iOS 18.6 and macOS Sequoia 15.6 Address Chrome Zero-Day Attack

The iOS 18.6, iPadOS 18.6, and macOS Sequoia 15.6 updates that Apple released yesterday address a major zero-day attack that targeted Chrome users, according to Bleeping Computer.

Chrome Feature 22
Apple says that CVE-2025-6558 was a vulnerability in open source code that also affected Apple software. The flaw could allow remote attackers to execute arbitrary code using HTML pages created for that purpose, escaping Chrome's sandboxing. Google patched the issue on July 15, and said that it had been actively exploited.

In Safari, Apple said that the issue could cause unexpected crashing, but it wasn't known to have been used in attacks against Safari users.

Google hasn't offered up technical details on how the exploit worked, and the company said that additional information would be restricted until the majority of users have updated their devices. Chrome users who have not installed the latest version of Chrome should do so.

Popular Stories

iOS 26

iOS 26.1 Coming Soon: New Features for Your iPhone and Release Date

Monday October 27, 2025 7:55 am PDT by
The upcoming iOS 26.1 update includes a handful of new features and changes for iPhones, including a toggle for changing the appearance of the Liquid Glass design, "slide to stop" for alarms in the Clock app, and more. Below, we outline key details about iOS 26.1. Release Date Given that Apple has yet to seed an iOS 26.1 Release Candidate, which is typically the final beta version, the...
iOS 26

6 New Things Your iPhone Can Do in iOS 26.1

Wednesday October 29, 2025 4:22 am PDT by
Apple is about to drop iOS 26.1, the first major point release since iOS 26 was rolled out in September, and there are at least six notable changes and improvements to look forward to. We've rounded them up below. Apple has already provided developers and public beta testers with the release candidate version of iOS 26.1, which means Apple will likely roll out the update to all compatible...
maxresdefault

Apple TV 4K Could Still Launch Before 2025 Ends: All the Rumored Features

Monday October 27, 2025 4:51 pm PDT by
Apple is designing an updated version of the Apple TV 4K, and rumors suggest that it could come out sometime in the next couple of months. We're not expecting a major overhaul with design changes, but even a simple chip upgrade will bring major improvements to Apple's set-top box. Subscribe to the MacRumors YouTube channel for more videos. We've rounded up all the latest Apple TV rumors. ...
M6 MacBook Pro Feature 1

M6 MacBook Pro: Release Date, Pricing, and What to Expect

Monday October 27, 2025 9:15 am PDT by
Apple this month refreshed the 14-inch MacBook Pro base model with its new M5 chip, and higher-end 14-inch and 16-inch MacBook Pro models with M5 Pro and M5 Max chips are expected to follow in early 2026. However, these machines will represent the final update to the current design, with Apple reportedly developing a completely new version of the MacBook Pro packed with next-generation hardware...
iOS 26

Apple Seeds iOS 26.1, iPadOS 26.1, and macOS Tahoe 26.1 Release Candidates

Tuesday October 28, 2025 1:07 pm PDT by
Apple today provided developers and public beta testers with the release candidate versions of upcoming iOS 26.1, iPadOS 26.1, macOS Tahoe 26.1, tvOS 26.1, watchOS 26.1, and visionOS 26.1 updates for testing purposes. The RCs betas come a week after Apple released the fourth betas. The new betas can be downloaded from the Settings app on a compatible device by going to General > Software...
iOS 26 Battery Glass Feature

iOS 26.1 Beta Liquid Glass Battery Drain Test: Tinted vs Clear Mode

Friday October 24, 2025 2:30 pm PDT by
In the fourth iOS 26.1 beta, Apple added a "Tinted" option that reduces the translucency of Liquid Glass for those who prefer a more opaque look. I saw some comments wondering whether the setting might preserve battery life, so I thought I'd do some testing. Test Settings I did four separate tests using the iPhone 17 Pro Max, and I kept the parameters as similar as possible. Here are the...
ios 26 digital id passport wallet

Apple Says U.S. Passport Feature on iPhone is Coming Soon

Monday October 27, 2025 7:41 am PDT by
You will "soon" be able to add a digital version of your U.S. passport to your iPhone, according to Jennifer Bailey, vice president of Apple Pay and Apple Wallet. Bailey reiterated that the feature is coming soon during her keynote at the Money20/20 USA conference in Las Vegas on Sunday. On its iOS 26 page, Apple says the delayed feature will be "coming later this year." Apple's...
macos tahoe

Here Are Apple's Release Notes for macOS Tahoe 26.1

Tuesday October 28, 2025 1:21 pm PDT by
Apple today provided developers and public beta testers with the release candidate version of macOS Tahoe 26.1, which means the update will likely see a public launch next week. The release candidate includes notes on what's in the update, so we have a full picture of the new features that Apple has included. macOS Tahoe 26.1 adds AutoMix support over AirPlay, improved FaceTime audio...
iPhone Car Key Kia

Another Vehicle Brand Gaining iPhone Car Keys Support

Tuesday October 28, 2025 5:27 am PDT by
Apple is preparing to bring support for its digital car key feature to Jetour vehicles, according to evidence uncovered on Apple's backend by MacRumors contributor Aaron Perris. Introduced in 2022, Car Keys allows an iPhone or Apple Watch to unlock a vehicle through the Wallet app. A digital version of a car key is stored in Wallet, and unlocking can be done by holding an Apple Watch or...

Top Rated Comments

adamw Avatar
13 weeks ago

Good reason not to trust Google ever :rolleyes:
This not only applies to Google Chrome, but also appears to affect Safari (by causing a crash to it.) Here is more about this exploit:

Insufficient validation of untrusted input in ANGLE and GPU in Google Chrome prior to 138.0.7204.157 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

Tracked as CVE-2025-6558 ('https://nvd.nist.gov/vuln/detail/CVE-2025-6558'), the security bug is due to the incorrect validation of untrusted input in the ANGLE (Almost Native Graphics Layer Engine) open-source graphics abstraction layer, which processes GPU commands and translates OpenGL ES API calls to Direct3D, Metal, Vulkan, and OpenGL.

The vulnerability enables remote attackers to execute arbitrary code within the browser's GPU process via specially crafted HTML pages, potentially allowing them to escape the sandbox that isolates browser processes from the underlying operating system.
Score: 12 Votes (Like | Disagree)
ArtOfWarfare Avatar
13 weeks ago

Good reason not to trust Google ever :rolleyes:
This impacts all Chromium browsers, so Brave, Edge, Opera, and most other browsers not named Firefox or Safari.

The same issue causes Safari to crash, which while inconvenient, is preferable to having malicious code able to access data that it shouldn't.

What happens in Firefox?
Score: 11 Votes (Like | Disagree)
Love-hate ? relationship Avatar
13 weeks ago

Good reason not to trust Google ever :rolleyes:
You know how often this has happened to safari? I'll tell you: a damn lot

And when this happens, you need a WHOLE OS update to fix it , while chrome only needs an app update most of the time (not this time around though)
Score: 7 Votes (Like | Disagree)
adamw Avatar
13 weeks ago

How is that even possible unless the person downloads a file or allows third party apps? ?
Sounds like if a Google Chrome (or Safari) user went to view any web page with the malicious code embedded, it could take over their whole system by "allowing remote users to execute arbitrary code" on their machine. Appears to affect anyone using the web browser to view an infected web site, and not only to affect downloads of files or third party apps.
Score: 6 Votes (Like | Disagree)
star-affinity Avatar
13 weeks ago

Good reason not to trust Google ever :rolleyes:

Well, that's not true as Safari is a separate download on Ventura and Sonoma (and every other supported macOS that's not the current one). Having to install a whole point update on the most recent macOS is a choice Apple makes.
But what is true is that security problems are continuously discovered in software from all vendors and it’s definitely not the last time it happens in code written by folks from Google nor Apple.
Score: 6 Votes (Like | Disagree)
culex Avatar
13 weeks ago

Apple released yesterday address a major zero-day attack that targeted Chrome users
How can Apple fix a Chrome bug? That's right, they can't. They simply used the same buggy open source code in Webkit and patched it two weeks after Google. Pretty misleading headline.
Score: 5 Votes (Like | Disagree)