CVE-2025-6558 Debian — Exploit & Vulnerability Details HIGH

Parameter	Value
CVSS	8.8 (HIGH)
Affected Versions	before 2.6
Fixed In	138.0.7204.157
Type	CWE-20 (Improper Input Validation)
Vendor	Debian
Public PoC	Yes

Insufficient validation of untrusted input in ANGLE and GPU in Google Chrome prior to 138.0.7204.157 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

Attack Parameters

Attack Vector

Network

Can be exploited remotely

Attack Complexity

Low

Easy to exploit

Privileges Required

None

No privileges needed

User Interaction

Required

User action required

Impact Assessment

Confidentiality

High

Complete data leak

Integrity

High

Complete data modification

Availability

High

Complete denial of service

CVSS Vector v3.1

Weakness Type (CWE)

CWE-20 Improper Input Validation

Vulnerable Products 10

Configuration	From (including)	Up to (excluding)
Google Chrome cpe:2.3:a:google:chrome::::::::	—	`138.0.7204.157`
Debian Debian_Linux cpe:2.3:o:debian:debian_linux:11.0:::::::*	—	—
Apple Safari cpe:2.3:a:apple:safari::::::::	—	`18.6`
Apple Ipados cpe:2.3:o:apple:ipados::::::::	—	`18.6`
Apple Iphone_Os cpe:2.3:o:apple:iphone_os::::::::	—	`18.6`
Apple Macos cpe:2.3:o:apple:macos::::::::	—	`15.6`
Apple Visionos cpe:2.3:o:apple:visionos::::::::	—	`2.6`
Apple Watchos cpe:2.3:o:apple:watchos::::::::	—	`11.6`
Wpewebkit Wpe_Webkit cpe:2.3:a:wpewebkit:wpe_webkit::::::::	—	`2.48.0`
Webkitgtk Webkitgtk cpe:2.3:a:webkitgtk:webkitgtk::::::::	—	`2.48.0`