Intel

CVE-2025-6558

Google Chromium — Google Chromium ANGLE and GPU Improper Input Validation Vulnerability

criticalKEV: actively exploitedPoCEPSS 9.6%

Description

Insufficient validation of untrusted input in ANGLE and GPU in Google Chrome prior to 138.0.7204.157 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

Source: BSI_CSAFBSICISA_KEVNVDCVEORGCVELISTV5

Response & Mitigation

Why act now?

Prioritisation rationale

CVE-2025-6558 allows an unauthenticated remote attacker to escape the Chromium sandbox and execute code at the browser process privilege level simply by luring a user to a crafted web page — the CVSS vector AV:N/AC:L/PR:N/UI:R reflects low complexity and no required privileges, making mass exploitation via phishing or malvertising straightforward. An EPSS score at the 95th percentile signals that the security community assesses exploit development as highly likely relative to the full CVE population. For NIS2-obligated organisations whose staff routinely browse the web — spanning energy, healthcare, financial infrastructure, and public administration — the exposed attack surface is effectively organisation-wide. Treat patch deployment as a P1 action within the first available maintenance window after the KEV addition date of 22 July 2025; any system that cannot be patched immediately must be subject to the browser hardening and network controls described above until full patch compliance is achieved.

Runbook · Step 1

Immediate response (0-24 h)

  • Google Chrome: Update to version 138.0.7204.157 or later immediately — push via Chrome's built-in updater, WSUS, Intune, or Jamf; verify rollout completion within 4 hours through your endpoint management console.
  • Microsoft Edge (Chromium-based): Check Microsoft's security advisory for the corresponding Edge patch — Edge channel updates typically follow Chrome releases within 24–72 hours; apply as soon as available.
  • Apple platforms: Update iOS/iPadOS to 18.6, macOS to 15.6, watchOS to 11.6, visionOS to 2.6, and Safari to 18.6 via System Settings → Software Update or MDM push.
  • Opera and other Chromium-based browsers: Review each vendor's advisory; restrict use on high-value systems (KRITIS segments, admin workstations, PAWs) until a patch is confirmed available and deployed.
  • Redirect all browsing on privileged systems (jump hosts, OT boundary workstations) to a patched browser or a non-Chromium alternative until patch compliance is confirmed.
  • Enforce automatic browser updates via Group Policy or MDM and validate compliance status across the fleet before the end of the business day.

Runbook · Step 2

Mitigation layers

  • Network segmentation: Restrict outbound HTTP/HTTPS (ports 80/443) from privileged and OT-adjacent workstations to an explicit allowlist via an authenticating proxy; block unrestricted internet access on those systems.
  • Proxy/WAF filtering: Configure SSL-inspecting proxy (e.g. Zscaler, Squid) to block or quarantine HTML responses containing embedded WebGL or ANGLE-heavy content from uncategorised or newly registered domains.
  • Browser hardening via Group Policy: Disable WebGL (WebGLEnabled = false) and GPU rasterisation (GpuRasterizationEnabled = false) through Chrome/Edge policy templates where operationally acceptable — this significantly reduces the ANGLE attack surface.
  • Least privilege: Confirm browser processes run under standard user accounts; enforce AppLocker or WDAC rules to prevent child processes spawned from the browser from accessing sensitive filesystem paths or executing from user-writable directories.
  • EDR containment: On endpoints where patching is delayed, activate an EDR containment rule blocking outbound network connections initiated by any process that is a child of the browser outside the expected sandbox process tree.
  • Debian Linux: Run apt-get install --only-upgrade chromium once the patched package is available in the repository; if the package is not yet updated, consider removing Chromium and substituting a patched alternative browser for the interim period.

Runbook · Step 3

Detection rules

  • Sysmon EID 1 / EDR process ancestry: Alert on any child process of chrome.exe, msedge.exe, or opera.exe that spawns cmd.exe, powershell.exe, or wscript.exe directly from a renderer process (identifiable by --renderer in the parent command line). 
    Sigma-shape: process_creation | where ParentImage endswith 'chrome.exe' AND Image in ('cmd.exe','powershell.exe','wscript.exe')
  • Windows Event ID 4688 / Sysmon EID 1: Process creation with MandatoryLabel = High or System integrity level where the parent is a browser renderer process — a strong indicator of sandbox escape.
  • Network telemetry (Zeek/Suricata): Outbound connections from browser processes to external IPs on non-standard ports (not 80/443) following a visit to an external URL — potential post-escape C2 beacon. 
    Suricata: alert tcp $HOME_NET any -> $EXTERNAL_NET !80:443 (msg:"Browser process non-standard port egress"; app-layer-proto:!http; sid:9000001;)
  • EDR file activity: Write access to %APPDATA%, %TEMP%, or %PROGRAMDATA% by a browser process immediately followed by execution of the newly created file — classic post-sandbox-escape dropper pattern.
  • Linux auditd: execve syscall where the calling process has a parent PID belonging to a Chromium renderer and the effective UID does not match the expected sandbox UID: -a always,exit -F arch=b64 -S execve -k chromium_escape.

Metrics

Severity
critical
Priority score
212.03
KEV status
Actively exploited
Exploit maturity
actively exploited (KEV)
XIEM Effective CVSS
8.8
Source: nvd-v3
CVSS v3
8.8
CVSS v4
—
EPSS percentile
95.2 %
Critical — this CVE ranks in the top fifth of all CVEs scored today (rank ≥ 80%).
EPSS score
9.6 %
Moderate — model estimates 1-10% exploitation likelihood.
Published
2025-07-22 00:00 UTC
CWE
CWE-20

Weakness classes (CWE)

  • CWE-20Class

    Improper Input Validation

    The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

    cwe.mitre.org →

Affected operating systems

  • linux

    debian / debian_linux11.0

  • macos

    apple / macos

  • mobile

    apple / iphone_os

  • other

    apple / ipados

  • other

    apple / visionos

  • other

    apple / watchos

Affected products

Products and version ranges extracted from the vendor/CERT advisory. A range like „<4.14.6“ implies the update recommendation „upgrade to 4.14.6 or later“.

  • apple

    safari18.6

  • google

    chrome138.0.7204.157

  • webkitgtk

    webkitgtk2.48.0

  • wpewebkit

    wpe_webkit2.48.0

Public exploit references

Public proof-of-concepts and detection templates for this vulnerability. Maturity ranges from reported PoCs through working detection scripts up to fully weaponized exploit modules. NEOSEC mirrors the code internally for forensic analysis; externally we only link to the original sources.

References & sources

IDCVE-2025-6558