Google · Chromium
CVE-2025-6558
Google Chromium ANGLE and GPU Improper Input Validation Vulnerability
O que é
Insufficient validation of untrusted input in ANGLE and GPU in Google Chrome prior to 138.0.7204.157 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
CISA: Google Chromium contains an improper input validation vulnerability in ANGLE and GPU. This vulnerability could allow a remote attacker to potentially perform a sandbox escape via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
O que fazer
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Prazo para as agências federais dos EUA: 12 de agosto de 2025
Mais falhas exploradas de Google
| Adicionado | Vulnerabilidade | Produto | Gravidade | Chance de ataque |
|---|---|---|---|---|
| 17 de fev. de 2026 | CSS Use-After-Free | Chromium | Alto 8,8 | 55% |
| 12 de dez. de 2025 | Out of Bounds Memory Access | Chromium | Alto 8,8 | 55% |
| 13 de mai. de 2024 | Visuals Use-After-Free | Chromium | Crítica 9,6 | 8,3% |
| 3 de nov. de 2021 | Race Condition | Chromium | Alto 8,8 | 24% |
| 3 de nov. de 2021 | Information Disclosure | Chromium | Média 6,5 | 20% |
| 27 de out. de 2026 | Unchecked Return Value | Brotli | Crítica 9,2 | 55% |
| 16 de set. de 2026 | Improper Authorization | Pixel | Alto 8,8 | 0,6% |
| 9 de set. de 2026 | Out of Bounds Write | Chromium V8 | Alto 8,8 | 3,5% |
Fontes: Known Exploited Vulnerabilities (CISA, domínio público), CVE records (cve.org) e EPSS (FIRST). A chance de ataque é a estimativa EPSS de que alguém tente explorar a falha nos próximos 30 dias.