This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.
[TLP:CLEAR] Google Chrome fixes 6 vulnerabilities
Google fixes 6 vulnerabilities in Google Chrome, one of which is already being actively exploited [1][2]. The fix is available in version 138.0.7204.157/.158 for Windows and macOS. In the coming days/weeks it will also be available in version 138.0.7204.157 for Linux. A description of selected vulnerabilities can be found below [1].
An unauthenticated remote attacker is, via a specially crafted HTML page, due to insufficient input validation in the ANGLE software layer, allowed to escape the sandbox and execute code within the browser's GPU process. The vulnerability is already being actively exploited [3][2].
The vulnerability is present in product:
- Google Chrome; <138.0.7204.157;
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
More information:
- CVE-2025-6558 at cve.org, NVD
- CWE-20: Improper Input Validation at cwe.mitre.org
The vulnerability was publicly disclosed 15. 7. 2025.
An unauthenticated remote attacker is, via a specially crafted HTML page, due to an integer overflow in the V8 JavaScript engine, allowed to corrupt data in memory [3].
The vulnerability is present in product:
- Google Chrome; <138.0.7204.157;
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L
More information:
- CVE-2025-7656 at cve.org, NVD
- CWE-190: Integer Overflow or Wraparound at cwe.mitre.org
The vulnerability was publicly disclosed 15. 7. 2025.
An unauthenticated remote attacker is, via a specially crafted HTML page, due to a use-after-free vulnerability in the WebRTC component, allowed to corrupt data in memory [3].
The vulnerability is present in product:
- Google Chrome; <138.0.7204.157;
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L
More information:
- CVE-2025-7657 at cve.org, NVD
- CWE-416: Use After Free at cwe.mitre.org
The vulnerability was publicly disclosed 15. 7. 2025.
Links
By CESNET, z.s.p.o. Michaela Ručková on 18. 7. 2025.