CVE-2025-6558

Insufficient validation of untrusted input in ANGLE and GPU in Google Chrome prior to 138.0.7204.157 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

CVSS v3.1

8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS

9.59% chance of exploitation in the next 30 days, 95th percentile

CISA KEV

added 2025-07-22

Published

2025-07-15

Updated

2026-02-26

Proof-of-concept exploits (4)

• DevBuiHieu/CVE-2025-6558-Proof-Of-Concept7★ · 2025-07-24
• gmh5225/CVE-2025-6558-exp1★ · 2025-07-17
• d4rkc0nd0r/work
• jaf0rk/CVE-2026-143827★ · 2026-07-10

References

• CVE Record
• NVD entry

Related

• CVE-2025-33053
• CVE-2003-0358
• CVE-2015-2291
• CVE-2020-36603
• CVE-2021-42205
• CVE-2022-24716