EUVD-2025-19675CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Lifecycle Timeline
6Description
Type confusion in V8 in Google Chrome prior to 138.0.7204.96 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. (Chromium security severity: High)
Analysis
Chrome's V8 engine contains a type confusion vulnerability (CVE-2025-6554, CVSS 8.1) enabling arbitrary read/write operations through crafted HTML pages. KEV-listed with public PoC, type confusion in V8 is the most reliable class of browser exploitation primitives, providing full memory read/write capability for code execution within the renderer sandbox.
Technical Context
V8 type confusion occurs when the JIT compiler makes incorrect assumptions about an object's type, generating machine code that accesses memory using the wrong offsets and sizes. This provides the attacker with arbitrary read/write primitives — the most powerful exploitation building blocks. Type confusion bugs in V8 are considered the gold standard for browser exploitation because they provide reliable, flexible memory access.
Affected Products
['Google Chrome prior to 138.0.7204.96', 'All Chromium-based browsers']
Remediation
Update Chrome to 138.0.7204.96+. Update all Chromium browsers. Enterprise: push updates via Group Policy.
Priority Score
Vendor Status
Debian
| Release | Status | Fixed Version | Urgency |
|---|---|---|---|
| bullseye (security), bullseye | vulnerable | 120.0.6099.224-1~deb11u1 | - |
| bookworm | fixed | 138.0.7204.92-1~deb12u1 | - |
| bookworm (security) | fixed | 146.0.7680.71-1~deb12u1 | - |
| trixie | fixed | 145.0.7632.159-1~deb13u1 | - |
| trixie (security) | fixed | 146.0.7680.71-1~deb13u1 | - |
| forky | fixed | 146.0.7680.71-1 | - |
| sid | fixed | 146.0.7680.80-1 | - |
| bullseye | fixed | (unfixed) | end-of-life |
| (unstable) | fixed | 138.0.7204.92-1 | - |
Share
External POC / Exploit Code
Leaving vuln.today