Veille CVE
CVE-2025-6558
8.8 Élevée Exploitée activementCatalogue CISA KEV — Google Chromium ANGLE and GPU Improper Input Validation Vulnerability
Ajoutée le 22/07/2025 · Échéance de correction (agences US) : 12/08/2025
Action requise : Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Description
Insufficient validation of untrusted input in ANGLE and GPU in Google Chrome prior to 138.0.7204.157 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
Produits concernés
Scores CVSS
| Version | Score | Source | Vecteur |
|---|---|---|---|
| 3.1 | 8.8 Élevée | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
Faiblesses (CWE)
Références
- https://chromereleases.googleblog.com/2025/07/stable-channel-update-for-desktop_15.html Release Notes
- https://issues.chromium.org/issues/427162086 Issue TrackingPermissions Required
- http://seclists.org/fulldisclosure/2025/Aug/0 Third Party Advisory
- http://seclists.org/fulldisclosure/2025/Jul/30 Third Party Advisory
- http://seclists.org/fulldisclosure/2025/Jul/32 Third Party Advisory
- http://seclists.org/fulldisclosure/2025/Jul/35 Third Party Advisory
- http://seclists.org/fulldisclosure/2025/Jul/37 Third Party Advisory
- http://www.openwall.com/lists/oss-security/2025/08/02/1 Mailing List
- http://www.openwall.com/lists/oss-security/2026/09/30/18 Mailing List
- https://lists.debian.org/debian-lts-announce/2025/08/msg00015.html Mailing ListThird Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-6558 US Government Resource