CVE-2025-6554: Medium Type Confusion in V8
Chromium: CVE-2025-6554 Type Confusion in V8
Other sources
Google Chromium V8 contains a type confusion vulnerability that could allow a remote attacker to perform arbitrary read/write via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
— CISA
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information. Google is aware that an exploit for CVE-2025-6554 exists in the wild.
— Microsoft
Type confusion in V8 in Google Chrome prior to 138.0.7204.96 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. (Chromium security severity: High)
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 138.0.7204.96 - Upgrade
Upgrade
alpine/qt6-qtwebengineto a version that resolves this vulnerability.Fixed in 6.8.3-r1 - Upgrade
Upgrade
alpine/qt6-qtwebengineto a version that resolves this vulnerability.Fixed in 6.9.1-r3 - Upgrade
Upgrade
Google Chrome/Chromium V8to a version that resolves this vulnerability.Fixed in 138.0.7204.96
Event History
Frequently Asked Questions
What is the severity of CVE-2025-6554?
CVE-2025-6554 is classified as a critical vulnerability that can be actively exploited in the wild.
How do I fix CVE-2025-6554?
To mitigate CVE-2025-6554, update Google Chrome to version 138.0.7204.96 or later.
Which browsers are affected by CVE-2025-6554?
CVE-2025-6554 affects Google Chrome and Microsoft Edge (Chromium-based) versions prior to their respective updates.
Is there a known exploit for CVE-2025-6554?
Yes, there are known exploits for CVE-2025-6554 that are being actively used.
When was CVE-2025-6554 disclosed?
CVE-2025-6554 was disclosed in June 2025 as part of a security update by Google.