Google patches another actively exploited Chrome zero day flaw

CVE-2025-6554 is the fourth zero day this year



Google has issued a critical security update for its Chrome browser to fix a zero day vulnerability that is being actively exploited in the wild.

The flaw, tracked as CVE-2025-6554, is the fourth zero day Chrome vulnerability confirmed to be under active attack this year.

The bug, described as a type confusion vulnerability in Chrome's V8 JavaScript and WebAssembly engine, allows remote attackers to perform arbitrary read and write operations simply by luring users to a maliciously crafted HTML page.

According to the National Vulnerability Database (NVD), this kind of flaw can cause unexpected software behaviour – including browser crashes, code execution, and full compromise of the underlying system.

"Type confusion in V8 in Google Chrome prior to 138.0.7204.96 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page," reads the official description.

The vulnerability was discovered and reported on 25 June 2025, by Clément Lecigne of Google's Threat Analysis Group (TAG). The timing of the disclosure and TAG's involvement suggests the flaw may have been used in highly targeted attacks, possibly linked to nation-state actors or surveillance operations.

Google acknowledged the existence of an exploit for CVE-2025-6554 in the wild but has not disclosed technical details or attributed the attacks.

However, a mitigation was quickly deployed via a configuration change the following day, and a stable fix is now available for all major platforms.

Google advises all users to update to the latest versions of Chrome to protect against the flaw:

Although the current threat may be limited in scope, users in high-risk roles – such as government workers or those handling sensitive data – are urged to update immediately.

Zero day vulnerabilities, flaws unknown to vendors at the time they're exploited, are a significant threat to browser security, allowing a way in to threat actors that’s hard to detect.

As attackers grow more sophisticated and well-resourced, especially in the context of geopolitically motivated cyber operations, Google and other tech companies face the challenge of more rapid detection, disclosure and patch deployment.

Until further details emerge about the nature of CVE-2025-6554 and the entities involved, users are strongly encouraged to:

CVE-2025-6554 marks the fourth actively exploited Chrome zero day Google has patched so far in 2025, continuing a troubling trend of sophisticated, real-world attacks targeting the browser. Three other zero days patched this year by Google are:

In comparison, 2024 saw 10 zero days patched in Chrome, including several discovered through real-world abuse and security contests like Pwn2Own.