high8.1Known exploited

CVE-2025-6554

Google Chromium V8 Type Confusion Vulnerability

Exploited in the wild

This vulnerability is on a Known Exploited Vulnerabilities catalogue, added 2025-07-02. Federal due date: 2025-07-23.

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Impact

Type confusion in V8 in Google Chrome prior to 138.0.7204.96 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. (Chromium security severity: High)

Affected products

Vendor	Product	Affected versions
Google	Chrome	before 138.0.7204.96 before 138.0.7204.92

Weakness classification

CWE-843

References

NVD record
CVE.org record
CISA KEV catalog
https://chromereleases.googleblog.com/2025/06/stable-channel-update-for-desktop_30.html
https://issues.chromium.org/issues/427663123
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-6554