CVE-2025-6558
KEVHIGH 8.8EPSS 10.9%
Insufficient validation of untrusted input in ANGLE and GPU in Google Chrome prior to 138.0.7204.157 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
- Affected
- Google · Chrome
- CVSS v3.1 CNA
- 8.8 HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - EPSS
- 10.93% chance of exploitation in the next 30 days, 96th percentile
- CISA KEV
- added 2025-07-22
- Published
- 2025-07-15
- Updated
- 2026-10-01
Proof-of-concept exploits (4)
- DevBuiHieu/CVE-2025-6558-Proof-Of-Concept7★ · 2025-07-24
- gmh5225/CVE-2025-6558-exp1★ · 2025-07-17
- d4rkc0nd0r/work1★ · 2025-11-13
- jaf0rk/CVE-2026-143827★ · 2026-07-10
Security advisories
- http://seclists.org/fulldisclosure/2025/Aug/0
- http://seclists.org/fulldisclosure/2025/Jul/30
- http://seclists.org/fulldisclosure/2025/Jul/32
- http://seclists.org/fulldisclosure/2025/Jul/35
- http://seclists.org/fulldisclosure/2025/Jul/37
- https://lists.debian.org/debian-lts-announce/2025/08/msg00015.html
- https://chromereleases.googleblog.com/2025/07/stable-channel-update-for-desktop_15.html
- https://issues.chromium.org/issues/427162086