Zero-day Vulnerability in Chrome Being Actively Exploited

Recently, Google released an emergency patch for a new zero-day vulnerability that hackers are actively exploiting.

Details

Vulnerability ID: CVE-2025-6554
CVSS(3.1) Score: 8.1
Severity Level: HIGH
Description: A type confusion error in Chrome's V8 engine allows remote attackers to exploit and execute arbitrary code through a malicious HTML file.
Affected Versions: All versions of Google Chrome before version 138.0.7204.96.

As reported by FPT Threat Intelligence in a previous security alert, the JavaScript Engine V8 acts as the brain processing JavaScript code in Google Chrome and other Chromium-based browsers like Brave, Chromium Edge, etc. When users open any webpage, the JavaScript code of that page is processed by V8 to make the page and its components function.

The CVE-2025-6554 vulnerability in the V8 engine due to a type confusion error allows remote attackers to read/write arbitrary memory on a victim's system through a malicious HTML page. Since V8 directly processes code from websites that users visit, hackers can exploit this process to take advantage of the vulnerability and infiltrate the victim's system.

CVE-2025-6554 also enables remote attackers to execute arbitrary code, inject malicious code into system processes, or further exploit the system when combined with other known serious security vulnerabilities like CVE-2025-5419. The fact that this vulnerability is being actively exploited in the wild increases its severity and the alarming situation it causes.

Recommendations & Mitigation

In its announcement, Google recommends users to:

Update Chrome browser to the latest version: Upgrade to version 138.0.7204.96/.97 for the stable version of Google Chrome on Windows, 138.0.7204.92/.93 for macOS, or version 138.0.7204.92 for Linux.
Avoid visiting unfamiliar websites: Besides updating to the latest software version, users should not visit unfamiliar links online. Do not download or install files or software from unknown sources.
Use security solutions: Install antivirus software, regularly back up data, or use advanced security solutions like 24/7 monitoring to ensure maximum system safety.

Zero-day Vulnerability in Chrome Being Actively Exploited

Comments

Newsletters-eng

More from this blog

Khi chiếc máy tính của bạn trở thành "trạm trung chuyển" bí mật cho gián điệp mạng

Dysphoria: sáu ngày sau cuộc triệt phá, và tám năm sau ý tưởng gốc

Operation BlueDash: khi RMM hợp pháp trở thành backdoor, và một repo GitHub công khai kể lại toàn bộ chiến dịch

Từ SSH Botnet Đến “Ổ” Đào Coin: Lần Theo Dấu Vết Một Chiến Dịch Cryptomining

OctLurk & SilkLurk: Hai Backdoor “Ẩn Mình” Và Tự Biến Đổi Theo Từng Nạn Nhân

Details

Recommendations & Mitigation

References

Command Palette

Comments

Newsletters-eng

More from this blog

Details

Recommendations & Mitigation

References