8.8

CVE-2025-6558: Google Chromium ANGLE and GPU Improper Input Validation Vulnerability

CVSS: 8.8v3.1HighKEVAnalyzed
AliasesUBUNTU-CVE-2025-6558DEBIAN-CVE-2025-6558CGA-q9gg-pj9r-xpmx
Published 15-07-2025Last modified 01-10-2026
Open JSON

Vulnerability summary

CVE-2025-6558 is a high (CVSS 8.8) Improper Input Validation vulnerability in Google Chromium. It is known to be exploited: CISA lists it, first on 22-07-2025. EPSS estimates a 10.93% chance of exploitation in the next 30 days, higher than 95.8% of scored vulnerabilities.

Overall risk
85/100
0100
Critical · default modelHow is this calculated?
CVSS score
8.8/10
010
High · v3.1 (CVE.org)
EPSS score
10.93%
0%100%
Medium · +1.34 pp in 30 days
KEVListedCISA
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 22 · Related 9
DLA-4276-1DSA-5963-1DSA-5978-1MGASA-2025-0313OPENSUSE-SU-2025:15350-1OPENSUSE-SU-2026:22076-1

Timeline

  1. 15-07-2025
    PublishedVulnerability first disclosed.
  2. 22-07-2025
    Added to CISA KEVGoogle Chromium ANGLE and GPU Improper Input Validation Vulnerability
  3. 12-08-2025
    CISA remediation dueApply mitigations per vendor instructions.
  4. 01-10-2026
    Last modifiedVulnerability information updated.

Description

Insufficient validation of untrusted input in ANGLE and GPU in Google Chrome prior to 138.0.7204.157 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

CVSS metrics

6 scores · 6 sources · 1 version

EPSS trend

Probability

10.93%

Chance of exploitation in the next 30 days

Percentile

96%

Versus all other CVEs

30-day change

+1.34 pp

From 9.59% on 19-09-2026

19-09-202619-10-2026
EPSS score
10.93%

Known exploited

Compare KEV catalogs
CISA KEVListed
Added
22-07-2025
Federal due date
12-08-2025

CISA required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. chromereleases.googleblog.com/2025/07/stable-channel-update-for-desktop_15.html nvd.nist.gov/vuln/detail/CVE-2025-6558

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Apple6 products
Ubuntu5 products
  • qtwebkit-opensource-srcAll versions (No fix recorded)
  • qtwebkit-sourceAll versions (No fix recorded)
  • webkit2gtkAll versions (No fix recorded) | < 2.48.5-0ubuntu0.22.04.1 | < 2.48.5-0ubuntu0.24.04.1 | < 2.48.6-1ubuntu2
  • webkitgtkAll versions (No fix recorded)
  • wpewebkitAll versions (No fix recorded)
Debian4 products
  • chromium< 138.0.7204.157-1~deb12u1 | < 138.0.7204.157-1
  • webkit2gtk< 2.48.5-1~deb12u1 | < 2.48.5-1~deb13u1 | < 2.48.5-1
  • wpewebkitAll versions (No fix recorded) | < 2.48.5-1
  • debian_linuxEOL11.0
Chainguard1 product
  • chromium< 138.0.7204.157-r0
Google1 product
  • chrome≥ 138.0.7204.157, < 138.0.7204.157 | < 138.0.7204.157
Webkitgtk1 product
Wolfi1 product
  • chromium< 138.0.7204.157-r0
Wpewebkit1 product

8 vendors · 20 products

References

18 links
Show all 18 references