CVE-2025-6554
Google Chromium V8 Type Confusion Vulnerability
Description
CVE-2025-6554 is a high-severity type confusion vulnerability in the V8 JavaScript engine of Google Chrome, the world's most widely used web browser. The flaw allows a remote attacker to perform arbitrary read and write operations in the renderer process by luring a victim to a crafted HTML page. Rated CVSS v3.1 8.1, this vulnerability impacts confidentiality and integrity with high severity, and has been confirmed as actively exploited in the wild. CISA added CVE-2025-6554 to the Known Exploited Vulnerabilities catalog with a remediation deadline of July 23, 2025. Although the EPSS score of 0.47% at the 64th percentile is relatively low, the confirmed active exploitation and the massive Chrome user base make this a high-priority security update.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| chrome | < 138.0.7204.96; < 138.0.7204.92 |
References
- https://chromereleases.googleblog.com/2025/06/stable-channel-update-for-desktop_30.html(Vendor Advisory)
- https://issues.chromium.org/issues/427663123(Permissions Required)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-6554(US Government Resource)
Weakness Type
CWE-843: Type Confusion
CVE-2025-6554 is classified under CWE-843, Access of Resource Using Incompatible Type (Type Confusion). In the Chrome V8 JavaScript engine, a type confusion error occurs when the engine incorrectly handles an object as a different type than originally allocated. This misinterpretation allows an attacker to access memory regions with incorrect type assumptions, enabling arbitrary read and write primitives that can be used to achieve code execution within the renderer sandbox.
Learn more: CWE-843 — Access of Resource Using Incompatible Type (Type Confusion)
Impact Analysis
CVE-2025-6554 enables arbitrary memory read and write operations within the Chrome renderer process, posing severe risks to both confidentiality and integrity. The attack is network-accessible (AV:N) with low complexity (AC:L) and requires no authentication (PR:N), though it does require user interaction (UI:R) — the victim must visit a malicious or compromised webpage. Confidentiality and integrity are both rated high (C:H/I:H), as the type confusion primitive allows reading sensitive data from the renderer process memory and writing arbitrary data to controlled memory locations, which can be leveraged to execute attacker-controlled code. While Chrome's multi-process architecture and sandbox provide defense-in-depth, type confusion vulnerabilities in V8 are a proven path to sandbox escape when chained with additional exploits. The combination of Chrome's dominant market share (over 65% globally) and the low barrier to exploitation through a simple webpage visit makes this vulnerability particularly impactful for targeted attacks, watering hole campaigns, and drive-by exploitation scenarios.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2025-6554 in the wild by adding it to the Known Exploited Vulnerabilities catalog. While the EPSS score of 0.47% at the 64th percentile suggests limited widespread automated exploitation, type confusion vulnerabilities in V8 are highly valued by sophisticated threat actors and are commonly used in targeted attack campaigns, including state-sponsored operations and commercial spyware deployment. The Chrome release blog confirms the vulnerability was reported with evidence of active exploitation, though specific exploit details remain restricted in the Chromium issue tracker to protect users during the patching window. V8 type confusion exploits are among the most sought-after browser vulnerabilities on the exploit market, and organizations should treat the confirmed in-the-wild exploitation as an indicator that capable threat actors have weaponized this flaw.
Remediation
-
Update Google Chrome to version 138.0.7204.96 or later immediately. Chrome typically auto-updates, but enterprise environments with managed update policies should push this update urgently. Verify the update by navigating to
chrome://settings/help. -
Update all Chromium-based browsers including Microsoft Edge, Brave, Opera, and Vivaldi, which share the V8 JavaScript engine and are affected by the same underlying vulnerability. Check each browser's release notes for corresponding security updates.
-
Enable Chrome's site isolation and strict site process isolation in enterprise environments to limit the impact of renderer compromises. Configure the
--site-per-processflag and ensure V8 sandbox features are enabled. -
Implement network-level protections including web content filtering and DNS-based security services to block access to known malicious domains hosting exploitation pages. Deploy browser isolation solutions for high-risk users who may be targeted by sophisticated attacks.
-
Monitor for indicators of browser exploitation including unexpected Chrome renderer crashes, anomalous JavaScript execution patterns, and suspicious process creation from browser processes. Review endpoint detection and response (EDR) telemetry for signs of sandbox escape or post-exploitation activity.
Technical Details
CVE-2025-6554 is a type confusion vulnerability in V8, the JavaScript and WebAssembly engine used by Google Chrome, with the CVSS v3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N indicating a network-accessible attack requiring user interaction that impacts confidentiality and integrity. Type confusion in V8 occurs when the Just-In-Time (JIT) compiler or interpreter misidentifies the type of a JavaScript object during optimization, causing the engine to access memory using incorrect type layout assumptions. This creates a primitive where an attacker can read or write memory at offsets that correspond to fields of the confused type rather than the actual object type, enabling controlled out-of-bounds memory access. By carefully constructing JavaScript objects and triggering the confusion through specific execution patterns, an attacker can build arbitrary read and write primitives within the V8 heap, which can then be escalated to code execution within the renderer process. The vulnerability affects Chrome versions prior to 138.0.7204.96 (and 138.0.7204.92 on some platforms). The fix addresses the type handling logic in V8 to ensure correct type identification throughout the compilation and execution pipeline.
Frequently Asked Questions
Is CVE-2025-6554 being actively exploited?
Yes. Google has acknowledged that CVE-2025-6554 is being exploited in the wild, and CISA has added it to the KEV catalog. While specific exploit details are restricted, V8 type confusion vulnerabilities are commonly used in targeted attacks and commercial spyware operations.
What products are affected by CVE-2025-6554?
Google Chrome versions prior to 138.0.7204.96 are affected. All Chromium-based browsers sharing the V8 engine, including Microsoft Edge, Brave, Opera, and Vivaldi, are also potentially affected until they incorporate the fix.
How do I fix CVE-2025-6554?
Update Chrome to version 138.0.7204.96 or later. In enterprise environments, push the update immediately through browser management policies. Also update all other Chromium-based browsers to their latest versions.
How severe is CVE-2025-6554?
With a CVSS score of 8.1 (High) and confirmed active exploitation, CVE-2025-6554 is a significant browser security risk. The type confusion primitive enables arbitrary memory read/write in the renderer, and Chrome's massive user base amplifies the potential impact.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.