CVE-2025-6558

What it actually does

CVE-2025-6558 is an insufficient input validation flaw in Chromium's ANGLE/GPU handling. A malicious HTML page can supply crafted graphics/browser input that reaches GPU-related code paths and may allow code execution to break out of the browser sandbox. The practical risk is highest when combined with a renderer compromise or other browser exploit, because sandbox escapes convert a contained browser compromise into access to the broader user context. The issue affects Google Chrome before 138.0.7204.157 and is listed as actively exploited in the wild.

Why it matters to the business

Successful exploitation can let an attacker compromise user workstations through normal web browsing, potentially enabling credential theft, data access, malware deployment, lateral movement, and follow-on compromise of business applications. Because this vulnerability is in CISA KEV with active in-the-wild exploitation and a remediation due date of 2025-08-12, organizations should treat unpatched browsers and embedded Chromium/GPU consumers as high-priority exposure even though the EPSS score is moderate at 0.09185.

How an attack unfolds

An attacker hosts or injects a malicious web page containing crafted HTML and graphics content designed to trigger the ANGLE/GPU validation flaw. The victim is lured to the page through phishing, malvertising, compromised websites, watering-hole content, or malicious redirects. When the browser processes the page, the crafted content reaches vulnerable GPU/ANGLE code paths. If exploitation succeeds, the attacker escapes browser sandbox restrictions and gains the ability to run code with the privileges of the browser user or to continue a chain that installs malware, steals browser/session data, or executes post-exploitation tooling. Public threat context confirms active exploitation, but the supplied threat actor names appear to be vulnerability labels rather than attributable groups.

How to fix it

Update Google Chrome to 138.0.7204.157 or later across all platforms and ensure Chromium-based browsers or embedded Chromium runtimes consume the corresponding fixed Chromium build. Apply vendor updates for any affected downstream packages. Supplied fixed versions include: flightgear/flightgear GIT fixed in commit 7e2aaf061ee53b3b9a5cd840555b2deeecd1bd45; linux-lts for Alpaquita:23 fixed in 6.1.81-r0; linux-lts for Alpaquita:stream fixed in 6.6.58-r0 and 6.12.41-r0; linux-lts for Alpaquita:25 fixed in 6.12.41-r0. As temporary risk reduction only, restrict access to untrusted web content, disable or limit risky browser features such as GPU acceleration/WebGL where operationally feasible, enforce browser auto-update, and isolate high-risk browsing activity. Temporary mitigations should not replace patching because this issue is known to be exploited.

How to confirm the fix worked

Confirm browser versions through endpoint inventory, browser management consoles, package managers, or command-line checks and verify Chrome is 138.0.7204.157 or later. Validate that Chromium-based applications and embedded runtimes are rebuilt against fixed Chromium/ANGLE code. For supplied packages, verify flightgear includes commit 7e2aaf061ee53b3b9a5cd840555b2deeecd1bd45 and Alpaquita linux-lts packages are at or above the listed fixed package versions. Test that enterprise update policies are enabled and that rollback/pin controls do not hold browsers below the fixed release. Review vulnerability scanner output after patch deployment and separately confirm with software inventory because browser auto-updates may not be reflected immediately in periodic scans.

Typical attack path

1. Identify targets running vulnerable Chrome or Chromium-based software before 138.0.7204.157, or downstream packages that include vulnerable GPU/ANGLE code.
2. Prepare a malicious HTML page that exercises the vulnerable ANGLE/GPU input validation path.
3. Deliver the page through phishing, malvertising, compromised sites, watering-hole placement, or redirect infrastructure.
4. Wait for a victim to load the crafted page in a vulnerable browser.
5. Trigger the GPU/ANGLE flaw and escape browser sandbox protections.
6. Execute follow-on payloads in the user's context, such as credential theft, persistence setup, reconnaissance, or malware deployment.
7. Use stolen credentials or host access for lateral movement or access to sensitive applications and data.

How to detect it

There are no reliable public payload-specific indicators for this vulnerability. Detection should focus on behavioral evidence around browser exploitation: browser or GPU-process crashes followed by unusual process creation, network connections, credential access, persistence, or script execution. Review EDR telemetry for Chrome/Chromium processes spawning command shells, scripting engines, archive utilities, downloaders, or living-off-the-land binaries. Examine browser crash reports, Windows Event Logs, macOS Unified Logs, Linux syslog/journald, EDR process trees, proxy logs, DNS logs, and web gateway logs for visits to suspicious domains immediately before GPU/browser crashes or endpoint compromise. Look for high-risk delivery patterns such as malvertising redirects, phishing links, compromised websites, newly registered domains, and unusual referrer chains. Because exploitation is active in the wild, correlate vulnerable browser versions with suspicious browsing sessions and downstream post-exploitation events rather than relying on a single static IOC.

What your security team should do

• Treat this as an emergency browser patching item because it is CISA KEV-listed and actively exploited in the wild.
• Prioritize internet-facing user endpoints, privileged-user workstations, developer systems, VDI images, kiosks, and servers that browse or render untrusted web content.
• Force-update Chrome and Chromium-based browsers to 138.0.7204.157 or later; restart browsers after update so the fixed code is actually loaded.
• Search endpoint inventory for Chromium, Chrome, Electron-based applications, embedded browsers, and affected downstream packages that may carry vulnerable ANGLE/GPU code.
• Review telemetry for suspicious browser crashes, GPU process instability, unexpected child processes spawned by browsers, and post-browser-exploitation activity around the time users visited unknown or newly registered sites.
• Increase monitoring for credential theft, token theft, unusual sign-ins, and lateral movement from endpoints that were vulnerable during the exploitation window.
• If exploitation is suspected, isolate the endpoint, preserve browser crash dumps and endpoint telemetry, collect memory/disk artifacts where feasible, rotate exposed credentials, and investigate for persistence or follow-on payloads.
• Track CISA KEV compliance and document remediation against the 2025-08-12 due date.