U.S. CISA adds Google Chromium V8 flaw to its Known Exploited Vulnerabilities catalog

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Chromium V8 vulnerability to its Known Exploited Vulnerabilities catalog.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added Chromium V8 vulnerability, tracked as CVE-2025-6554, to its Known Exploited Vulnerabilities (KEV) catalog.

Last week, Google released security patches to address the Chrome vulnerability CVE-2025-6554 for which an exploit is available in the wild.

“Type confusion in V8 in Google Chrome prior to 138.0.7204.96 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. (Chromium security severity: High)” reads the description published by NIST.

The vulnerability CVE-2025-6554 is a type-confusing issue that resides in the V8 JavaScript and WebAssembly engine.

“This issue was mitigated on 2025-06-26 by a configuration change pushed out to Stable channel across all platforms.” reads the advisory. “Google is aware that an exploit for CVE-2025-6554 exists in the wild.”

A type confusion vulnerability occurs when a program mistakenly treats a piece of data as a different type than it actually is, leading to unintended behavior. This mismatch can cause memory corruption, crashes, or allow an attacker to execute arbitrary code.

Clément Lecigne of Google’s Threat Analysis Group discovered the vulnerability on June 25, 2025. Chrome Stable has been updated to version 138.0.7204.x for Windows, Mac, and Linux, rolling out in the coming days/weeks.

The existence in the wild of an exploit for this flaw suggests that threat actors, state-sponsored hackers or commercial spyware vendors, may have used it in targeted attacks

CVE-2025-6554 is the fourth Chrome zero-day patched by Google in 2025.

Google released security patches to address a Chrome vulnerability, tracked as CVE-2025-6554, for which an exploit is available in the wild.

“Type confusion in V8 in Google Chrome prior to 138.0.7204.96 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. (Chromium security severity: High)” reads the description published by NIST.

The vulnerability CVE-2025-6554 is a type-confusing issue that resides in the V8 JavaScript and WebAssembly engine.

“This issue was mitigated on 2025-06-26 by a configuration change pushed out to Stable channel across all platforms.” reads the advisory. “Google is aware that an exploit for CVE-2025-6554 exists in the wild.”

A type confusion vulnerability occurs when a program mistakenly treats a piece of data as a different type than it actually is, leading to unintended behavior. This mismatch can cause memory corruption, crashes, or allow an attacker to execute arbitrary code.

Clément Lecigne of Google’s Threat Analysis Group discovered the vulnerability on June 25, 2025. Chrome Stable has been updated to version 138.0.7204.x for Windows, Mac, and Linux, rolling out in the coming days/weeks.

The existence in the wild of an exploit for this flaw suggests that threat actors, state-sponsored hackers or commercial spyware vendors, may have used it in targeted attacks

CVE-2025-6554 is the fourth Chrome zero-day patched by Google in 2025.

According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.

Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure.

CISA orders federal agencies to fix the vulnerabilities by July 23, 2025.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, CISA)