What’s Vulnerable › Vulnerabilities

CVE-2025-6558: Google Chromium ANGLE and GPU Improper Input Validation Vulnerability

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: yes — in CISA KEV since 2025-07-22
• EPSS: 10.9% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-07-15 · updated 2026-10-01
• Weakness: CWE-20

Description

Insufficient validation of untrusted input in ANGLE and GPU in Google Chrome prior to 138.0.7204.157 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

Affected products

• Apple iPadOS: before 18.6 — fixed in 18.6
• Apple Iphone Os: before 18.6 — fixed in 18.6
• Apple macOS: before 15.6 — fixed in 15.6
• Apple Safari: before 18.6 — fixed in 18.6
• Apple visionOS: before 2.6 — fixed in 2.6
• Apple watchOS: before 11.6 — fixed in 11.6
• Debian Linux: 11.0
• Google Chrome: before 138.0.7204.157 — fixed in 138.0.7204.157
• Webkit: before 2.48.5 — fixed in 2.48.5
• Wpewebkit Wpe Webkit: before 2.48.5 — fixed in 2.48.5

How to fix

Upgrade to a fixed version: Apple iPadOS 18.6; Apple Iphone Os 18.6; Apple macOS 15.6; Apple Safari 18.6; Apple visionOS 2.6; Apple watchOS 11.6; Google Chrome 138.0.7204.157; Webkit 2.48.5; Wpewebkit Wpe Webkit 2.48.5. Check the vendor advisory for mitigations.

References

• https://chromereleases.googleblog.com/2025/07/stable-channel-update-for-desktop_15.html
• https://issues.chromium.org/issues/427162086
• http://seclists.org/fulldisclosure/2025/Aug/0
• http://seclists.org/fulldisclosure/2025/Jul/30
• http://seclists.org/fulldisclosure/2025/Jul/32
• http://seclists.org/fulldisclosure/2025/Jul/35
• http://seclists.org/fulldisclosure/2025/Jul/37
• http://www.openwall.com/lists/oss-security/2025/08/02/1
• http://www.openwall.com/lists/oss-security/2026/09/30/18
• https://lists.debian.org/debian-lts-announce/2025/08/msg00015.html
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-6558

Get alerted when CVE-2025-6558 or the next vulnerability affects your stack