CVE-2025-6558
Published: 15 July 2025
Summary
CVE-2025-6558 is a high-severity Improper Input Validation (CWE-20) vulnerability in Google Chrome. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 44.1th percentile by exploit likelihood (below the median); CISA has added it to the Known Exploited Vulnerabilities catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-39 (Process Isolation) and SI-10 (Information Input Validation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly addresses the insufficient validation of untrusted input in ANGLE and GPU components that enables the sandbox escape.
Enforces process isolation to prevent sandbox escapes resulting from the input validation flaw in Chrome's GPU processes.
Requires timely remediation of the specific flaw via patching to Chrome version 138.0.7204.157, eliminating the vulnerability.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct client-side browser RCE/sandbox escape via malicious HTML input validation flaw.
NVD Description
Insufficient validation of untrusted input in ANGLE and GPU in Google Chrome prior to 138.0.7204.157 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
Deeper analysisAI
CVE-2025-6558 involves insufficient validation of untrusted input (CWE-20) in the ANGLE and GPU components of Google Chrome prior to version 138.0.7204.157. This vulnerability, published on 2025-07-15, carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and is rated High severity by Chromium security standards.
A remote attacker can exploit the issue by luring a user to interact with a crafted HTML page, potentially achieving a sandbox escape. The attack requires no privileges and low complexity but depends on user interaction, enabling high-impact compromise of confidentiality, integrity, and availability within the browser's sandboxed environment.
Mitigation is available via the Google Chrome stable channel update to version 138.0.7204.157, as announced in the Chrome Releases blog at chromereleases.googleblog.com/2025/07/stable-channel-update-for-desktop_15.html. Additional technical details are documented in Chromium issue 427162086 at issues.chromium.org/issues/427162086, with related disclosures on seclists.org/fulldisclosure/2025/Aug/0, seclists.org/fulldisclosure/2025/Jul/30, and seclists.org/fulldisclosure/2025/Jul/32.
Details
- CWE(s)
- KEV Date Added
- 22 July 2025