Google released security patches to address a Chrome vulnerability, tracked as CVE-2025-6554, for which an exploit exists in the wild.
Google released security patches to address a Chrome vulnerability, tracked as CVE-2025-6554, for which an exploit is available in the wild.
“Type confusion in V8 in Google Chrome prior to 138.0.7204.96 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. (Chromium security severity: High)” reads the description published by NIST.
The vulnerability CVE-2025-6554 is a type-confusing issue that resides in the V8 JavaScript and WebAssembly engine.
“This issue was mitigated on 2025-06-26 by a configuration change pushed out to Stable channel across all platforms.” reads the advisory. “Google is aware that an exploit for CVE-2025-6554 exists in the wild.”
A type confusion vulnerability occurs when a program mistakenly treats a piece of data as a different type than it actually is, leading to unintended behavior. This mismatch can cause memory corruption, crashes, or allow an attacker to execute arbitrary code.
Clément Lecigne of Google’s Threat Analysis Group discovered the vulnerability on June 25, 2025. Chrome Stable has been updated to version 138.0.7204.x for Windows, Mac, and Linux, rolling out in the coming days/weeks.
The existence in the wild of an exploit for this flaw suggests that threat actors, state-sponsored hackers or commercial spyware vendors, may have used it in targeted attacks
CVE-2025-6554 is the fourth Chrome zero-day patched by Google in 2025. The IT giant also addressed these zero-day vulnerabilities this year:
- CVE-2025-5419 – The vulnerability is an out-of-bounds read and write in the V8 JavaScript engine in Google Chrome prior. An attacker can exploit the flaw to trigger a heap corruption via a crafted HTML page. The flaw is actively exploited in the wild.
- CVE-2025-4664 – The vulnerability is a Chrome browser vulnerability that could lead to full account takeover. Google is aware that an exploit for CVE-2025-5419 exists in the wild.
- CVE-2025-2783 – The vulnerability is an incorrect handle provided in unspecified circumstances in Mojo on Windows. Kaspersky researchers Boris Larin (@oct0xor) and Igor Kuznetsov (@2igosha) reported the vulnerability on March 20, 2025. Google released out-of-band fixes to address the high-severity security vulnerability in the Chrome browser for Windows. The flaw was actively exploited in attacks targeting organizations in Russia.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
Pierluigi Paganini
(SecurityAffairs – hacking, Google)