Type confusion in V8 in Google Chrome prior to 138

CVE-2025-6554 is a V8 type confusion bug in Chrome that affects desktop releases before 138.0.7204.96 on Windows, before 138.0.7204.92/.93 on macOS, and before 138.0.7204.92 on Linux. A malicious site can feed crafted HTML/JavaScript into the browser and turn that memory-safety mistake into an arbitrary read/write primitive inside the browser process.

Google's HIGH 8.1 baseline is basically fair. The big downward pressures are real: the attacker still needs user interaction, a reachable vulnerable browser, and in many full-compromise scenarios a second bug or a browser sandbox escape. But those frictions are offset by the two facts that matter most to an enterprise fleet manager: Chrome is everywhere and Google plus CISA both confirm real-world exploitation.

Why this verdict

• Active exploitation keeps the floor high: Google says an exploit exists in the wild and CISA KEV confirms this is not theoretical
• User interaction subtracts real risk: attacker position is *unauthenticated remote*, but it still implies a delivery problem that modern email, web, DNS, and browser controls can disrupt
• Single-bug impact is narrower than 'full RCE everywhere': arbitrary read/write in the browser process is serious, but many enterprise-worst outcomes still require a second vulnerability or a compatible post-browser path

Why not higher?

I am not calling this CRITICAL because the chain is not one-packet, wormable, or broadly automatable. The need for a victim browsing event and the likelihood that full host compromise needs another bug are meaningful friction points in real deployments.

Why not lower?

I am not dropping this to MEDIUM because this is Chrome, not a niche product, and Google explicitly says it is already being exploited. Once a browser zero-day is live, exposure is measured in users, not servers, and your reachable population is usually enormous.

1. Force browser updates and restarts — Push managed Chrome updates and enforce restart/completion for lagging endpoints. Because this is KEV-listed / actively exploited, do this immediately, within hours, not on the normal HIGH 30-day rhythm.
2. Restrict risky browsing paths — Temporarily tighten web filtering for uncategorized domains, ad-tech domains, newly registered domains, and direct file-sharing links commonly used in lure campaigns. This is a fast exposure reducer while patch uptake completes, and it should be in place immediately, within hours.
3. Use browser isolation for high-risk groups — Route executives, finance, admins, and research users through remote browser isolation or equivalent hardened browsing controls where available. For a HIGH verdict this is a strong compensating control, but because exploitation is active, deploy for priority users immediately, within hours.
4. Hunt for browser crash clusters — Query EDR, crash reporting, and proxy telemetry for renderer crashes, abnormal Chrome child-process behavior, or suspicious browsing immediately before help-desk complaints. Use this during the first 24-72 hours to find likely failed exploit attempts and patch laggards.
5. Block unmanaged Chrome variants — If you govern only Google Chrome but allow unmanaged Chromium forks, close that gap with application control or MDM compliance rules. Do it within hours for internet-facing user populations because the patch speed of forks is uneven.

Run this on the target endpoint or through your EDR/remote execution tooling. Invoke it with python3 check_cve_2025_6554.py on Windows, macOS, or Linux; standard user rights are usually enough because it only reads local version information from common install paths and the Windows registry.

#!/usr/bin/env python3
# check_cve_2025_6554.py
# Detect likely exposure to CVE-2025-6554 on local Chrome installs.
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import os
import platform
import re
import shutil
import subprocess
import sys


def parse_ver(s):
    m = re.search(r'(\d+)\.(\d+)\.(\d+)\.(\d+)', s)
    return tuple(int(x) for x in m.groups()) if m else None


def cmp_ver(a, b):
    return (a > b) - (a < b)


def run_cmd(cmd):
    try:
        p = subprocess.run(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, timeout=10)
        out = (p.stdout or '') + (p.stderr or '')
        return out.strip()
    except Exception:
        return ''


def get_windows_version():
    # Prefer registry App Paths / BLBeacon if present
    reg_paths = [
        ["reg", "query", r"HKLM\Software\Google\Chrome\BLBeacon", "/v", "version"],
        ["reg", "query", r"HKCU\Software\Google\Chrome\BLBeacon", "/v", "version"],
        ["reg", "query", r"HKLM\Software\WOW6432Node\Google\Chrome\BLBeacon", "/v", "version"],
    ]
    for cmd in reg_paths:
        out = run_cmd(cmd)
        v = parse_ver(out)
        if v:
            return v, out

    common = [
        os.path.expandvars(r"%ProgramFiles%\Google\Chrome\Application\chrome.exe"),
        os.path.expandvars(r"%ProgramFiles(x86)%\Google\Chrome\Application\chrome.exe"),
        os.path.expandvars(r"%LocalAppData%\Google\Chrome\Application\chrome.exe"),
    ]
    for path in common:
        if os.path.exists(path):
            out = run_cmd([path, "--version"])
            v = parse_ver(out)
            if v:
                return v, out
    return None, ''


def get_macos_version():
    apps = [
        "/Applications/Google Chrome.app/Contents/MacOS/Google Chrome",
        os.path.expanduser("~/Applications/Google Chrome.app/Contents/MacOS/Google Chrome"),
        "/Applications/Chromium.app/Contents/MacOS/Chromium",
    ]
    for path in apps:
        if os.path.exists(path):
            out = run_cmd([path, "--version"])
            v = parse_ver(out)
            if v:
                return v, out
    return None, ''


def get_linux_version():
    bins = ["google-chrome", "google-chrome-stable", "chromium", "chromium-browser", "chrome"]
    for b in bins:
        p = shutil.which(b)
        if p:
            out = run_cmd([p, "--version"])
            v = parse_ver(out)
            if v:
                return v, out
    return None, ''


def main():
    system = platform.system()
    version = None
    raw = ''
    fixed = None

    if system == 'Windows':
        version, raw = get_windows_version()
        fixed = (138, 0, 7204, 96)
    elif system == 'Darwin':
        version, raw = get_macos_version()
        fixed = (138, 0, 7204, 92)
    elif system == 'Linux':
        version, raw = get_linux_version()
        fixed = (138, 0, 7204, 92)
    else:
        print('UNKNOWN - unsupported platform:', system)
        sys.exit(2)

    if not version:
        print('UNKNOWN - Chrome/Chromium version not found')
        sys.exit(2)

    print(f'Detected version: {version[0]}.{version[1]}.{version[2]}.{version[3]}')
    print(f'Raw version output: {raw}')
    print(f'Fixed threshold for {system}: {fixed[0]}.{fixed[1]}.{fixed[2]}.{fixed[3]}+')

    if cmp_ver(version, fixed) < 0:
        print('VULNERABLE')
        sys.exit(1)
    else:
        print('PATCHED')
        sys.exit(0)


if __name__ == '__main__':
    main()

Sources

1. Google Chrome Releases - Stable Channel Update for Desktop (June 30, 2025)
2. NVD - CVE-2025-6554
3. CISA - Adds One Known Exploited Vulnerability to Catalog (July 2, 2025)
4. OpenCVE record for CVE-2025-6554
5. Debian Security Tracker - CVE-2025-6554
6. Debian Security Advisory DSA-5955-1
7. FIRST EPSS - Data and Statistics
8. GitHub training repo referencing CVE-2025-6554