CVE-2025-6554

Type confusion in V8 in Google Chrome prior to 138.0.7204.96 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. (Chromium security severity: High)

CVSS v3.1

8.1 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

EPSS

12.72% chance of exploitation in the next 30 days, 96th percentile

CISA KEV

added 2025-07-02

Published

2025-06-30

Updated

2025-10-21

Proof-of-concept exploits (9)

• DarkNavySecurity/PoC226★ · 2025-08-27
• PwnToday/CVE-2025-65542★ · 2025-08-28
• ghostn4444/POC-CVE-2025-65541★ · 2025-07-09
• gmh5225/CVE-2025-65540★ · 2025-07-04
• gmh5225/CVE-2025-6554-22★ · 2025-07-04
• LordBheem/CVE-2025-6554
• aklnjakln/CVE-2025-6554
• jopraveen/CVE-2025-6554
• mistymntncop/CVE-2025-6554

References

• CVE Record
• NVD entry

Related

• CVE-2024-5274
• CVE-2025-43300
• CVE-2025-53770
• CVE-2025-8088
• CVE-2003-0358
• CVE-2015-2291