---
title: "Chrome V8 Zero-Days CVE-2025-5419 and CVE-2025-6554"
url: https://erroneo.us/security/briefs/chrome-v8-cve-2025-5419-6554-exploited-zero-days/
description: "Two exploited V8 bugs fixed in Chrome 137.0.7151.68 (Jun 2, 2025) and 138.0.7204.96 (Jun 30), plus Edge and Opera. Auto-updated browsers can relax."
type: security-brief
section: "Security Digest"
date_published: 2025-06-02
date_modified: 2026-10-23
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Most can relax"
cves: ["CVE-2025-5419", "CVE-2025-6554"]
severity: "high"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# Chrome V8 Zero-Days CVE-2025-5419 and CVE-2025-6554

**Verdict: Most can relax.** Both were real zero-days, but Google blunted them with configuration pushes within a day and shipped fixes in June 2025; sixteen months later the only people still exposed run browsers that do not update.

- **Who must act:** Admins of fleets, kiosks or VDI images where Chrome, Edge or another Chromium browser is pinned, deferred or broken, and owners of Android devices stuck on an old Chrome or a pre-September 2025 security patch level.
- **Who can relax:** Anyone whose Chrome or Edge auto-updated and relaunched since July 2025, which is nearly every desktop and Android user.
- **Affected:** Google Chrome before 137.0.7151.68 (CVE-2025-5419); Google Chrome before 138.0.7204.96 on Windows and 138.0.7204.92 on Mac and Linux (CVE-2025-6554); Microsoft Edge before 137.0.3296.62 (CVE-2025-5419) and before 138.0.3351.65 (CVE-2025-6554); Other Chromium-based browsers until their vendors shipped the V8 fixes
- **Fixed:** Chrome 137.0.7151.68/.69 Windows and Mac, 137.0.7151.68 Linux; Android 137.0.7151.72; Extended Stable 136.0.7103.156 (CVE-2025-5419); Chrome 138.0.7204.96/.97 Windows, 138.0.7204.92/.93 Mac, 138.0.7204.92 Linux; Extended Stable 138.0.7204.97/.93 (CVE-2025-6554); Edge Stable 137.0.3296.62 and Extended Stable 136.0.3240.115 (CVE-2025-5419); Edge 138.0.3351.65 (CVE-2025-6554); Opera One 120.0.5543.38, Opera GX 119.0.5497.163, Opera for Android 90.2 (CVE-2025-6554)
- **CVEs:** CVE-2025-5419, CVE-2025-6554
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Open chrome://settings/help or edge://settings/help, relaunch if an update is pending, and confirm a current version.
2. In managed fleets, report browser versions and flag anything below Chrome 153.0.8010.36, which also covers later exploited V8 bugs.
3. Remove policies that pin Chrome or Edge or defer updates indefinitely, and set a relaunch deadline so downloaded updates apply.
4. Check Opera, Brave, Vivaldi and any app that bundles its own Chromium for a release built on a mid-2025 or newer engine.
5. On Android, keep Chrome current from Google Play and install OS updates to at least the 2025-09-05 patch level, which fixes the kernel bug used in the same chain.

### How to check if you are affected

- Query endpoint inventory for chrome.exe or msedge.exe builds older than the fixed versions at any point in June and July 2025, and list the users of those machines.
- Google has published no indicators; for high-risk users who ran old builds, review EDR for browser processes spawning unexpected executables or new persistence around that time.

## What happened

On June 2, 2025, Google shipped [Chrome 137.0.7151.68/.69](https://chromereleases.googleblog.com/2025/06/stable-channel-update-for-desktop.html) to fix CVE-2025-5419, an out-of-bounds read and write in V8, Chrome's JavaScript and WebAssembly engine. Clément Lecigne and Benoît Sevens of Google's Threat Analysis Group (TAG) reported it on May 27. Google said an exploit "exists in the wild" and that it had already mitigated the bug on May 28 with a configuration change pushed to Stable on all platforms. The [bug report](https://issues.chromium.org/issues/420636529), now public, describes an arbitrary read/write inside the V8 sandbox via the Turbofan compiler.

The pattern repeated four weeks later. Lecigne reported CVE-2025-6554, a V8 type confusion, on June 25. Google pushed a configuration mitigation on June 26 and shipped the fix in [Chrome 138.0.7204.96 (Windows) and 138.0.7204.92 (Mac, Linux)](https://chromereleases.googleblog.com/2025/06/stable-channel-update-for-desktop_30.html) on June 30, again noting an in-the-wild exploit. The [bug report](https://issues.chromium.org/issues/427663123) shows a `delete` construct leaking V8's internal "hole" value, which "combined with a typer bug can lead to arbitrary r/w within the v8 heap sandbox." [Qianxin](https://ti.qianxin.com/blog/articles/a-brief-analysis-of-chrome-0day-cve-2025-6554-en/) reports that a public proof of concept appeared about two days after the fix.

Neither bug escapes Chrome's sandbox on its own. Google's [2025 zero-day review](https://cloud.google.com/blog/topics/threat-intelligence/2025-zero-day-review/) adds one piece. Google saw CVE-2025-5419 used in a chain with CVE-2025-6558, a GPU bug reaching the Arm Mali user-land driver, and CVE-2025-38352 in the Linux kernel's POSIX CPU timers. Who ran either exploit, and against whom, was not disclosed as of Oct 23, 2026.

## Who is affected

Per the [CVE-2025-5419](https://www.cve.org/CVERecord?id=CVE-2025-5419) and [CVE-2025-6554](https://www.cve.org/CVERecord?id=CVE-2025-6554) records, Chrome before 137.0.7151.68 and before 138.0.7204.96. [Chrome for Android 137.0.7151.72](https://chromereleases.googleblog.com/2025/06/chrome-for-android-update.html) carried the first fix, and [Extended Stable 136.0.7103.156](https://chromereleases.googleblog.com/2025/06/extended-stable-updates-for-desktop.html) backported it. [Microsoft](https://learn.microsoft.com/en-us/deployedge/microsoft-edge-relnotes-security) fixed Edge in 137.0.3296.62 (June 3), Extended Stable 136.0.3240.115 (June 4) and 138.0.3351.65 (July 1). [Opera](https://blogs.opera.com/security/2025/07/update-your-browser-security-fix-for-chrome-zero-day-cve-2025-6554/) fixed CVE-2025-6554 in Opera One 120.0.5543.38 on July 3. CISA's KEV entries warn that any Chromium-based browser may be affected.

## Do you really need to act?

Almost certainly not for these two bugs. CISA added them to KEV on June 5 ([CVE-2025-5419](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-5419)) and July 2 ([CVE-2025-6554](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-6554)), 2025. The configuration pushes protected even browsers that had not yet updated. CISA's ADP scores them CVSS 3.1 8.8 and 8.1 and marks neither as automatable. No public report describes mass exploitation. The remaining exposure is browsers that never update: pinned versions, frozen kiosk or VDI images, and apps that bundle their own Chromium.

"Patched for these two" is not the bar anymore. KEV lists later exploited V8 bugs, including CVE-2025-10585, CVE-2025-13223 and CVE-2026-87491. The last was fixed in [Chrome 153.0.8010.36](https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html) on September 8, 2026. On Android, the kernel half of the chain was fixed in the [September 2025 bulletin](https://source.android.com/docs/security/bulletin/2025-09-01) at the 2025-09-05 patch level.

## What to do now

1. Open `chrome://settings/help` or `edge://settings/help` and relaunch if prompted.
2. In managed fleets, report browser versions and chase anything below Chrome 153.0.8010.36.
3. Remove policies that pin versions or defer updates indefinitely. Use `RelaunchNotification` so updates actually apply.
4. Check Opera, Brave, Vivaldi and Chromium-based desktop apps for current releases.
5. On Android, update Chrome from Google Play and confirm a security patch level of 2025-09-05 or later.

## How to tell if you were hit

Google has published no indicators for either bug. Check whether any endpoint ran a build older than the fixes in June or July 2025. For high-risk users on those machines, review EDR data for browser processes launching unexpected executables or creating new persistence around that time.

## Timeline

- May 27, 2025 — TAG reports CVE-2025-5419.
- May 28, 2025 — Google pushes a configuration mitigation to Stable.
- Jun 2, 2025 — Chrome 137.0.7151.68 fixes CVE-2025-5419.
- Jun 5, 2025 — CISA adds CVE-2025-5419 to KEV.
- Jun 25, 2025 — TAG reports CVE-2025-6554; mitigated the next day.
- Jun 30, 2025 — Chrome 138.0.7204.96 fixes CVE-2025-6554.
- Jul 2, 2025 — CISA adds CVE-2025-6554 to KEV.
- Mar 5, 2026 — Google's zero-day review ties CVE-2025-5419 to a chain with CVE-2025-6558 and CVE-2025-38352.

## Sources

1. [Google Chrome Releases — Stable Channel Update for Desktop (Jun 2, 2025)](https://chromereleases.googleblog.com/2025/06/stable-channel-update-for-desktop.html)
2. [Google Chrome Releases — Stable Channel Update for Desktop (Jun 30, 2025)](https://chromereleases.googleblog.com/2025/06/stable-channel-update-for-desktop_30.html)
3. [Google Chrome Releases — Extended Stable Updates for Desktop (Jun 3, 2025)](https://chromereleases.googleblog.com/2025/06/extended-stable-updates-for-desktop.html)
4. [Google Chrome Releases — Chrome for Android Update (Jun 2, 2025)](https://chromereleases.googleblog.com/2025/06/chrome-for-android-update.html)
5. [Chromium issue 420636529 — [0-day] Arbitrary read/write within the V8 sandbox via Turbofan](https://issues.chromium.org/issues/420636529)
6. [Chromium issue 427663123 — [0-day] delete construct leaking TheHole](https://issues.chromium.org/issues/427663123)
7. [CVE record — CVE-2025-5419](https://www.cve.org/CVERecord?id=CVE-2025-5419)
8. [CVE record — CVE-2025-6554](https://www.cve.org/CVERecord?id=CVE-2025-6554)
9. [NVD — CVE-2025-5419](https://nvd.nist.gov/vuln/detail/CVE-2025-5419)
10. [NVD — CVE-2025-6554](https://nvd.nist.gov/vuln/detail/CVE-2025-6554)
11. [CISA — Known Exploited Vulnerabilities: CVE-2025-5419](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-5419)
12. [CISA — Known Exploited Vulnerabilities: CVE-2025-6554](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-6554)
13. [Microsoft — Release notes for Microsoft Edge Security Updates](https://learn.microsoft.com/en-us/deployedge/microsoft-edge-relnotes-security)
14. [Opera — Update your browser: Security fix for Chrome zero-day CVE-2025-6554](https://blogs.opera.com/security/2025/07/update-your-browser-security-fix-for-chrome-zero-day-cve-2025-6554/)
15. [Google Threat Intelligence Group — 2025 Zero-Day Review](https://cloud.google.com/blog/topics/threat-intelligence/2025-zero-day-review/)
16. [Android Security Bulletin — September 2025](https://source.android.com/docs/security/bulletin/2025-09-01)
17. [Google Chrome Releases — Stable Channel Update for Desktop (Sep 8, 2026)](https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html)
18. [Qianxin Threat Intelligence Center — A Brief Analysis of Chrome's 0day CVE-2025-6554 in the Wild](https://ti.qianxin.com/blog/articles/a-brief-analysis-of-chrome-0day-cve-2025-6554-en/)

---
Source page: https://erroneo.us/security/briefs/chrome-v8-cve-2025-5419-6554-exploited-zero-days/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt