CVE-2025-6558High· 8.8▾ Abyssal⚠ Exploited in the wildPoC availableInsufficient validation of untrusted input in ANGLE and GPU in Google Chrome prior to 138.0.7204.157 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
▾ Abyssal zone — Critical with a public exploit or in-the-wild use
impact 48.4 · likelihood 2.2 · exploitation 25
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 21.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Federal remediation due Aug 12, 2025
9.6%
Last analysed / modified upstream
9.6% → 11%
2 GitHub repos (last check)
Added to the CISA catalog on Jul 22, 2025. Federal remediation due Aug 12, 2025. View catalog ↗
Insufficient validation of untrusted input in ANGLE and GPU in Google Chrome prior to 138.0.7204.157 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
chrome < 138.0.7204.157debian_linux = 11.0safari < 18.6ipados < 18.6iphone_os < 18.6macos < 15.6visionos < 2.6watchos < 11.6wpe_webkit < 2.48.5webkitgtk < 2.48.5Upgrade past the affected range:
chrome 138.0.7204.157safari 18.6ipados 18.6iphone_os 18.6macos 15.6visionos 2.6watchos 11.6wpe_webkit 2.48.5webkitgtk 2.48.5Connected by shared product, vendor, weakness, or advisory.
CVE-2025-14174High· 8.8Out of bounds memory access in ANGLE in Google Chrome on Mac prior to 143.0.7499.110 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page
CVE-2025-13223High· 8.8Type Confusion in V8 in Google Chrome prior to 142.0.7444.175 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page
CVE-2026-118348High· 8.8Improper input validation in Skia in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page
CVE-2026-118331High· 8.8Improper input validation in FileAPI in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page
CVE-2026-118354High· 8.8Improper input validation in Skia in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page
CVE-2026-118321Critical· 9.6Improper input validation in Core in Google Chrome on on Android prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page