Coverage › CVE-2025-6558
CVE-2025-6558 Mapped Partial Sigma
Google Chromium ANGLE and GPU Improper Input Validation Vulnerability
- Vendor / product
- Google — Chromium
- Description (CISA)
- Google Chromium contains an improper input validation vulnerability in ANGLE and GPU. This vulnerability could allow a remote attacker to potentially perform a sandbox escape via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
- Added to KEV
- 2025-07-22
- Due date
- 2025-08-12
- Required action
- Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known ransomware use
- Unknown
- CWE
- CWE-20
- CISA notes
- https://chromereleases.googleblog.com/2025/07/stable-channel-update-for-desktop_15.html
https://nvd.nist.gov/vuln/detail/CVE-2025-6558 - Elsewhere
- cve.org · NVD · CISA KEV · JSON
ATT&CK techniques · CTID Mappings Explorer, ATT&CK 16.1, KEV snapshot 2025-07-28
6 mapping objects across 6 techniques. exploitation technique states how the vulnerability is exploited; primary and secondary impact state what exploitation achieves. They are different claims and are labelled as such. Mappings marked mobile refer to ATT&CK Mobile; this site traverses the Enterprise bundle only and shows no detection chain for them.
| Technique | Mapping type | CTID comment | Status in v19.2 |
|---|---|---|---|
| T1189 Drive-by Compromise | exploitation technique | This vulnerability enables remote threat actors to escape the browser sandbox by leveraging a specially crafted HTML page. ref 1 · ref 2 |
live |
| T1203 Exploitation for Client Execution | exploitation technique | This vulnerability enables remote threat actors to escape the browser sandbox by leveraging a specially crafted HTML page. ref 1 · ref 2 |
live |
| T1456 Drive-By Compromisemobile | exploitation technique | This vulnerability enables remote threat actors to escape the browser sandbox by leveraging a specially crafted HTML page. ref 1 · ref 2 |
not checked (Mobile) |
| T1658 Exploitation for Client Executionmobile | exploitation technique | This vulnerability enables remote threat actors to escape the browser sandbox by leveraging a specially crafted HTML page. ref 1 · ref 2 |
not checked (Mobile) |
| T1497 Virtualization/Sandbox Evasion | primary impact | This vulnerability enables remote threat actors to escape the browser sandbox by leveraging a specially crafted HTML page. ref 1 · ref 2 |
live |
| T1633 Virtualization/Sandbox Evasionmobile | primary impact | This vulnerability enables remote threat actors to escape the browser sandbox by leveraging a specially crafted HTML page. ref 1 · ref 2 |
not checked (Mobile) |
Detection chain · ATT&CK Enterprise v19.2 detection strategies, analytics, log sources
T1189 Drive-by Compromise exploitation technique
- DET0176 Drive-by Compromise — Behavior-based, Multi-platform Detection Strategy (T1189)
AN0498 WindowsCorrelated evidence of anomalous browser/network behavior (suspicious external resource fetches and script injection patterns) followed by atypical child processes, ephemeral execution contexts, memory modification or process injection, and unexpected file drops. Defender sees network requests to previously unseen/suspicious domains or resources + browser process spawning unusual children or loading unsigned modules + file writes or registry changes shortly after those requests.WinEventLog:Application
Browser or plugin/application logs showing script errors, plugin enumerations, or unusual extension load events→ DC0038 Application Log Contentetw:Microsoft-Windows-Kernel-ProcessMemory Modification / Unmapped module load or suspicious RWX allocations in the process space of a browser process→ DC0020 Process ModificationNSM:Flowhttp.request: HTTP requests and responses for specific script resources, unexpected content-types (application/octet-stream for script URLs), suspicious referrers, or obfuscated javascript resources→ DC0085 Network Traffic ContentTunable:TimeWindowKnownGoodDomainsListPayloadEntropyThresholdUserContextAN0499 LinuxCorrelated evidence of browser or webview fetches to uncommon domains or mutated JS resources (proxy/NGFW logs + Zeek/HTTP logs) followed by unexpected interpreters or script engines executing (python, ruby, sh) spawned from browser processes or user sessions, rapid on-disk staging in /tmp, and outbound connections that deviate from baseline. Defender sees: uncommon resource fetch → short-lived child process executions from user browser context → file writes in temp directories → anomalous outbound C2-like connections.auditd:SYSCALLexecve: execve calls where a browser/webview process is parent and child is interpreter (python, sh, ruby) or downloader (curl, wget)→ DC0032 Process Creationlinux:syslogApplication or browser logs (webview errors, plugin enumerations) indicating suspicious script evaluation or plugin loads→ DC0038 Application Log ContentNSM:Flowhttp::response: HTTP responses with suspicious content-type for scripts, long obfuscated javascript bodies, or redirects to exploit kit domains→ DC0085 Network Traffic Contentlinux:SysmonNew files in /tmp, /var/tmp, $HOME/.cache, executed within TimeWindow after browser HTTP fetch→ DC0039 File CreationNSM:ConnectionsOutbound connections from newly spawned child processes or from the browser to uncommon endpoints or on anomalous ports→ DC0082 Network Connection CreationTunable:TempPathPatternsUserShellWhitelistDomainRarityThresholdAN0500 macOSCorrelated evidence where Safari/Chrome/WebKit-based processes issue network requests for uncommon or obfuscated JS resources followed by spawning of script interpreters, launchd or ad-hoc binaries, unusual child processes, or dynamic library loads into browser processes. Defender sees: proxy/HTTP logs with suspicious resource content + unifiedlogs/ASL showing browser/plugin crashes or extension loads + process events indicating child process creation and file writes to /var/folders or /tmp shortly after the fetch.macos:unifiedlogLogs from unifiedlogging that show browser crashes, plugin enumerations, extension installs or errors around the same time as suspicious network fetches→ DC0038 Application Log Contentmacos:unifiedlogprocess_create: Process creation where parent is Safari/Google Chrome and child is script interpreter or signed-but-unusual helper binary→ DC0032 Process Creationmacos:unifiedlogNew files written to /var/folders, /tmp, ~/Library/Caches, or ~/Downloads by browser context or its children→ DC0039 File CreationNSM:FlowHTTP/HTTPS requests for script resources flagged by content inspection (excessive obfuscation, eval usage, unusual redirects)→ DC0085 Network Traffic Contentmacos:unifiedlogAnomalous dyld dynamic library loads or RWX memory mappings in browser process→ DC0020 Process ModificationTunable:SleepyUserThresholdExtensionInstallPolicyAN0501 Identity ProviderPost-compromise identity & session anomalies that follow a drive-by compromise: token reuse from new/unfamiliar IPs, anomalous sign-in patterns for previously inactive users, unexpected consent/grant events, or provisioning changes. Defender sees an endpoint/browser compromise (network + endpoint signals) followed by unusual IdP events: new refresh token issuance, consent/consent-grant events, odd MFA bypass patterns, or unusual OAuth client registrations.azure:signinlogsSignIn: Sign-ins flagged as atypical (new geographic region, unfamiliar device id) shortly after correlated endpoint/browser compromise times→ DC0002 User Account Authenticationm365:unifiedApplication Consent grants, new OAuth client registrations, or unusual admin-level activities executed by a user account shortly after suspected drive-by compromise→ DC0038 Application Log Contentsaas:authRefresh token issuance or refresh token usage from new IPs or user agents→ DC0013 User Account MetadataAWS:CloudTrailConsoleLogin: If IdP backed by cloud provider, Console login from new IP/agent after correlated endpoint compromise→ DC0067 Logon Session CreationTunable:IdpAlertWindowHighRiskCountryListDeviceTrustLevel
Sigma rules tagged attack.t1189 (3)
Author: Sohan G (D4rkCiph3r)
· 2023-04-05 · logsource: product=macos category=process_creation · 0250638a-2b28-4541-86fc-ea4c558fa0c6
Detects suspicious child processes spawned from browsers. This could be a result of a potential web browser exploitation.
Author: Florian Roth (Nextron Systems)
· 2017-10-25 (modified 2022-08-08) · logsource: category=proxy · 4922a5dd-6743-4fc2-8e81-144374280997
Detects a flashplayer update from an unofficial location
Author: Saw Win Naung, Nasreddine Bencherchali
· 2021-08-15 (modified 2022-06-14) · logsource: category=webserver · 65354b83-a2ea-4ea6-8414-3ab38be0d409
Detects XSS attempts injected via GET requests in access logs
T1203 Exploitation for Client Execution exploitation technique
- DET0287 Exploitation for Client Execution – cross-platform behavior chain (browser/Office/3rd-party apps)
AN0797 WindowsCause→effect chain: (1) A client app (browser, Office, PDF/Flash/reader) experiences a crash/abnormal exit or loads from an unusual location, then (2) drops or modifies a file in user-writable paths, and/or (3) spawns an unexpected child (e.g., powershell/cmd/mshta/rundll32/wscript/installer), and (4) establishes outbound C2-like connections shortly after. Correlate application logs, file writes, process lineage, and network egress within a short window.Tunable:
TimeWindowHighRiskChildrenUserPathsAllowedPluginsEgressAllowlistAN0798 LinuxCause→effect chain: (1) Browser/Office/reader process logs crash/segfault or abnormal sandbox message, (2) new executable/script/write occurs in $HOME (Downloads, ~/.cache, /tmp), (3) unexpected child like curl/wget/bash/python opens network connections soon after.Tunable:TimeWindowUserPathsHighRiskChildrenPackageUpdatersAN0799 macOSCause→effect chain: (1) App crash/abnormal termination in unified logs for Safari/Chrome/Office/Preview, (2) new files/scripts in ~/Library, ~/Downloads, /private/var/folders/*, (3) unexpected child (osascript, zsh, bash, curl) spawned by those apps, (4) new outbound connections.Tunable:TimeWindowHighRiskChildrenUserPathsQuarantineBypass
Sigma rules tagged attack.t1203 (35)
Author: Florian Roth (Nextron Systems)
· 2017-11-07 (modified 2023-05-18) · logsource: category=proxy · 00d0b5ab-1f55-4120-8e83-487c0a7baf19
Detects download of certain file types from hosts in suspicious TLDs
Author: Florian Roth (Nextron Systems)
· 2019-10-24 (modified 2021-11-27) · logsource: product=windows category=process_creation · 023394c4-29d5-46ab-92b8-6a534c6f447b
Detects suspicious Hangul Word Processor (Hanword) sub processes that could indicate an exploitation
Author: Sohan G (D4rkCiph3r)
· 2023-04-05 · logsource: product=macos category=process_creation · 0250638a-2b28-4541-86fc-ea4c558fa0c6
Detects suspicious child processes spawned from browsers. This could be a result of a potential web browser exploitation.
Author: Arnim Rupp (Nextron Systems)
· 2026-06-15 · logsource: category=antivirus · 101a1877-2cf4-474d-abfd-7f6ac4788d1a
Detects a highly relevant Antivirus alert that reports APT malware.
This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-08-31 · logsource: product=windows category=process_creation · 146aace8-9bd6-42ba-be7a-0070d8027b76
Detects potentially suspicious child processes of WinRAR.exe.
Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC
· 2021-10-15 (modified 2022-10-05) · logsource: product=linux category=process_creation · 21541900-27a9-4454-9c4c-3f0a4240344a
Rule to detect the use of the SCX RunAsProvider Invoke_ExecuteShellCommand to execute any UNIX/Linux command using the /bin/sh shell.
SCXcore, started as the Microsoft Operations Manager UNIX/Linux Agent, is now used in a host of products including
Microsoft Operations Manager, Microsoft Azure, and Microsoft Operations Management Suite.
Author: Florian Roth (Nextron Systems), Arnim Rupp
· 2018-09-09 (modified 2026-06-15) · logsource: category=antivirus · 238527ad-3c2c-4e4f-a1f6-92fd63adb864
Detects a highly relevant Antivirus alert that reports an exploitation framework.
This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.
Author: Florian Roth
· 2025-01-18 · logsource: product=linux category=process_creation · 297241f3-8108-4b3a-8c15-2dda9f844594
Detects the execution of a shell as sub process of "rsync" without the expected command line flag "-e" being used, which could be an indication of exploitation as described in CVE-2024-12084. This behavior is commonly associated with attempts to execute arbitrary commands or escalate privileges, potentially leading to unauthorized access or further exploitation.
Author: Sittikorn S, frack113
· 2021-07-16 (modified 2023-08-17) · logsource: product=windows category=registry_set · 32b5db62-cb5f-4266-9639-0fa48376ac00
Detects patterns as noticed in exploitation of Windows CVE-2021-31979 CVE-2021-33771 vulnerability and DevilsTongue malware by threat group Sourgum
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-06-12 (modified 2024-03-12) · logsource: product=windows category=network_connection · 3c21219b-49b5-4268-bce6-c914ed50f09c
Detects network connections from "dfsvc.exe" used to handled ClickOnce applications to non-local IPs
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-05-20 · logsource: category=webserver · 41956f7c-7a6b-46d6-b6bb-da6eb2e83fbe
Detects potential exploitation of a chained vulnerability attack targeting Ivanti EPMM 12.5.0.0.
CVE-2025-4427 allows unauthenticated access to protected API endpoints via an authentication bypass,
which can then be leveraged to trigger CVE-2025-4428 — a remote code execution vulnerability through
template injection. This sequence enables unauthenticated remote code execution, significantly increasing
the impact of exploitation.
Author: Huntress Labs, Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-10-31 · logsource: product=windows category=process_creation · 43259cc4-1b80-4931-bd98-baea01afc196
Detects the creation of command-line interpreters (cmd.exe, powershell.exe) as child processes of Windows Server Update Services (WSUS) related process wsusservice.exe.
This behavior is a key indicator of exploitation for the critical remote code execution vulnerability such as CVE-2025-59287, where attackers spawn shells to conduct reconnaissance and further post-exploitation activities.
Author: Florian Roth (Nextron Systems), Zach Mathis
· 2020-01-15 (modified 2022-10-22) · logsource: product=windows service=application · 48d91a3a-2363-43ba-a456-ca71ac3da5c2
Detects events generated by user-mode applications when they call the CveEventWrite API when a known vulnerability is trying to be exploited.
MS started using this log in Jan. 2020 with CVE-2020-0601 (a Windows CryptoAPI vulnerability.
Unfortunately, that is about the only instance of CVEs being written to this log.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-06-12 (modified 2024-01-31) · logsource: product=windows category=network_connection · 4c5fba4a-9ef6-4f16-823d-606246054741
Detects an initiated network connection over uncommon ports from "dfsvc.exe". A utility used to handled ClickOnce applications.
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-11-25 · logsource: product=windows category=process_creation · 5299fadf-f228-4526-8274-251db1960be9
Detects the execution of `bun_environment.js` via the Bun runtime, a behavior associated with the Shai-Hulud "Second Coming" NPM supply chain attack.
The malware uses a `setup_bun.js` script to install the Bun runtime if not present, and then executes the malicious `bun_environment.js` payload.
All 35 rules on the technique page →
T1497 Virtualization/Sandbox Evasion primary impact
- DET0046 Detection Strategy for T1497 Virtualization/Sandbox Evasion
AN0127 WindowsExecution of discovery commands or API calls for virtualization artifacts (e.g., registry keys, device drivers, services), sleep/skipped execution behavior, or sandbox evasion DLLs before payload deployment.Tunable:
TimeWindowKnownVMArtifactListAN0128 LinuxExecution of commands to enumerate virtualization-related files or processes (e.g., '/sys/class/dmi/id/product_name', dmesg, lscpu, lspci), or querying hypervisor interfaces prior to malware execution.auditd:SYSCALLexecve or syscall invoking vm artifact check commands (e.g., dmidecode, lspci, dmesg)→ DC0032 Process Creationauditd:SYSCALLsleep function usage or loops (nanosleep, usleep) in scripts→ DC0064 Command ExecutionTunable:TimeWindowCommandArtifactMatchListAN0129 macOSExecution of scripts or binaries that check for virtualization indicators (e.g., system_profiler, ioreg -l, kextstat), combined with delay functions or anomalous launchd activity.macos:unifiedlogexecution of system_profiler, ioreg, kextstat with argument patterns related to VM/sandbox checks→ DC0032 Process Creationmacos:unifiedlogdynamic loading of sleep-related functions or sandbox detection libraries→ DC0016 Module LoadTunable:ProcessCommandPatternSleepThreshold
Sigma rules tagged attack.t1497 (0)
None. MITRE's strategy above is the only public detection guidance for this technique.