# Google Chrome type confusion in V8 under active exploitation

Published: 2026-06-09 · Severity: high
Canonical: https://vorant.io/reports/9ef571e2-38c8-5e95-860f-9f232a0413db/google-chrome-type-confusion-in-v8-under-active-exploitation

> Critical type confusion flaw in Chrome V8 allows arbitrary code execution; actively exploited in the wild.

A type confusion vulnerability in Google Chrome's V8 JavaScript engine (CVE-2025-6554) allows remote attackers to achieve arbitrary code execution in the context of the logged-on user. The flaw is exploited via drive-by compromise—a victim visiting a malicious website can trigger the vulnerability without further interaction. CISA has confirmed active exploitation in the wild and added the CVE to its Known Exploited Vulnerabilities catalog.

The impact depends on user privileges: administrators face full system compromise including program installation and account creation; standard users are limited to that user's scope. Affected versions are Chrome 138.0.7204.96/.97 (Windows), 138.0.7204.92/.93 (Mac), and 138.0.7204.92 (Linux) and earlier. Mitigation requires immediate patching after testing, enforcement of least-privilege access, anti-exploitation features (DEP, WDEG, SIP), and DNS/URL filtering to block malicious sites that serve the exploit.

## Mentioned in this report

- Vulnerabilities: CVE-2025-6554 (KEV)

## Detection guidance (public sample)

### Chrome Renderer Process Spawning Non-Chrome Child Process

ATT&CK: T1189

A Chrome renderer (--type=renderer) should only spawn further Chrome processes. Any other child suggests browser exploitation, such as a V8 type confusion leading to code execution. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Chrome Renderer Process Spawning Non-Chrome Child Process
description: Detects a sandboxed Chrome renderer process (--type=renderer) creating
  a child process that is not Chrome itself. Renderers have no legitimate reason to
  launch other binaries, so this indicates post-exploitation after a browser RCE such
  as a V8 type confusion drive-by.
tags:
- attack.initial-access
- attack.t1189
- attack.execution
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \chrome.exe
    ParentCommandLine|contains: --type=renderer
  filter_chrome:
    Image|endswith: \chrome.exe
  condition: selection and not filter_chrome
falsepositives:
- Crash reporting or WER helpers launched during a renderer crash
- Security or DLP products that inject and spawn helper processes from the renderer
level: high
id: 0acda8d9-cbc4-5293-b02b-be3abd6058ad
status: experimental
author: Vorant
references:
- https://www.cisecurity.org/advisory/a-vulnerability-in-google-chrome-could-allow-for-arbitrary-code-execution_2025-061
```

### Chrome Browser Spawning Command Shell or Script Interpreter

ATT&CK: T1189

chrome.exe directly spawning cmd, PowerShell, wscript, mshta or similar is uncommon and consistent with post-exploitation following a drive-by browser exploit. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Chrome Browser Spawning Command Shell or Script Interpreter
description: Detects chrome.exe launching shells, script hosts or common download/proxy-execution
  LOLBins. After a drive-by V8 exploit, attackers running in the context of the user
  often start these tools for payload staging or data exfiltration.
tags:
- attack.initial-access
- attack.t1189
- attack.exfiltration
- attack.t1048
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \chrome.exe
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \wscript.exe
    - \cscript.exe
    - \mshta.exe
    - \rundll32.exe
    - \regsvr32.exe
    - \certutil.exe
    - \bitsadmin.exe
    - \curl.exe
  filter_native_messaging:
    CommandLine|contains: chrome-extension://
  condition: selection and not filter_native_messaging
falsepositives:
- Native messaging hosts implemented as batch or PowerShell scripts for browser extensions
- Enterprise web apps that launch helper scripts through custom URL handlers
level: high
id: 4c54a517-cef3-573c-824a-f86deca54a18
status: experimental
author: Vorant
references:
- https://www.cisecurity.org/advisory/a-vulnerability-in-google-chrome-could-allow-for-arbitrary-code-execution_2025-061
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisecurity.org/advisory/a-vulnerability-in-google-chrome-could-allow-for-arbitrary-code-execution_2025-061

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/9ef571e2-38c8-5e95-860f-9f232a0413db/google-chrome-type-confusion-in-v8-under-active-exploitation.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup