high8.8Known exploited
CVE-2025-6558
Google Chromium ANGLE and GPU Improper Input Validation Vulnerability
Exploited in the wild
This vulnerability is on a Known Exploited Vulnerabilities catalogue, added 2025-07-22. Federal due date: 2025-08-12.
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Impact
Insufficient validation of untrusted input in ANGLE and GPU in Google Chrome prior to 138.0.7204.157 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Chrome | before 138.0.7204.157 | |
| Debian | Debian Linux | Version 11.0 |
| Apple | Safari | before 18.6 |
| Apple | Ipados | before 18.6 |
| Apple | Iphone Os | before 18.6 |
| Apple | Macos | before 15.6 |
| Apple | Visionos | before 2.6 |
| Apple | Watchos | before 11.6 |
| Wpewebkit | Wpe Webkit | before 2.48.5 |
| Webkitgtk | Webkitgtk | before 2.48.5 |
Weakness classification
References
- NVD record
- CVE.org record
- CISA KEV catalog
- https://chromereleases.googleblog.com/2025/07/stable-channel-update-for-desktop_15.html
- https://issues.chromium.org/issues/427162086
- http://seclists.org/fulldisclosure/2025/Aug/0
- http://seclists.org/fulldisclosure/2025/Jul/30
- http://seclists.org/fulldisclosure/2025/Jul/32
- http://seclists.org/fulldisclosure/2025/Jul/35
- http://seclists.org/fulldisclosure/2025/Jul/37
- http://www.openwall.com/lists/oss-security/2025/08/02/1
- http://www.openwall.com/lists/oss-security/2026/09/30/18
- https://lists.debian.org/debian-lts-announce/2025/08/msg00015.html
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-6558