Google has released an emergency security update for Chrome, addressing six vulnerabilities, including a high-severity flaw currently exploited in the wild.
The actively targeted issue, tracked as CVE-2025-6558, stems from improper validation of untrusted input in Chrome's ANGLE and GPU components.
The vulnerability was discovered and reported by Clément Lecigne and Vlad Stolyarov of Google's Threat Analysis Group (TAG) on June 23, 2025. TAG is known for uncovering sophisticated threat campaigns, often linked to nation-state or advanced persistent threat (APT) actors. While Google has not disclosed exploitation details, the company's acknowledgment of active exploitation strongly suggests that attackers may be leveraging the flaw for sandbox escapes, a critical step in full browser exploitation chains.
CVE-2025-6558 affects Chrome versions prior to 138.0.7204.157 and impacts all major desktop platforms, including Windows, macOS, and Linux. According to the brief advisory, the flaw resides in how Chrome's ANGLE and GPU subsystems handle untrusted input. ANGLE (Almost Native Graphics Layer Engine) is an abstraction layer used in Chromium to translate WebGL and other graphics APIs to platform-specific backends like Direct3D or OpenGL.
The insufficient input validation could allow a remote attacker to craft a malicious HTML page capable of executing arbitrary code within the browser's GPU process. If paired with other vulnerabilities, particularly those allowing memory corruption or privilege escalation, attackers could potentially escape the browser sandbox, execute code on the host system, or spy on users.
Chrome 138.0.7204.157/.158, which patches this and five other security issues, is now rolling out to desktop users. Notably, another high-severity flaw in V8 (CVE-2025-7656) reported by independent researcher Shaheen Fazim and a use-after-free issue in WebRTC (CVE-2025-7657) reported by GitHub user jakebiles are also included in the fix list, though neither is known to be exploited at this time.
Google Chrome remains the world's most widely used browser, with over 3 billion users. Its architecture relies heavily on sandboxing to compartmentalize components and reduce the impact of security flaws. A successful sandbox escape, particularly through GPU processing or ANGLE translation layers, could grant attackers broader access to the underlying operating system.
Users are strongly advised to update Chrome to version 138.0.7204.157 or later as soon as possible. This can be done by navigating to Menu > Settings > About Chrome, which will automatically trigger an update check. After the download is finished, click ‘Relaunch' for the update to be applied.
Leave a Reply