CVE-2025-6558
Google Chromium ANGLE and GPU Improper Input Validation Vulnerability
Description
CVE-2025-6558 is a high-severity improper input validation vulnerability in the ANGLE and GPU components of Google Chrome and multiple Apple products that share the WebKit rendering engine. The flaw allows a remote attacker to potentially escape the browser sandbox by convincing a user to visit a crafted HTML page, leading to complete system compromise. Rated 8.8 (High) on the CVSS v3.1 scale, the vulnerability affects Google Chrome versions prior to 138.0.7204.157, Apple Safari, iOS/iPadOS, macOS, visionOS, watchOS, and WebKit-based browsers. CISA has added CVE-2025-6558 to the Known Exploited Vulnerabilities catalog with a remediation deadline of August 12, 2025. While the EPSS score of 0.12% at the 31st percentile suggests relatively lower exploitation probability compared to other KEV entries, CISA's confirmation of active exploitation warrants immediate patching.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| chrome | < 138.0.7204.157 | |
| debian | debian linux | 11.0 |
| apple | safari | < 18.6 |
| apple | ipados | < 18.6 |
| apple | iphone os | < 18.6 |
| apple | macos | < 15.6 |
| apple | visionos | < 2.6 |
| apple | watchos | < 11.6 |
| wpewebkit | wpe webkit | < 2.48.0 |
| webkitgtk | webkitgtk | < 2.48.0 |
References
- https://chromereleases.googleblog.com/2025/07/stable-channel-update-for-desktop_15.html(Release Notes)
- https://issues.chromium.org/issues/427162086(Issue Tracking, Permissions Required)
- http://seclists.org/fulldisclosure/2025/Aug/0(Third Party Advisory)
- http://seclists.org/fulldisclosure/2025/Jul/30(Third Party Advisory)
- http://seclists.org/fulldisclosure/2025/Jul/32(Third Party Advisory)
- http://seclists.org/fulldisclosure/2025/Jul/35(Third Party Advisory)
- http://seclists.org/fulldisclosure/2025/Jul/37(Third Party Advisory)
- http://www.openwall.com/lists/oss-security/2025/08/02/1(Mailing List)
- https://lists.debian.org/debian-lts-announce/2025/08/msg00015.html(Mailing List, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-6558(US Government Resource)
Weakness Type
CWE-20: Improper Input Validation
CVE-2025-6558 is classified under CWE-20, which describes vulnerabilities where an application does not properly validate input before processing it. In the ANGLE (Almost Native Graphics Layer Engine) and GPU components of Chromium, insufficient validation of untrusted graphics-related input allows an attacker to provide malformed data through a crafted HTML page that triggers undefined behavior in the rendering pipeline. This improper validation enables a sandbox escape, where code execution breaks out of the browser's security boundary to affect the host operating system.
Learn more: CWE-20 — Improper Input Validation
Impact Analysis
CVE-2025-6558 carries a CVSS v3.1 base score of 8.8 (High) with significant real-world impact. The vulnerability is remotely exploitable over the network (AV:N) with low attack complexity (AC:L), requiring no authentication (PR:N), though it does require user interaction (UI:R) — specifically, the victim must navigate to a malicious web page. Confidentiality (High), Integrity (High), and Availability (High) are all fully impacted because the sandbox escape grants the attacker access to the host system beyond the browser's isolated environment. The broad attack surface is particularly concerning: the vulnerability affects not only Google Chrome but also Apple Safari, iOS, iPadOS, macOS Sequoia, visionOS, watchOS, and WebKit-based browsers on Debian Linux, encompassing billions of devices worldwide. While the EPSS score of 0.12% is relatively modest, CISA's inclusion in the KEV catalog confirms that exploitation is occurring in real-world attacks.
Exploit Maturity
CVE-2025-6558 has confirmed active exploitation. CISA has added this vulnerability to the Known Exploited Vulnerabilities catalog, indicating real-world attacks leveraging this sandbox escape. The advisory details have been disclosed through multiple channels, including the Chrome stable channel update and several Apple security advisories published via seclists.org. While the Chromium issue tracker entry (427162086) is access-restricted, the cross-platform nature of this vulnerability — affecting both Chromium and WebKit rendering engines — suggests it targets a fundamental graphics processing component shared across browser implementations. The EPSS score of 0.12% at the 31st percentile is lower than other KEV entries, but the confirmed active exploitation and sandbox escape capability make immediate patching essential.
Remediation
-
Update all affected browsers and operating systems immediately. Upgrade Google Chrome to version 138.0.7204.157 or later. Update Apple Safari to version 18.6 or later, iOS/iPadOS to 18.6 or later, macOS to Sequoia 15.6 or later, visionOS to 2.6 or later, and watchOS to 11.6 or later. Update WebKitGTK and WPE WebKit to version 2.48.0 or later on Linux systems.
-
Enable automatic browser updates. Ensure that Chrome, Safari, and operating system auto-update mechanisms are enabled across all managed devices to receive security patches promptly when they are released.
-
Implement browser isolation controls. Deploy browser isolation solutions or network-level content inspection to reduce the risk of users encountering malicious web pages that exploit rendering engine vulnerabilities. Consider restricting access to untrusted websites through URL filtering.
-
Monitor endpoint detection systems. Review EDR/XDR alerts for indicators of sandbox escape attempts, including unusual child process creation from browser processes, unexpected file system access patterns, or privilege escalation from browser-context processes.
-
Audit Debian and Linux WebKit packages. For Debian Linux 11.0 and similar distributions, ensure that WebKitGTK and WPE WebKit packages are updated through the distribution's package manager, as these are often updated separately from the browser itself.
Technical Details
CVE-2025-6558 is an improper input validation vulnerability in the ANGLE and GPU components of Google Chromium, described by the CVSS v3.1 vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. ANGLE (Almost Native Graphics Layer Engine) is the cross-platform graphics abstraction layer used by Chrome, and the GPU process handles hardware-accelerated rendering operations. The vulnerability occurs when untrusted input from a crafted HTML page is processed by the ANGLE/GPU rendering pipeline without sufficient validation, allowing an attacker to trigger memory corruption or logic errors that break out of the browser sandbox. A sandbox escape is particularly severe because modern browsers rely on process isolation as a core security boundary — once bypassed, the attacker gains the ability to execute arbitrary code with the privileges of the user's operating system account. The vulnerability's presence in both Chromium and WebKit-based browsers suggests the flaw exists in a shared graphics processing code path, potentially in the handling of WebGL or GPU shader programs.
Frequently Asked Questions
Is CVE-2025-6558 being actively exploited?
Yes. CISA has added CVE-2025-6558 to the Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. While the EPSS score of 0.12% is relatively low, the sandbox escape capability makes this vulnerability highly valuable to attackers.
What products are affected by CVE-2025-6558?
Google Chrome prior to version 138.0.7204.157, Apple Safari prior to 18.6, iOS/iPadOS prior to 18.6, macOS prior to 15.6, visionOS prior to 2.6, watchOS prior to 11.6, Debian Linux 11.0, WebKitGTK prior to 2.48.0, and WPE WebKit prior to 2.48.0 are all affected.
How do I fix CVE-2025-6558?
Update Google Chrome to version 138.0.7204.157 or later, and update all Apple platforms and WebKit-based browsers to their latest security releases. Enable automatic updates across all managed devices to ensure timely patching.
How severe is CVE-2025-6558?
CVE-2025-6558 is rated High with a CVSS v3.1 score of 8.8. The sandbox escape capability elevates the real-world impact significantly, as successful exploitation grants full system access. The vulnerability affects billions of devices across Chrome, Safari, and Apple platforms.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.