CVE-2025-6558: Google Chromium ANGLE and GPU Improper Input Validation Vulnerability

Q: How do I fix CVE-2025-6558?

chrome: upgrade to 138.0.7204.157; debian linux: mitigate or apply the listed mitigation; safari: upgrade to 18.6. Exact commands for each OS are on this page.

Q: Is CVE-2025-6558 being exploited?

Yes. CVE-2025-6558 is on the CISA Known Exploited Vulnerabilities list, so treat it as patch-now.

Q: What does CVE-2025-6558 affect?

CVE-2025-6558 affects chrome, debian linux, safari. Severity is high (CVSS 8.8). Insufficient validation of untrusted input in ANGLE and GPU in Google Chrome prior to 138.0.7204.157 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

Q: How urgent is CVE-2025-6558?

Priority 90/100. High severity; EPSS top 4%: very likely to be exploited; Exploited in the wild (CISA KEV); Public exploit reference; On your watchlist

Patch now

HIGH 8.8EXPLOITEDWATCHLISTUPGRADEMITIGATEUPGRADE

CVE-2025-6558 is a high-severity flaw (CVSS 8.8) affecting chrome, debian linux, safari, reported as exploited in the wild. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

Insufficient validation of untrusted input in ANGLE and GPU in Google Chrome prior to 138.0.7204.157 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

Why this priority

High severity
EPSS top 4%: very likely to be exploited
Exploited in the wild (CISA KEV)
Public exploit reference
On your watchlist

A fixed release or distro patch exists.

Risk facts

CVSS score	8.8 (High)
Attack vector	Network (remote)
Attack complexity	Low
Privileges needed	None
User interaction	Required
EPSS exploit chance	10.9% (top 4%)
CISA exploited list	Yes, fix due 2025-08-12
Weakness	CWE-20
Published	2025-07-15
Last modified	2026-10-01

Publisher (CNA): Chrome · Vendor: apple · debian · google

Last updated 2026-10-01 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2025-07-15 18:15 UTCPublished CVE record published
2025-07-22Exploited Added to the CISA Known Exploited Vulnerabilities list
2025-08-12Deadline CISA due date for US federal agencies to patch
2026-10-01 12:00 UTCUpdated Record last modified

google chrome UPGRADE

Affected: < 138.0.7204.157

Fixed in: 138.0.7204.157

Safe to downgrade to: no unaffected older release

1. Check installed version

apt-cache policy chrome || rpm -q chrome || chrome --version

2. UPGRADE to 138.0.7204.157 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade chrome

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade chrome

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

debian debian linux MITIGATE

Affected: 11.0

Fixed in: no fixed release known

Safe to downgrade to: a release before 11.0

Check your OS release

cat /etc/os-release; uname -r

Debian / Ubuntu

sudo apt update && sudo apt full-upgrade

RHEL / Amazon Linux / Fedora

sudo dnf upgrade --refresh

Windows

Install the latest cumulative update from Windows Update

If no patch exists yet

OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure.

apple safari UPGRADE

Affected: < 18.6

Fixed in: 18.6

Safe to downgrade to: no unaffected older release

1. Check installed version

apt-cache policy safari || rpm -q safari || safari --version

2. UPGRADE to 18.6 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade safari

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade safari

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

apple ipados UPGRADE

Affected: < 18.6

Fixed in: 18.6

Safe to downgrade to: no unaffected older release

Check your OS release

cat /etc/os-release; uname -r

Debian / Ubuntu

sudo apt update && sudo apt full-upgrade

RHEL / Amazon Linux / Fedora

sudo dnf upgrade --refresh

Windows

Install the latest cumulative update from Windows Update

If no patch exists yet

OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure.

apple iphone os UPGRADE

Affected: < 18.6

Fixed in: 18.6

Safe to downgrade to: no unaffected older release

Check your OS release

cat /etc/os-release; uname -r

Debian / Ubuntu

sudo apt update && sudo apt full-upgrade

RHEL / Amazon Linux / Fedora

sudo dnf upgrade --refresh

Windows

Install the latest cumulative update from Windows Update

If no patch exists yet

OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure.

apple macos UPGRADE

Affected: < 15.6

Fixed in: 15.6

Safe to downgrade to: no unaffected older release

Check your OS release

cat /etc/os-release; uname -r

Debian / Ubuntu

sudo apt update && sudo apt full-upgrade

RHEL / Amazon Linux / Fedora

sudo dnf upgrade --refresh

Windows

Install the latest cumulative update from Windows Update

If no patch exists yet

OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure.

Exact fixes by distribution

A distro patch exists: prefer upgrading over downgrading.

Fedora 46 · R · FIXED · 4.6.2-1.fc46 · FEDORA-2026-1dd919a262 · source

sudo dnf upgrade --advisory=FEDORA-2026-1dd919a262

Fedora ELN · perl-Mail-AuthenticationResults · FIXED · 2.20261029-1.eln159 · FEDORA-2026-a2c11d7da6 · source

sudo dnf upgrade --advisory=FEDORA-2026-a2c11d7da6

Ubuntu 22.04 · chromium-browser · NOT AFFECTED

Ubuntu 24.04 · chromium-browser · NOT AFFECTED

Ubuntu 25.04 · chromium-browser · NOT AFFECTED

Ubuntu 25.10 · chromium-browser · NOT AFFECTED

Ubuntu 22.04 · webkit2gtk · FIXED · 2.48.5-0ubuntu0.22.04.1

sudo apt update && sudo apt install --only-upgrade webkit2gtk dpkg --compare-versions "$(dpkg-query -W -f='${Version}' webkit2gtk)" ge "2.48.5-0ubuntu0.22.04.1" && echo PATCHED || echo STILL-VULNERABLE

Debian 12 · chromium · FIXED · 138.0.7204.157-1~deb12u1

sudo apt update && sudo apt install --only-upgrade chromium dpkg --compare-versions "$(dpkg-query -W -f='${Version}' chromium)" ge "138.0.7204.157-1~deb12u1" && echo PATCHED || echo STILL-VULNERABLE

Debian 13 · chromium · FIXED · 138.0.7204.157-1

sudo apt update && sudo apt install --only-upgrade chromium dpkg --compare-versions "$(dpkg-query -W -f='${Version}' chromium)" ge "138.0.7204.157-1" && echo PATCHED || echo STILL-VULNERABLE

Debian 12 · webkit2gtk · FIXED · 2.48.5-1~deb12u1

sudo apt update && sudo apt install --only-upgrade webkit2gtk dpkg --compare-versions "$(dpkg-query -W -f='${Version}' webkit2gtk)" ge "2.48.5-1~deb12u1" && echo PATCHED || echo STILL-VULNERABLE

Debian 13 · webkit2gtk · FIXED · 2.48.5-1~deb13u1

sudo apt update && sudo apt install --only-upgrade webkit2gtk dpkg --compare-versions "$(dpkg-query -W -f='${Version}' webkit2gtk)" ge "2.48.5-1~deb13u1" && echo PATCHED || echo STILL-VULNERABLE

RHEL 7 Extended Lifecycle Support · webkitgtk4 · FIXED · webkitgtk4-2.48.5-1.el7_9

sudo dnf upgrade --advisory=RHSA-2025:15729 rpm -q webkitgtk4

RHEL 8 · webkit2gtk3 · FIXED · webkit2gtk3-2.48.5-1.el8_10

sudo dnf upgrade --advisory=RHSA-2025:13780 rpm -q webkit2gtk3

RHEL 8.2 Advanced Update Support · webkit2gtk3 · FIXED · webkit2gtk3-2.48.5-1.el8_2

sudo dnf upgrade --advisory=RHSA-2025:14432 rpm -q webkit2gtk3

RHEL 8.4 Advanced Mission Critical Update Support · webkit2gtk3 · FIXED · webkit2gtk3-2.48.5-1.el8_4

sudo dnf upgrade --advisory=RHSA-2025:14486 rpm -q webkit2gtk3

RHEL 8.4 Extended Update Support Long-Life Add-On · webkit2gtk3 · FIXED · webkit2gtk3-2.48.5-1.el8_4

sudo dnf upgrade --advisory=RHSA-2025:14486 rpm -q webkit2gtk3

Alpine 3.22 · qt6-qtwebengine · FIXED · qt6-qtwebengine-6.8.3-r1

apk add --upgrade qt6-qtwebengine apk info -v qt6-qtwebengine

Alpine 3.23 · qt6-qtwebengine · FIXED · qt6-qtwebengine-6.9.1-r3

apk add --upgrade qt6-qtwebengine apk info -v qt6-qtwebengine

Alpine 3.24 · qt6-qtwebengine · FIXED · qt6-qtwebengine-6.9.1-r3

apk add --upgrade qt6-qtwebengine apk info -v qt6-qtwebengine

Public exploits and detection

Public code exists for this CVE. Treat unpatched systems as at risk, and only run PoCs in a lab.

GitHub PoC: DevBuiHieu/CVE-2025-6558-Proof-Of-Concept (7 stars)
GitHub PoC: gmh5225/CVE-2025-6558-exp (1 stars)
Write-up: issues.chromium.org/issues/427162086

Verify at the official source NVD · CVE Program · CISA KEV catalog · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2025-6558?

chrome: upgrade to 138.0.7204.157; debian linux: mitigate or apply the listed mitigation; safari: upgrade to 18.6. Exact commands for each OS are on this page.

Is CVE-2025-6558 being exploited?

Yes. CVE-2025-6558 is on the CISA Known Exploited Vulnerabilities list, so treat it as patch-now.

What does CVE-2025-6558 affect?

CVE-2025-6558 affects chrome, debian linux, safari. Severity is high (CVSS 8.8). Insufficient validation of untrusted input in ANGLE and GPU in Google Chrome prior to 138.0.7204.157 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

How urgent is CVE-2025-6558?

Priority 90/100. High severity; EPSS top 4%: very likely to be exploited; Exploited in the wild (CISA KEV); Public exploit reference; On your watchlist

Software pages

Debian vulnerabilities · macOS vulnerabilities · Safari vulnerabilities · Google Chrome vulnerabilities · Chromium vulnerabilities · Apple Safari and WebKit vulnerabilities

Related CVEs

CVE-2026-118316 CRITICAL 9.6 UPGRADE Improper input validation in V8 in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potential
CVE-2026-118318 MEDIUM 4.3 UPGRADE Improper access control in V8 in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to read memory
CVE-2026-118319 MEDIUM 4.3 UPGRADE Memory corruption in Skia in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially rea
CVE-2026-118321 CRITICAL 9.6 UPGRADE Improper input validation in Core in Google Chrome on on Android prior to 156.0.8078.73 allowed a remote attac
CVE-2026-118322 MEDIUM 4.3 UPGRADE Memory corruption in ANGLE in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially re

References

← Back to latest CVEs