CVE-2025-6558

KEV
Published: Lug 15, 2025 Last Modified: Nov 06, 2025 EU-VD ID: EUVD-2025-21546
ExploitDB:
Other exploit source:
Google Dorks:
HIGH 8,8
Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0
Attack Vector: network
Attack Complexity: low
Privileges Required: none
User Interaction: required
Scope: unchanged
Confidentiality: high
Integrity: high
Availability: high

Description

AI Translation Available

Insufficient validation of untrusted input in ANGLE and GPU in Google Chrome prior to 138.0.7204.157 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

EPSS (Exploit Prediction Scoring System)

Trend Analysis

EPSS (Exploit Prediction Scoring System)

Prevede la probabilità di sfruttamento basata su intelligence sulle minacce e sulle caratteristiche della vulnerabilità.

EPSS Score
0,0009
Percentile
0,3th
Updated

EPSS Score Trend (Last 90 Days)

20

Improper Input Validation

Stable
Abstraction: Class Structure: Simple
Common Consequences
Security Scopes Affected:
Availability Confidentiality Integrity
Potential Impacts:
Dos: Crash, Exit, Or Restart Dos: Resource Consumption (Cpu) Dos: Resource Consumption (Memory) Read Memory Read Files Or Directories Modify Memory Execute Unauthorized Code Or Commands
Applicable Platforms
All platforms may be affected
Likelihood of Exploit: High
View CWE Details
Operating System

Macos by Apple

Product Information
Vendor Apple
Product Macos
Version Range Affected
To 15.6 (exclusive)
cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application

Wpe Webkit by Wpewebkit

Product Information
Vendor Wpewebkit
Product Wpe Webkit
Version Range Affected
To 2.48.0 (exclusive)
cpe:2.3:a:wpewebkit:wpe_webkit:*:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System

Watchos by Apple

Product Information
Vendor Apple
Product Watchos
Version Range Affected
To 11.6 (exclusive)
cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application

Chrome by Google

Product Information
Vendor Google
Product Chrome
Version Range Affected
To 138.0.7204.157 (exclusive)
cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System

Ipados by Apple

Product Information
Vendor Apple
Product Ipados
Version Range Affected
To 18.6 (exclusive)
cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application

Safari by Apple

Product Information
Vendor Apple
Product Safari
Version Range Affected
To 18.6 (exclusive)
cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System

Iphone Os by Apple

Product Information
Vendor Apple
Product Iphone Os
Version Range Affected
To 18.6 (exclusive)
cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application

Webkitgtk by Webkitgtk

Product Information
Vendor Webkitgtk
Product Webkitgtk
Version Range Affected
To 2.48.0 (exclusive)
cpe:2.3:a:webkitgtk:webkitgtk:*:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System

Visionos by Apple

Product Information
Vendor Apple
Product Visionos
Version Range Affected
To 2.6 (exclusive)
cpe:2.3:o:apple:visionos:*:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System

Debian Linux by Debian

Product Information
Vendor Debian
Product Debian Linux
Version 11.0
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
https://www.cisa.gov/known-exploited-vulnerabilities-catalo…
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025…
http://seclists.org/fulldisclosure/2025/Aug/0
http://seclists.org/fulldisclosure/2025/Aug/0
http://seclists.org/fulldisclosure/2025/Jul/30
http://seclists.org/fulldisclosure/2025/Jul/30
http://seclists.org/fulldisclosure/2025/Jul/32
http://seclists.org/fulldisclosure/2025/Jul/32
http://seclists.org/fulldisclosure/2025/Jul/35
http://seclists.org/fulldisclosure/2025/Jul/35
http://seclists.org/fulldisclosure/2025/Jul/37
http://seclists.org/fulldisclosure/2025/Jul/37
https://lists.debian.org/debian-lts-announce/2025/08/msg000…
https://lists.debian.org/debian-lts-announce/2025/08/msg00015.html
http://www.openwall.com/lists/oss-security/2025/08/02/1
http://www.openwall.com/lists/oss-security/2025/08/02/1
https://chromereleases.googleblog.com/2025/07/stable-channe…
https://chromereleases.googleblog.com/2025/07/stable-channel-update-for-desktop…
https://issues.chromium.org/issues/427162086
https://issues.chromium.org/issues/427162086