iOS 18.6 and macOS Sequoia 15.6 Address Chrome Zero-Day Attack - MacRumorsOpen MenuShow RoundupsShow Forums menuVisit ForumsOpen Sidebar
Skip to Content

iOS 18.6 and macOS Sequoia 15.6 Address Chrome Zero-Day Attack

by

The iOS 18.6, iPadOS 18.6, and macOS Sequoia 15.6 updates that Apple released yesterday address a major zero-day attack that targeted Chrome users, according to Bleeping Computer.

Chrome Feature 22
Apple says that CVE-2025-6558 was a vulnerability in open source code that also affected Apple software. The flaw could allow remote attackers to execute arbitrary code using HTML pages created for that purpose, escaping Chrome's sandboxing. Google patched the issue on July 15, and said that it had been actively exploited.

In Safari, Apple said that the issue could cause unexpected crashing, but it wasn't known to have been used in attacks against Safari users.

Google hasn't offered up technical details on how the exploit worked, and the company said that additional information would be restricted until the majority of users have updated their devices. Chrome users who have not installed the latest version of Chrome should do so.

Popular Stories

iOS 27 Next to iPhone

Here's When iOS 27 Rolls Out Today in Every Time Zone [Update: It's Out]

Sunday September 13, 2026 3:00 am PDT by
Update 10:04 a.m.: iOS 27 is rolling out now, though it may take a bit for all users to see it, so keep checking! Apple is about to release iOS 27, which will finally deliver more advanced Siri AI capabilities as well as a variety of other refinements, improvements, and new features to iPhones. It's Apple's biggest software update of the year, and Apple announced at Wednesday's iPhone event...
Read Full Article • 151 comments
iOS 27 Icon iPhone

iOS 27 Available Now With These 8 New Features

Monday September 14, 2026 9:00 am PDT by
Update — 10 a.m. Pacific Time: Apple has released iOS 27. During its iPhone 18 Pro and iPhone Duo event last week, Apple announced that iOS 27 will be released widely on Monday, September 14. iOS 27 should be available around 10 a.m. Pacific Time / 1 p.m. Eastern Time today via the Settings app, under General → Software Update. Below, we have highlighted eight new features and...
Read Full Article • 111 comments
Apple iCloud Plus expansion hero

iCloud+ Now Includes Apple TV, Apple Arcade, and Curated Apple Music Stations in Over 100 Countries

Tuesday September 15, 2026 1:43 am PDT by
Apple today announced a new subscription initiative that turns paid iCloud+ subscriptions into a broader services bundle in more than 100 countries. In select countries, Apple says every paid iCloud+ plan, including the cheapest 50GB tier, now includes Apple TV and Apple Arcade "at no additional cost," while family sharing extends the storage, TV and Arcade access to up to five people....
Read Full Article • 103 comments

Top Rated Comments

adamw Avatar
adamw
15 months ago

Good reason not to trust Google ever :rolleyes:
This not only applies to Google Chrome, but also appears to affect Safari (by causing a crash to it.) Here is more about this exploit:

Insufficient validation of untrusted input in ANGLE and GPU in Google Chrome prior to 138.0.7204.157 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

Tracked as CVE-2025-6558 ('https://nvd.nist.gov/vuln/detail/CVE-2025-6558'), the security bug is due to the incorrect validation of untrusted input in the ANGLE (Almost Native Graphics Layer Engine) open-source graphics abstraction layer, which processes GPU commands and translates OpenGL ES API calls to Direct3D, Metal, Vulkan, and OpenGL.

The vulnerability enables remote attackers to execute arbitrary code within the browser's GPU process via specially crafted HTML pages, potentially allowing them to escape the sandbox that isolates browser processes from the underlying operating system.
Score: 12 Votes (Like | Disagree)
ArtOfWarfare Avatar
ArtOfWarfare
15 months ago

Good reason not to trust Google ever :rolleyes:
This impacts all Chromium browsers, so Brave, Edge, Opera, and most other browsers not named Firefox or Safari.

The same issue causes Safari to crash, which while inconvenient, is preferable to having malicious code able to access data that it shouldn't.

What happens in Firefox?
Score: 11 Votes (Like | Disagree)
L
Love-hate 🍏 relationship
15 months ago

Good reason not to trust Google ever :rolleyes:
You know how often this has happened to safari? I'll tell you: a damn lot

And when this happens, you need a WHOLE OS update to fix it , while chrome only needs an app update most of the time (not this time around though)
Score: 7 Votes (Like | Disagree)
star-affinity Avatar
star-affinity
15 months ago

Good reason not to trust Google ever :rolleyes:

Well, that's not true as Safari is a separate download on Ventura and Sonoma (and every other supported macOS that's not the current one). Having to install a whole point update on the most recent macOS is a choice Apple makes.
But what is true is that security problems are continuously discovered in software from all vendors and it’s definitely not the last time it happens in code written by folks from Google nor Apple.
Score: 6 Votes (Like | Disagree)
adamw Avatar
adamw
15 months ago

How is that even possible unless the person downloads a file or allows third party apps? 😬
Sounds like if a Google Chrome (or Safari) user went to view any web page with the malicious code embedded, it could take over their whole system by "allowing remote users to execute arbitrary code" on their machine. Appears to affect anyone using the web browser to view an infected web site, and not only to affect downloads of files or third party apps.
Score: 6 Votes (Like | Disagree)
C
culex
15 months ago

Apple released yesterday address a major zero-day attack that targeted Chrome users
How can Apple fix a Chrome bug? That's right, they can't. They simply used the same buggy open source code in Webkit and patched it two weeks after Google. Pretty misleading headline.
Score: 5 Votes (Like | Disagree)
Read All Comments