U.S. CISA adds Google Chromium V8 flaw to its Known Exploited Vulnerabilities catalog
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2025-6554 | Type Confusion in Google Chrome V8 Allows Arbitrary Read/Write (Actively Exploited) CVE-2025-6554 is a type confusion vulnerability (CWE-843) in the V8 JavaScript engine of Google Chrome, affecting versions prior to 138.0.7204.96. A remote attacker can trigger it by inducing a user to open a crafted HTML page, and the flaw permits arbitrary read and write within the browser renderer process. Successful exploitation yields high confidentiality and integrity impact, and V8 type confusion bugs are commonly used as the first stage toward a full browser compromise. Any user of an unpatched Chrome or Chromium-based browser is exposed, and the flaw is being actively exploited in the wild as a zero-day; CISA added it to the Known Exploited Vulnerabilities catalog on 2025-07-02. Ransomware usage is not confirmed (reported as unknown), and no public proof-of-concept is known. Do: Update Chrome to 138.0.7204.96 or later (check chrome://settings/help) and restart the browser to load the patched V8; users of Chromium-derived browsers (Edge, Brave, Opera, etc.) should install their vendor's corresponding V8 patch. Organizations must apply vendor mitigations or follow BOD 22-01 guidance given the KEV listing, and should inventory managed browsers and force-update policies to confirm rollout. | 8.1 | 13% | KEV |
| mass≈3+ billion Chrome users; effectively every desktop Chrome installation running a build older than 138.0.7204.96 |
Full article560 words · extracted from securityaffairs.com · click to collapse
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Chromium V8 vulnerability to its Known Exploited Vulnerabilities catalog.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added Chromium V8 vulnerability, tracked as CVE-2025-6554, to its Known Exploited Vulnerabilities (KEV) catalog.
Last week, Google released security patches to address the Chrome vulnerability CVE-2025-6554 for which an exploit is available in the wild.
“Type confusion in V8 in Google Chrome prior to 138.0.7204.96 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. (Chromium security severity: High)” reads the description published by NIST.
The vulnerability CVE-2025-6554 is a type-confusing issue that resides in the V8 JavaScript and WebAssembly engine.
“This issue was mitigated on 2025-06-26 by a configuration change pushed out to Stable channel across all platforms.” reads the advisory. “Google is aware that an exploit for CVE-2025-6554 exists in the wild.”
A type confusion vulnerability occurs when a program mistakenly treats a piece of data as a different type than it actually is, leading to unintended behavior. This mismatch can cause memory corruption, crashes, or allow an attacker to execute arbitrary code.
Clément Lecigne of Google’s Threat Analysis Group discovered the vulnerability on June 25, 2025. Chrome Stable has been updated to version 138.0.7204.x for Windows, Mac, and Linux, rolling out in the coming days/weeks.
The existence in the wild of an exploit for this flaw suggests that threat actors, state-sponsored hackers or commercial spyware vendors, may have used it in targeted attacks
CVE-2025-6554 is the fourth Chrome zero-day patched by Google in 2025.
Google released security patches to address a Chrome vulnerability, tracked as CVE-2025-6554, for which an exploit is available in the wild.
“Type confusion in V8 in Google Chrome prior to 138.0.7204.96 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. (Chromium security severity: High)” reads the description published by NIST.
The vulnerability CVE-2025-6554 is a type-confusing issue that resides in the V8 JavaScript and WebAssembly engine.
“This issue was mitigated on 2025-06-26 by a configuration change pushed out to Stable channel across all platforms.” reads the advisory. “Google is aware that an exploit for CVE-2025-6554 exists in the wild.”
A type confusion vulnerability occurs when a program mistakenly treats a piece of data as a different type than it actually is, leading to unintended behavior. This mismatch can cause memory corruption, crashes, or allow an attacker to execute arbitrary code.
Clément Lecigne of Google’s Threat Analysis Group discovered the vulnerability on June 25, 2025. Chrome Stable has been updated to version 138.0.7204.x for Windows, Mac, and Linux, rolling out in the coming days/weeks.
The existence in the wild of an exploit for this flaw suggests that threat actors, state-sponsored hackers or commercial spyware vendors, may have used it in targeted attacks
CVE-2025-6554 is the fourth Chrome zero-day patched by Google in 2025.
According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.
Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure.
CISA orders federal agencies to fix the vulnerabilities by July 23, 2025.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, CISA)
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/179682/hacking/u-s-cisa-adds-google-chromium-v8-flaw-to-its-known-exploited-vulnerabilities-catalog.html