CVE-2025-6556 — Authentication Bypass Using an Alternate Path or Channel in Google Chrome

CWE-288 — Authentication Bypass Using an Alternate Path or Channel8 documents8 sources

Severity

5.4MEDIUMNVD

EPSS

0.0%

top 94.40%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Google Chrome Chromium Paloalto Prisma Browser

Timeline

PublishedJun 24

Latest updateJul 23

Description

Insufficient policy enforcement in Loader in Google Chrome prior to 138.0.7204.49 allowed a remote attacker to bypass content security policy via a crafted HTML page. (Chromium security severity: Low)

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.5

Affected Packages4 packages

▶CVEListV5google/chrome138.0.7204.49 — 138.0.7204.49

▶NVDgoogle/chrome< 138.0.7204.49

▶Debianchromium/chromium< 138.0.7204.49-1~deb12u1+2

▶Palo Altopaloalto/prisma_browser

🔴Vulnerability Details

CVEList

CVE-2025-6556: Insufficient policy enforcement in Loader in Google Chrome prior to 138↗2025-06-24

▶

OSV

CVE-2025-6556: Insufficient policy enforcement in Loader in Google Chrome prior to 138↗2025-06-24

▶

GHSA

GHSA-96h5-q657-fqcv: Insufficient policy enforcement in Loader in Google Chrome prior to 138↗2025-06-24

▶

📋Vendor Advisories

Chrome

Stable Chanel Update for ChromeOS / ChromeOS-Flex: CVE-2025-6556↗2025-07-23

▶

Palo Alto

PAN-SA-2025-0013 Chromium: Monthly Vulnerability Update (July 2025)↗2025-07-09

▶

Microsoft

Chromium: CVE-2025-6556 Insufficient policy enforcement in Loader↗2025-06-10

▶

Debian

CVE-2025-6556: chromium - Insufficient policy enforcement in Loader in Google Chrome prior to 138.0.7204.4...↗2025

▶