Palo Alto Networks Security Advisories / PAN-SA-2025-0013

PAN-SA-2025-0013 Chromium: Monthly Vulnerability Update (July 2025)

Urgency MODERATE

047910
Severity 8.6 · HIGH
Exploit Maturity ATTACKED
Response Effort MODERATE
Recovery USER
Value Density DIFFUSE
Attack Vector NETWORK
Attack Complexity LOW
Attack Requirements NONE
Automatable NO
User Interaction ACTIVE
Product Confidentiality HIGH
Product Integrity HIGH
Product Availability HIGH
Privileges Required NONE
Subsequent Confidentiality NONE
Subsequent Integrity NONE
Subsequent Availability NONE

Description

Palo Alto Networks incorporated the following Chromium security fixes into our products:

CVESummary
CVE-2025-5958Use after free in Media
CVE-2025-5959Type Confusion in V8
CVE-2025-6191Integer overflow in V8
CVE-2025-6192Use after free in Metrics
CVE-2025-6554Type confusion in V8
CVE-2025-6555Use after free in Animation
CVE-2025-6556Insufficient policy enforcement in Loader
CVE-2025-6557Insufficient data validation in DevTools

Product Status

VersionsAffectedUnaffected
Prisma Access Browser< 137.16.6.120
>= 138.33.5.97

Required Configuration for Exposure

No special configuration is required to be affected by this issue.

Severity: HIGH, Suggested Urgency: MODERATE

CVSS-BT: 8.6 / CVSS-B: 8.6 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/AU:N/R:U/V:D/RE:M/U:Amber)

Exploitation Status

Palo Alto Networks is not aware of any malicious exploitation of this issue.

Solution

CVEPrisma Access Browser
CVE-2025-5958
137.16.6.120
CVE-2025-5959
137.16.6.120
CVE-2025-6191
137.27.4.120
CVE-2025-6192
137.27.4.120
CVE-2025-6554
138.33.5.97
CVE-2025-6555
138.33.5.97
CVE-2025-6556
138.33.5.97
CVE-2025-6557
138.33.5.97

Workarounds and Mitigations

No workaround or mitigation is available.

CPE Applicability

Timeline

Initial publication
© 2025 Palo Alto Networks, Inc. All rights reserved.