CVE-2025-6558: high-severity vulnerability in Google Chrome
Published · Updated
Prioritize patching. It under exploitation confirmed by CISA and has a public proof of concept.
Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Google Chrome had a flaw where it didn't properly check data from websites, allowing an attacker to create a malicious webpage that could break out of Chrome's security sandbox. This is serious because it could let attackers access files and programs on your computer.
Insufficient input validation in ANGLE and GPU processing allowed remote code execution with sandbox escape via crafted HTML. Attack requires user interaction (visiting a malicious webpage); successful exploitation bypasses Chrome's sandbox isolation, potentially granting attacker access to system resources beyond the browser process.
The full analysis of this CVE is available in Portuguese →
In the same product, most dangerous first.