Microsoft Edge Fixes Actively Exploited Chromium Flaw — Update Immediately

Microsoft has released a critical security update for its Edge browser, addressing a high-severity vulnerability in the Chromium engine that is currently being exploited in the wild.

The update, available in Microsoft Edge Stable Channel Version 138.0.3351.65, patches CVE-2025-6554—a flaw that security experts urge all users to remediate without delay.

CVE-2025-6554 is a type confusion vulnerability found in the V8 JavaScript engine, the core component responsible for processing JavaScript in Chromium-based browsers such as Edge and Chrome. 

CVE	Component	Severity	CVSS v3.1	Description
CVE-2025-6554	Chromium V8 Engine	High	8.1	Type confusion, remote code execution4

Type confusion occurs when a program incorrectly assumes the type of an object, allowing attackers to access memory or execute code in unintended ways.

In this case, a remote attacker can exploit the flaw by tricking users into visiting a malicious website, which can then execute arbitrary code on the victim’s machine.

Google’s Threat Analysis Group first reported the vulnerability, confirming that it is being actively exploited in real-world attacks. 

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2025-6554 to its Known Exploited Vulnerabilities Catalog, signaling the urgent need for patching across both public and private sectors. 

The flaw is rated with a CVSS v3.1 base score of 8.1 (High), reflecting its potential for significant impact on confidentiality and integrity, though it does not directly affect availability.

Technical Details and Impact

• Vulnerability Type: Type confusion in V8 JavaScript engine
• Attack Vector: Network (requires user interaction, such as visiting a malicious site)
• Privileges Required: None
• Impact: High confidentiality and integrity compromise, remote code execution possible
• Exploit Status: Actively exploited zero-day

Successful exploitation could allow attackers to install malware, steal sensitive data, or gain control of the affected system, especially if the user has elevated privilege.

Alongside the Chromium patch, Microsoft Edge 138.0.3351.65 also addresses an Edge-specific vulnerability, CVE-2025-49713, which could allow unauthorized remote code execution due to a type confusion error. 

Both vulnerabilities raise the risk of system compromise if left unpatched.

All users and administrators are strongly advised to update Microsoft Edge to version 138.0.3351.65 or later immediately.

This update is available for Windows, macOS, iOS, and Android platforms. 

Delaying the installation of this patch leaves systems vulnerable to ongoing attacks leveraging this flaw.

For organizations, especially those in high-risk sectors, prompt patching is critical to prevent exploitation and potential system compromise.

Exclusive Webinar Alert: Harnessing Intel® Processor Innovations for Advanced API Security – Register for Free