PT-2025-26787 · Google+2 · Google Chrome+2

Ameen Basha M K · Published 2025-06-24 · Updated 2025-07-18 · CVE-2025-6557

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 138.0.7204.49

Description: Insufficient data validation in DevTools in Google Chrome on Windows allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code via a crafted HTML page. The issue has a security severity of Low.

Recommendations: For versions prior to 138.0.7204.49, update to version 138.0.7204.49 or later to resolve the issue. As a temporary workaround, consider restricting access to DevTools until the update is applied. Avoid using crafted HTML pages that could exploit this issue until the update is installed.

Fix

RCE

Clickjacking

Weakness Enumeration

CWE-1021

Related Identifiers

ALT-PU-2025-9065

BDU:2025-09102

CVE-2025-6557

DSA-5952-1

OPENSUSE-SU-2025:15210-1

Affected Products

Alt Linux

Debian

Google Chrome

References · 37

• https://bdu.fstec.ru/vul/2025-09102 · Security Note
• https://osv.dev/vulnerability/DSA-5952-1 · Vendor Advisory
• https://chromereleases.googleblog.com/2025/06/stable-channel-update-for-desktop_24.html · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-6557 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-6557 · Security Note
• https://osv.dev/vulnerability/CVE-2025-6557 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15210-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-6557 · Vendor Advisory
• https://suse.com/security/cve/CVE-2025-6557 · Note
• https://suse.com/security/cve/CVE-2025-5064 · Note
• https://t.me/cvetracker/26982 · Telegram Post
• https://crbug.com/406631048 · Note
• https://xn--80ahaefyxhn.xn--j1afgaq.xn--p1ai/bin/view/%D0%9E%D0%A1%D0%BD%D0%BE%D0%B2%D0%B0/%D0%9E%D0%B1%D0%BD%D0%BE%D0%B2%D0%BB%D0%B5%D0%BD%D0%B8%D1%8F/3.1 · Note
• https://suse.com/security/cve/CVE-2025-6192 · Note
• https://twitter.com/Cezar_H_Linux/status/1940078497029816633 · Twitter Post