Skip to main content
The Website Services team at NHS England are testing early designs to understand how you find information. Your views will help us check our ideas work. Sign up to take part in our user research.

Google Releases Security Update for Chrome

Security update addresses an exploited high severity vulnerability in Google Chrome

Threat ID:
CC-4682
Threat Severity:
Medium
Published:
18 July 2025 1:22 PM
Report a cyber attack: call 0300 303 5222 or email [email protected]

Summary

Security update addresses an exploited high severity vulnerability in Google Chrome

Threat details

Exploitation of CVE-2025-6558

Google is aware that an exploit for CVE-2025-6558 exists in the wild.

Introduction

Google has released version 138.0.7204.157/.158 for Chrome for Windows and Mac and 138.0.7204.157 for Chrome for Linux, which will roll out over the coming days/weeks. 

The updates address three high severity vulnerabilities, including CVE-2025-6558, which has an exploit in the wild.

  • CVE-2025-6558: Incorrect validation of untrusted input in ANGLE and GPU vulnerability - CVSSv3 score: 8.8
    • Exploitation could allow a remote attacker to potentially perform a sandbox escape via a crafted HTML page.
  • CVE-2025-7656: Integer overflow in V8 - CVSSv3 score: 8.8
    • Exploitation could allow a remote attacker to potentially exploit heap corruption via a crafted HTML page.
  • CVE-2025-7657: Use after free in WebRTC - CVSSv3 score: 8.8
    • Exploitation could allow remote attacker to potentially exploit heap corruption via a crafted HTML page.

Remediation advice

Affected organisations are encouraged to review the Chrome Release 138.0.7204.157/.158 Stable Channel advisory and apply the update for the latest release.

Last edited: 18 July 2025 1:22 pm