Pierluigi Paganini
July 16, 2025
Google released fixes for six Chrome flaws, including one actively exploited in the wild tracked as CVE-2025-6558 (CVSS score of 8.8). CVE-2025-6558 stems from improper validation of untrusted input in Chrome’s ANGLE and GPU components.
Clément Lecigne and Vlad Stolyarov of Google’s Threat Analysis Group reported the vulnerability on June 23, 2025. Google’s TAG team investigates attacks by nation-state actors and commercial spyware vendors. One of these threat actors likely exploited the issue in the wild.
“Google is aware that an exploit for CVE-2025-6558 exists in the wild.” reads the advisory published by Google.
Google also fixed the following vulnerabilities:
In early July, Google released security patches to address another Chrome vulnerability, tracked as CVE-2025-6554, for which an exploit exists in the wild.
The vulnerability CVE-2025-6554 is a type-confusing issue that resides in the V8 JavaScript and WebAssembly engine.
“This issue was mitigated on 2025-06-26 by a configuration change pushed out to Stable channel across all platforms.” reads the advisory. “Google is aware that an exploit for CVE-2025-6554 exists in the wild.”
A type confusion vulnerability occurs when a program mistakenly treats a piece of data as a different type than it actually is, leading to unintended behavior. This mismatch can cause memory corruption, crashes, or allow an attacker to execute arbitrary code.
Clément Lecigne of Google’s Threat Analysis Group discovered the vulnerability on June 25, 2025.
CVE-2025-6554 is the fourth Chrome zero-day patched by Google in 2025. The IT giant also addressed these zero-day vulnerabilities this year:
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, Google)
