CVE-2025-6554: Google Chrome Security Flaw Actively Exploited – Update Immediately

Google has released a Stable Channel Update for Chrome addressing a high-severity vulnerability, CVE-2025-6554, affecting the V8 JavaScript engine. This type confusion vulnerability was discovered by Clément Lecigne from Google’s Threat Analysis Group and was actively exploited in the wild prior to mitigation.

Severity Level: High

Vulnerability Details

• CVE ID: CVE-2025-6554
• Vulnerability Type: Type Confusion
• Component Affected: V8 JavaScript engine
• Weakness Class: CWE-843 – Access of Resource Using Incompatible Type (‘Type Confusion’)

Type confusion vulnerabilities occur when a program allocates or accesses a resource assuming it is of one type, while it actually is of a different type. This can lead to undefined behavior such as memory corruption, crashes, or arbitrary code execution.

The root cause is likely an incorrect type assertion or casting in V8’s internal object representation logic, allowing attackers to:

• Treat one object as another incompatible type.
• Perform unauthorized memory manipulation.
• Execute attacker-controlled code outside the intended sandbox.

While specific details are not public, type confusion flaws often originate from JIT optimizations or DOM-to-JS bindings with flawed type assumptions.

• Exploitation of the Vulnerability:

• Google confirmed in-the-wild exploitation but has not shared:
  • Exploit vectors
  • Payload delivery mechanisms
  • Threat actor attribution

However, based on prior patterns and TAG’s involvement, exploitation may include:

• Delivery via malicious JavaScript hosted on compromised or attacker-controlled sites.
• Use of exploit chains combining this flaw with sandbox escapes or privilege escalations.

The exploit likely allows arbitrary code execution, enabling spyware deployment or browser hijacking.

• Affects Google Chrome versions prior to 138.0.7204.96/.97 (Windows), 138.0.7204.92/.93 (Mac) and 138.0.7204.92 (Linux)

• Fixed in versions 138.0.7204.96/.97 for Windows, 138.0.7204.92/.93 for Mac and 138.0.7204.92 for Linux

Recommendations

1. Chrome users should immediately update their browser to the latest version.
2. Enforce auto-updates for Chrome in enterprise environments.
3. Enable Enhanced Safe Browsing mode for real-time protection.

Source:

• https://chromereleases.googleblog.com/2025/06/stable-channel-update-for-desktop_30.html

Enjoyed reading this Threat Intelligence Advisory? Stay updated with our latest exclusive content by following us on Twitter and LinkedIn

No related posts found.