CVE-2025-6558: Google Chromium ANGLE and GPU Improper Input Validation Vulnerability

Description

Insufficient validation of untrusted input in ANGLE and GPU in Google Chrome prior to 138.0.7204.157 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack vector

Network

Complexity

Low

Privileges

None

User interaction

Required

Confidentiality

High

Integrity

High

Availability

High

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)10.9% · higher than 96% of CVEs

Exploited in the wildYes

CISA KEVListed Jul 22, 2025

Federal remediation dueAug 12, 2025

Ransomware campaign useNot known

Affected products

Which versions

CH

Chrome · Google

138.0.7204.157 before 138.0.7204.157 · source: vendor, NVD, KEV

IO

iOS · Apple

before 18.6 · source: NVD

MA

macOS · Apple

before 15.6 · source: NVD

DL

Debian Linux · Debian

11.0 · source: NVD

SA

Safari · Apple

before 18.6 · source: NVD

VI

Visionos · Apple

before 2.6 · source: NVD

WA

Watchos · Apple

before 11.6 · source: NVD

WE

Webkitgtk · Webkitgtk

before 2.48.5 · source: NVD

WW

Wpe Webkit · Wpewebkit

before 2.48.5 · source: NVD