Vlad Stolyarov and Clément Lecigne of Google's Threat Analysis Group (TAG), a team of security experts dedicated to defending Google customers against state-sponsored attacks, discovered CVE-2025-6558 in June and reported it to the Google Chrome team, who patched it on July 15 and tagged it as actively exploited in attacks. On July 22, the Cybersecurity and Infrastructure Security Agency (CISA), the U.S. cyber defense agency, also added this security bug to its catalog of vulnerabilities known to be exploited in attacks, requiring federal agencies to patch their software by August 12. While Google has yet to provide further information on these attacks, Google TAG frequently discovers zero-day flaws exploited by government-sponsored threat actors in targeted campaigns aimed at deploying spyware on devices of high-risk individuals, including dissidents, opposition politicians, and journalists. Apple has released security updates to address a high-severity vulnerability that has been exploited in zero-day attacks targeting Google Chrome users. Apple has also patched five zero-day flaws exploited in targeted attacks since the start of the year, including one zero-day in January (CVE-2025-24085), one in February (CVE-2025-24200), a third in March (CVE-2025-24201), and two more in April (CVE-2025-31200 and CVE-2025-31201). Tracked as CVE-2025-6558, the security bug is due to the incorrect validation of untrusted input in the ANGLE (Almost Native Graphics Layer Engine) open-source graphics abstraction layer, which processes GPU commands and translates OpenGL ES API calls to Direct3D, Metal, Vulkan, and OpenGL. While the Binding Operational Directive (BOD) 22-01, which mandates federal agencies to secure their systems, only applies to federal agencies, CISA advised all network defenders to prioritize patching the CVE-2025-6558 vulnerability as soon as possible. "These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise," the cybersecurity agency warned last week.
This Cyber News was published on www.bleepingcomputer.com. Publication date: Wed, 30 Jul 2025 16:11:16 +0000