Chrome V8 Zero-Days CVE-2025-5419 and CVE-2025-6554

What to do

1. Open chrome://settings/help or edge://settings/help, relaunch if an update is pending, and confirm a current version.
2. In managed fleets, report browser versions and flag anything below Chrome 153.0.8010.36, which also covers later exploited V8 bugs.
3. Remove policies that pin Chrome or Edge or defer updates indefinitely, and set a relaunch deadline so downloaded updates apply.
4. Check Opera, Brave, Vivaldi and any app that bundles its own Chromium for a release built on a mid-2025 or newer engine.
5. On Android, keep Chrome current from Google Play and install OS updates to at least the 2025-09-05 patch level, which fixes the kernel bug used in the same chain.

How to check if you are affected or compromised

• Query endpoint inventory for chrome.exe or msedge.exe builds older than the fixed versions at any point in June and July 2025, and list the users of those machines.
• Google has published no indicators; for high-risk users who ran old builds, review EDR for browser processes spawning unexpected executables or new persistence around that time.

What happened#

On June 2, 2025, Google shipped Chrome 137.0.7151.68/.69 to fix CVE-2025-5419, an out-of-bounds read and write in V8, Chrome's JavaScript and WebAssembly engine. Clément Lecigne and Benoît Sevens of Google's Threat Analysis Group (TAG) reported it on May 27. Google said an exploit "exists in the wild" and that it had already mitigated the bug on May 28 with a configuration change pushed to Stable on all platforms. The bug report, now public, describes an arbitrary read/write inside the V8 sandbox via the Turbofan compiler.

The pattern repeated four weeks later. Lecigne reported CVE-2025-6554, a V8 type confusion, on June 25. Google pushed a configuration mitigation on June 26 and shipped the fix in Chrome 138.0.7204.96 (Windows) and 138.0.7204.92 (Mac, Linux) on June 30, again noting an in-the-wild exploit. The bug report shows a delete construct leaking V8's internal "hole" value, which "combined with a typer bug can lead to arbitrary r/w within the v8 heap sandbox." Qianxin reports that a public proof of concept appeared about two days after the fix.

Neither bug escapes Chrome's sandbox on its own. Google's 2025 zero-day review adds one piece. Google saw CVE-2025-5419 used in a chain with CVE-2025-6558, a GPU bug reaching the Arm Mali user-land driver, and CVE-2025-38352 in the Linux kernel's POSIX CPU timers. Who ran either exploit, and against whom, was not disclosed as of Oct 23, 2026.

Who is affected#

Per the CVE-2025-5419 and CVE-2025-6554 records, Chrome before 137.0.7151.68 and before 138.0.7204.96. Chrome for Android 137.0.7151.72 carried the first fix, and Extended Stable 136.0.7103.156 backported it. Microsoft fixed Edge in 137.0.3296.62 (June 3), Extended Stable 136.0.3240.115 (June 4) and 138.0.3351.65 (July 1). Opera fixed CVE-2025-6554 in Opera One 120.0.5543.38 on July 3. CISA's KEV entries warn that any Chromium-based browser may be affected.

Do you really need to act?#

Almost certainly not for these two bugs. CISA added them to KEV on June 5 (CVE-2025-5419) and July 2 (CVE-2025-6554), 2025. The configuration pushes protected even browsers that had not yet updated. CISA's ADP scores them CVSS 3.1 8.8 and 8.1 and marks neither as automatable. No public report describes mass exploitation. The remaining exposure is browsers that never update: pinned versions, frozen kiosk or VDI images, and apps that bundle their own Chromium.

"Patched for these two" is not the bar anymore. KEV lists later exploited V8 bugs, including CVE-2025-10585, CVE-2025-13223 and CVE-2026-87491. The last was fixed in Chrome 153.0.8010.36 on September 8, 2026. On Android, the kernel half of the chain was fixed in the September 2025 bulletin at the 2025-09-05 patch level.

What to do now#

1. Open chrome://settings/help or edge://settings/help and relaunch if prompted.
2. In managed fleets, report browser versions and chase anything below Chrome 153.0.8010.36.
3. Remove policies that pin versions or defer updates indefinitely. Use RelaunchNotification so updates actually apply.
4. Check Opera, Brave, Vivaldi and Chromium-based desktop apps for current releases.
5. On Android, update Chrome from Google Play and confirm a security patch level of 2025-09-05 or later.

How to tell if you were hit#

Google has published no indicators for either bug. Check whether any endpoint ran a build older than the fixes in June or July 2025. For high-risk users on those machines, review EDR data for browser processes launching unexpected executables or creating new persistence around that time.

Timeline#

• May 27, 2025 — TAG reports CVE-2025-5419.
• May 28, 2025 — Google pushes a configuration mitigation to Stable.
• Jun 2, 2025 — Chrome 137.0.7151.68 fixes CVE-2025-5419.
• Jun 5, 2025 — CISA adds CVE-2025-5419 to KEV.
• Jun 25, 2025 — TAG reports CVE-2025-6554; mitigated the next day.
• Jun 30, 2025 — Chrome 138.0.7204.96 fixes CVE-2025-6554.
• Jul 2, 2025 — CISA adds CVE-2025-6554 to KEV.
• Mar 5, 2026 — Google's zero-day review ties CVE-2025-5419 to a chain with CVE-2025-6558 and CVE-2025-38352.

Vulnerability records

• CVE-2025-5419 · KEV 2025-06-05 · Out of bounds read and write in V8 in Google Chrome prior to 137.0.7151.68 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML…
• CVE-2025-6554 · KEV 2025-07-02 · Type confusion in V8 in Google Chrome prior to 138.0.7204.96 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page.

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. Google Chrome Releases — Stable Channel Update for Desktop (Jun 2, 2025) chromereleases.googleblog.com
2. Google Chrome Releases — Stable Channel Update for Desktop (Jun 30, 2025) chromereleases.googleblog.com
3. Google Chrome Releases — Extended Stable Updates for Desktop (Jun 3, 2025) chromereleases.googleblog.com
4. Google Chrome Releases — Chrome for Android Update (Jun 2, 2025) chromereleases.googleblog.com
5. Chromium issue 420636529 — [0-day] Arbitrary read/write within the V8 sandbox via Turbofan issues.chromium.org
6. Chromium issue 427663123 — [0-day] delete construct leaking TheHole issues.chromium.org
7. CVE record — CVE-2025-5419 cve.org
8. CVE record — CVE-2025-6554 cve.org
9. NVD — CVE-2025-5419 nvd.nist.gov
10. NVD — CVE-2025-6554 nvd.nist.gov
11. CISA — Known Exploited Vulnerabilities: CVE-2025-5419 cisa.gov
12. CISA — Known Exploited Vulnerabilities: CVE-2025-6554 cisa.gov
13. Microsoft — Release notes for Microsoft Edge Security Updates learn.microsoft.com
14. Opera — Update your browser: Security fix for Chrome zero-day CVE-2025-6554 blogs.opera.com
15. Google Threat Intelligence Group — 2025 Zero-Day Review cloud.google.com
16. Android Security Bulletin — September 2025 source.android.com
17. Google Chrome Releases — Stable Channel Update for Desktop (Sep 8, 2026) chromereleases.googleblog.com
18. Qianxin Threat Intelligence Center — A Brief Analysis of Chrome's 0day CVE-2025-6554 in the Wild ti.qianxin.com