CVE-2025-6554

Deeper analysis

CVE-2025-6554 is a type confusion vulnerability, tracked under CWE-843, in the V8 JavaScript engine within Google Chrome versions prior to 138.0.7204.96. The flaw permits arbitrary memory read and write operations when a victim visits a specially crafted HTML page, carrying a CVSS 3.1 base score of 8.1 reflecting network attack vector, low complexity, and high impact on confidentiality and integrity.

A remote attacker can exploit the issue by serving malicious web content that triggers the type confusion during JavaScript execution. Successful exploitation grants the attacker the ability to read or corrupt arbitrary memory within the renderer process, potentially leading to code execution or further sandbox escapes, although user interaction is required to load the crafted page.

Chrome stable channel updates released on 30 June 2025 address the vulnerability by advancing the browser to version 138.0.7204.96 or later. The issue is also listed in CISA’s Known Exploited Vulnerabilities catalog, confirming observed in-the-wild exploitation and underscoring the need for prompt patching across enterprise fleets. The associated EPSS score has remained flat at 0.0158 with no material increase since disclosure.