CVE-2025-6554 marks the fifth actively exploited Chrome Zero-Day patched by Google in 2025

CVE-2025-6554 marks the fifth actively exploited Chrome Zero-Day patched by Google in 2025

Pierluigi Paganini
July 16, 2025

Google released security patches to address multiple Chrome vulnerabilities, including one flaw that has been exploited in the wild.

Google released fixes for six Chrome flaws, including one actively exploited in the wild tracked as CVE-2025-6558 (CVSS score of 8.8). CVE-2025-6558 stems from improper validation of untrusted input in Chrome’s ANGLE and GPU components.

Clément Lecigne and Vlad Stolyarov of Google’s Threat Analysis Group reported the vulnerability on June 23, 2025. Google’s TAG team investigates attacks by nation-state actors and commercial spyware vendors. One of these threat actors likely exploited the issue in the wild.

“Google is aware that an exploit for CVE-2025-6558 exists in the wild.” reads the advisory published by Google.

Google also fixed the following vulnerabilities:

• [$7000][425583995] High CVE-2025-7656: Integer overflow in V8. Reported by Shaheen Fazim on 2025-06-17
• [TBD][427681143] High CVE-2025-7657: Use after free in WebRTC. Reported by jakebiles on 2025-06-25

In early July, Google released security patches to address another Chrome vulnerability, tracked as CVE-2025-6554, for which an exploit exists in the wild.

The vulnerability CVE-2025-6554 is a type-confusing issue that resides in the V8 JavaScript and WebAssembly engine.

“This issue was mitigated on 2025-06-26 by a configuration change pushed out to Stable channel across all platforms.” reads the advisory. “Google is aware that an exploit for CVE-2025-6554 exists in the wild.”

A type confusion vulnerability occurs when a program mistakenly treats a piece of data as a different type than it actually is, leading to unintended behavior. This mismatch can cause memory corruption, crashes, or allow an attacker to execute arbitrary code.

Clément Lecigne of Google’s Threat Analysis Group discovered the vulnerability on June 25, 2025.

CVE-2025-6554 is the fourth Chrome zero-day patched by Google in 2025. The IT giant also addressed these zero-day vulnerabilities this year:

• CVE-2025-5419 – The vulnerability is an out-of-bounds read and write in the V8 JavaScript engine in Google Chrome prior. An attacker can exploit the flaw to trigger a heap corruption via a crafted HTML page. The flaw is actively exploited in the wild.
• CVE-2025-4664 – The vulnerability is a Chrome browser vulnerability that could lead to full account takeover. Google is aware that an exploit for CVE-2025-5419 exists in the wild.
• CVE-2025-2783 – The vulnerability is an incorrect handle provided in unspecified circumstances in Mojo on Windows. Kaspersky researchers Boris Larin (@oct0xor) and Igor Kuznetsov (@2igosha) reported the vulnerability on March 20, 2025. Google released out-of-band fixes to address the high-severity security vulnerability in the Chrome browser for Windows. The flaw was actively exploited in attacks targeting organizations in Russia.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Google)