CVE-2025-6554: Google Chrome V8 type confusion enables arbitrary read/write

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityRemote, unauthenticated-to-the-page type confusion in a widely deployed browser that is in CISA KEV with confirmed in-the-wild exploitation, though it requires user interaction and no ransomware use is documented.

What it is

Chrome before 138.0.7204.96 contains a type confusion flaw in the V8 JavaScript engine. A crafted HTML page can trigger the bug, letting an attacker read and write arbitrary memory in the renderer. It matters because it is a browser engine memory-corruption bug that CISA added to its Known Exploited Vulnerabilities catalog.

Impact

An attacker gains arbitrary read/write within the browser process, which is the standard primitive for escaping the sandbox or executing code. The CVSS vector shows high confidentiality and integrity impact with no availability impact.

Attack surface

Reached over the network by loading a crafted HTML page; the vector is AV:N/AC:L/PR:N/UI:R, so no authentication is needed but the victim must open the page or be redirected to it.

Exploitation

Listed in CISA KEV with a 2025-07-23 remediation due date, indicating exploitation in the wild. EPSS 30-day probability is 0.127 (96th percentile), and the vendor advisory is tagged Vendor Advisory.

What to do

• Update Chrome to 138.0.7204.96 or later on all platforms, and confirm the version in chrome://version.
• Apply the vendor advisory guidance and follow BOD 22-01 for cloud or managed Chrome deployments.
• If patching cannot be completed by the KEV due date, restrict or discontinue use of the affected browser per CISA required action.
• Enforce auto-update and restart policies so users are not left on vulnerable builds.
• Track other Chromium-based browsers and apply their equivalent V8 fixes.

Detection

• Hunt for Chrome processes spawning unexpected child processes or writing to unusual paths after browsing.
• Monitor for crashes in the renderer or V8 (chrome.exe crash dumps) clustered around suspicious web content.
• Review proxy and DNS logs for known exploit-hosting or malvertising domains visited by endpoints running unpatched Chrome.
• Alert on endpoints still reporting Chrome versions below 138.0.7204.96.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.