deploy Crypto Miners and Proxyware
Jul 23, 2025Ravie LakshmananMalware / Cryptocurrency The threat actor behind the exploitation of vulnerable Craft Content Management System (CMS) instances has shifted its tactics to target Magento ... Read more
-
The Hacker News
CISA Warns: SysAid Flaws Under Active Attack Enable Remote File Access and SSRF
Jul 23, 2025Ravie LakshmananVulnerability / Software Security The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added two security flaws impacting SysAid IT support software to its Kn ... Read more
-
The Hacker News
CISA Orders Urgent Patching After Chinese Hackers Exploit SharePoint Flaws in Live Attacks
Jul 23, 2025Ravie LakshmananVulnerability / Threat Intelligence The U.S. Cybersecurity and Infrastructure Security Agency (CISA), on July 22, 2025, added two Microsoft SharePoint flaws, CVE-2025-497 ... Read more
-
Daily CyberSecurity
CISA Alert: Actively Exploited Zero-Days in CrushFTP, Chrome, and SysAid Added to KEV Catalog
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has updated its Known Exploited Vulnerabilities (KEV) Catalog with four new entries that are currently under active exploitation. These ... Read more
-
The Hacker News
Microsoft Links Ongoing SharePoint Exploits to Three Chinese Hacker Groups
Jul 22, 2025Ravie LakshmananVulnerability / Threat Intelligence Microsoft has formally tied the exploitation of security flaws in internet-facing SharePoint Server instances to two Chinese hacking g ... Read more
-
The Hacker News
Cisco Confirms Active Exploits Targeting ISE Flaws Enabling Unauthenticated Root Access
Jul 22, 2025Ravie LakshmananNetwork Security / Vulnerability Cisco on Monday updated its advisory of a set of recently disclosed security flaws in Identity Services Engine (ISE) and ISE Passive Iden ... Read more
-
The Hacker News
Hackers Exploit SharePoint Zero-Day Since July 7 to Steal Keys, Maintain Persistent Access
The recently disclosed critical Microsoft SharePoint vulnerability has been under exploitation as early as July 7, 2025, according to findings from Check Point Research. The cybersecurity company said ... Read more
-
The Hacker News
Microsoft Releases Urgent Patch for SharePoint RCE Flaw Exploited in Ongoing Cyber Attacks
Microsoft on Sunday released security patches for an actively exploited security flaw in SharePoint and also released details of another vulnerability that it said has been addressed with "more robust ... Read more
-
The Hacker News
Hard-Coded Credentials Found in HPE Instant On Devices Allow Admin Access
Jul 21, 2025Ravie LakshmananNetwork Security / Vulnerability Hewlett-Packard Enterprise (HPE) has released security updates to address a critical security flaw affecting Instant On Access Points tha ... Read more
-
CybersecurityNews
Weekly Cybersecurity Newsletter: Chrome 0-Day, VMware Flaws Patched, Fortiweb Hack, Teams Abuse, and More
It’s been a busy seven days for security alerts. Google is addressing another actively exploited zero-day in Chrome, and VMware has rolled out key patches for its own set of vulnerabilities. We’ll als ... Read more
-
The Hacker News
EncryptHub Targets Web3 Developers Using Fake AI Platforms to Deploy Fickle Stealer Malware
The financially motivated threat actor known as EncryptHub (aka LARVA-208 and Water Gamayun) has been attributed to a new campaign that's targeting Web3 developers to infect them with information stea ... Read more
-
The Hacker News
Critical Unpatched SharePoint Zero-Day Actively Exploited, Breaches 75+ Global Organizations
Jul 20, 2025Ravie LakshmananZero-Day / Vulnerability A critical security vulnerability in Microsoft SharePoint Server has been weaponized as part of an "active, large-scale" exploitation campaign. T ... Read more
-
Help Net Security
Week in review: Google fixes zero-day vulnerability in Chrome, critical SQL injection flaw in FortiWeb
Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: Update Google Chrome to fix actively exploited zero-day (CVE-2025-6558) For the fifth time this year, ... Read more
-
The Hacker News
Hackers Exploit Critical CrushFTP Flaw to Gain Admin Access on Unpatched Servers
Jul 20, 2025Ravie LakshmananVulnerability / Threat Intelligence A newly disclosed critical security flaw in CrushFTP has come under active exploitation in the wild. Assigned the CVE identifier CVE-2 ... Read more
-
TheCyberThrone
CVE-2025-20337: Cisco ISE Critical RCE Vulnerability
Skip to content July 18, 2025SummaryCVE-2025-20337 is a critical remote code execution (RCE) vulnerability affecting Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE- ... Read more
-
TheCyberThrone
CVE-2025-6558 – Chrome Zero-Day Sandbox Escape via GPU Rendering Flaw
Skip to content July 17, 2025Threat OverviewCVE-2025-6558 is a high-risk zero-day vulnerability (CVSS score: 8.8) impacting Google Chrome’s graphics rendering pipeline, specifically within the ANGLE ( ... Read more
-
Help Net Security
Update Google Chrome to fix actively exploited zero-day (CVE-2025-6558)
For the fifth time this year, Google has patched a Chrome zero-day vulnerability (CVE-2025-6558) exploited by attackers in the wild. About CVE-2025-6558 CVE-2025-6558 is a high-severity vulnerability ... Read more
-
security.nl
Google verhelpt zes beveiligingslekken in Chrome
Google heeft een beveiligingsupdate uitgebracht voor Chrome. In totaal worden zes kwetsbaarheden verholpen. Google geeft aan dat voor één van de verholpen kwetsbaarheden (CVE-2025-6558) een exploit "i ... Read more
-
BleepingComputer
Google fixes actively exploited sandbox escape zero day in Chrome
Google has released a security update for Chrome to address half a dozen vulnerabilities, one of them actively exploited by attackers to escape the browser's sandbox protection. The vulnerability is i ... Read more
-
The Hacker News
Urgent: Google Releases Critical Chrome Update for CVE-2025-6558 Exploit Active in the Wild
Jul 16, 2025Ravie LakshmananBrowser Security / Zero-Day Google on Tuesday rolled out fixes for six security issues in its Chrome web browser, including one that it said has been exploited in the wil ... Read more
-
CybersecurityNews
Google Chrome 0-day Vulnerability Actively Exploited in the Wild
Google has released an emergency security update for Chrome, addressing a critical zero-day vulnerability that attackers are actively exploiting in real-world attacks. The tech giant confirmed that CV ... Read more
-
Daily CyberSecurity
Broadcom Addresses Critical Vulnerabilities in VMware ESXi, Workstation, and Fusion
Broadcom has issued an urgent advisory addressing four critical vulnerabilities affecting VMware ESXi, Workstation, Fusion, and Tools, with CVSS scores reaching as high as 9.3. These flaws, reported t ... Read more
-
Daily CyberSecurity
Urgent Chrome Update: Google Patches Critical Zero-Day (CVE-2025-6558) Under Active Attack
Google has released a critical Stable Channel update for Chrome Desktop (version 138.0.7204.157/.158), addressing six security vulnerabilities, including one that is already being exploited in the wil ... Read more
The following table lists the changes that have been made to the
CVE-2025-6558 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE CISA KEV Update by 9119a7d8-5eab-497f-8521-727c672e3725
Jul. 23, 2025
Action Type Old Value New Value Added Date Added 2025-07-22 Added Due Date 2025-08-12 Added Required Action Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Added Vulnerability Name Google Chromium ANGLE and GPU Improper Input Validation Vulnerability -
Initial Analysis by [email protected]
Jul. 16, 2025
Action Type Old Value New Value Added CPE Configuration OR *cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* versions up to (excluding) 138.0.7204.157 Added Reference Type Chrome: https://chromereleases.googleblog.com/2025/07/stable-channel-update-for-desktop_15.html Types: Release Notes Added Reference Type Chrome: https://issues.chromium.org/issues/427162086 Types: Issue Tracking, Permissions Required -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Jul. 15, 2025
Action Type Old Value New Value Added CVSS V3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H -
New CVE Received by [email protected]
Jul. 15, 2025
Action Type Old Value New Value Added Description Insufficient validation of untrusted input in ANGLE and GPU in Google Chrome prior to 138.0.7204.157 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High) Added CWE CWE-20 Added Reference https://chromereleases.googleblog.com/2025/07/stable-channel-update-for-desktop_15.html Added Reference https://issues.chromium.org/issues/427162086
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2025-6558 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2025-6558
weaknesses.