CVE-2025-6554 Actively Exploited Google Chrome Zeroday

🧾 Overview

CVE-2025-6554 is a high-severity zero-day vulnerability discovered in Google Chrome’s V8 JavaScript engine, which is responsible for processing JavaScript in the browser. The flaw is classified as a type confusion vulnerability, and it is already being exploited in the wild at the time of disclosure.

This makes it the fourth actively exploited Chrome zero-day vulnerability in 2025, prompting Google to release an emergency out-of-band patch.

📌 Technical Details

• Vulnerability Type: Type Confusion
• Component: V8 JavaScript engine
• CVE ID: CVE-2025-6554
• Severity Rating: High (CVSS v3.1 score: 8.1)
  • Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Impact: High Confidentiality + High Integrity + No Availability impact
• Exploit Status: Actively exploited (confirmed zero-day)
• Discovery Date: June 25, 2025
• Reported by: Google Threat Analysis Group (TAG)

🧨 Exploitation in the Wild

• Google confirmed that CVE-2025-6554 is being actively exploited in real-world attacks.
• Likely targets include high-value entities or users susceptible to phishing/social engineering campaigns.
• The exploit involves tricking users into visiting a malicious site that executes crafted JavaScript, triggering the vulnerability in V8.

🖥️ Affected Software

• Google Chrome versions prior to 138.0.7204.96
• Likely affects other Chromium-based browsers (e.g., Microsoft Edge, Brave, Vivaldi) until they adopt the patch.

🛠️ Security Patches and Fix

✅ Fixed Versions:

📅 Patch Release Date:

• Emergency updates began rolling out June 30 – July 1, 2025.

🧪 Detection and Mitigation

• There are currently no public IOCs (Indicators of Compromise) for the exploit.
• Web content inspection or endpoint monitoring tools may detect anomalous JavaScript behavior.
• App sandboxing and least privilege models can help contain browser-based exploits.