CVE-2025-6558

HIGH | Platform: tvOS | Changelog

CVE Details

Description

Insufficient validation of untrusted input in ANGLE and GPU in Google Chrome prior to 138.0.7204.157 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

CVSS 3.1 Score

Metric	Value
Base Score	8.8 (HIGH)
Vector	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H`

Weakness

CWE-20

References

Apple Security Advisory
NVD Entry
https://chromereleases.googleblog.com/2025/07/stable-channel-update-for-desktop_15.html (Release Notes)
https://issues.chromium.org/issues/427162086 (Issue Tracking, Permissions Required)
http://seclists.org/fulldisclosure/2025/Aug/0 (Third Party Advisory)
http://seclists.org/fulldisclosure/2025/Jul/30 (Third Party Advisory)
http://seclists.org/fulldisclosure/2025/Jul/32 (Third Party Advisory)
http://seclists.org/fulldisclosure/2025/Jul/35 (Third Party Advisory)
http://seclists.org/fulldisclosure/2025/Jul/37 (Third Party Advisory)
http://www.openwall.com/lists/oss-security/2025/08/02/1 (Mailing List)