# CVE-2025-6558

Insufficient validation of untrusted input in ANGLE and GPU in Google Chrome prior to 138.0.7204.157 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

- Page: https://www.vulneraibility.com/cve/CVE-2025-6558
- CVSS: 8.8
- Known exploited: yes, in CISA KEV since 2025-07-22; CISA due date 2025-08-12
- EPSS: 10.93%
- Unvetted proof-of-concept code on GitHub: 2 GitHub proofs of concept (first 2025-07-22)
- CISA SSVC: exploitation active, automatable no, technical impact total (assessed 2025-07-22)
- Weakness: CWE-20
- Published: 2025-07-15

## Affected versions

- Google Chrome: affected < 138.0.7204.157

A version outside these ranges is not a statement that it is unaffected.

## References

- [other] https://chromereleases.googleblog.com/2025/07/stable-channel-update-for-desktop_15.html
- [other] https://issues.chromium.org/issues/427162086
- [other] https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-6558
- [other] https://lists.debian.org/debian-lts-announce/2025/08/msg00015.html
- [other] http://seclists.org/fulldisclosure/2025/Aug/0
- [other] http://seclists.org/fulldisclosure/2025/Jul/37
- [other] http://seclists.org/fulldisclosure/2025/Jul/35
- [other] http://seclists.org/fulldisclosure/2025/Jul/32
- [other] http://seclists.org/fulldisclosure/2025/Jul/30
- [other] http://www.openwall.com/lists/oss-security/2025/08/02/1
- [other] http://www.openwall.com/lists/oss-security/2026/09/30/18

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.