SSA-365200: Google Chrome V8 Type Confusion Vulnerability (CVE-2025-6554) in Siemens HyperLynx and Industrial Edge App Publisher

Key facts for HyperLynx Chrome V8 flaw

Detection coverage for HyperLynx Chrome V8 flaw

As of 2026-11-07, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5477 across Splunk SPL, Microsoft KQL and Sigma, covering 9 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: CVE-2025-6554 Vulnerable Chrome/Embedded Chromium (< 138.0.7204.96) Executing — Exploitation Exposure

Detects execution of chrome.exe (including Chromium copies bundled with Siemens HyperLynx and Industrial Edge App Publisher, SSA-365200) whose file version is below 138.0.7204.96, the fixed build for the V8 type confusion flaw CVE-2025-6554 (CWE-843). Google and CISA KEV confirm in-the-wild exploitation of the upstream flaw via a crafted HTML page, so any running vulnerable build is exposed to drive-by arbitrary read/write.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1203, T1189
• Data sources: sysmon, microsoft_defender_endpoint
• Severity: high
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h Image="*chrome.exe" | rex field=FileVersion "^(?<v1>[0-9]+)[.](?<v2>[0-9]+)[.](?<v3>[0-9]+)[.](?<v4>[0-9]+)" | eval v1=tonumber(v1), v3=tonumber(v3), v4=tonumber(v4) | where v1<138 OR (v1=138 AND (v3<7204 OR (v3=7204 AND v4<96))) | stats count AS executions min(_time) AS first_seen max(_time) AS last_seen values(ParentImage) AS parents dc(User) AS users BY host, Image, FileVersion | convert ctime(first_seen) ctime(last_seen)

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName =~ 'chrome.exe'
| where isnotempty(ProcessVersionInfoProductVersion)
| where parse_version(ProcessVersionInfoProductVersion) < parse_version('138.0.7204.96')
| summarize Executions=count(), FirstSeen=min(Timestamp), LastSeen=max(Timestamp), Parents=make_set(InitiatingProcessFileName, 10), Folders=make_set(FolderPath, 10) by DeviceName, ProcessVersionInfoProductVersion
| project DeviceName, ProcessVersionInfoProductVersion, Executions, FirstSeen, LastSeen, Parents, Folders

Sigma

title: Vulnerable Chrome Build Executing (CVE-2025-6554 V8 Type Confusion)
id: 5b1c7e42-3a6d-4f0e-9c58-7d21e0a4b601
status: experimental
description: Detects chrome.exe, including Chromium bundled with Siemens HyperLynx and Industrial Edge App Publisher (SSA-365200), running a version below 138.0.7204.96, which is exposed to the actively exploited V8 type confusion CVE-2025-6554.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-6554
    - https://cert-portal.siemens.com/productcert/html/ssa-365200.html
    - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/07
tags:
    - attack.execution
    - attack.t1203
    - attack.initial-access
    - attack.t1189
    - cve.2025-6554
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        Image|endswith: '\chrome.exe'
    version_old_major:
        FileVersion|re: '^([0-9]|[1-9][0-9]|1[0-2][0-9]|13[0-7])[.]'
    version_138_old_branch:
        FileVersion|re: '^138[.]0[.](?:[0-6][0-9]{3}|7[01][0-9]{2}|720[0-3])[.]'
    version_138_old_build:
        FileVersion|re: '^138[.]0[.]7204[.](?:[0-9]|[1-8][0-9]|9[0-5])(?:[^0-9]|$)'
    condition: selection_img and 1 of version_*
falsepositives:
    - Portable or offline Chrome copies that are intentionally pinned to an older build
    - Software-packaging or test labs that keep legacy browser versions
level: high

Known false positives:

• Intentionally pinned legacy Chrome builds in test or packaging labs
• Portable Chrome copies on isolated systems with no web exposure

Tuning notes: Sysmon must log EventCode 1 with FileVersion populated. Run as a scheduled exposure report rather than a real-time alert. Extend the Image filter to other Chromium-based binaries bundled with Siemens tools, and exclude hosts already ticketed for patching. Fixed builds are 138.0.7204.96/.97 (Windows).

• 🔒 CVE-2025-6554 Embedded Chromium Launched with Sandbox/Web-Security Disabled in Siemens Tooling — Exploitation · unlock with TL Creds
• 🔒 CVE-2025-6554 Chrome / Siemens App Host Spawning File-Collection Utilities — Post-Exploitation Collection · unlock with TL Creds
• 🔒 CVE-2025-6554 Chrome / Siemens App Host Spawning Download Utilities — Ingress Tool Transfer · unlock with TL Creds
• 🔒 CVE-2025-6554 Vulnerable Chrome Launched from Mail/Office/Chat Link — User Execution of Malicious Link · unlock with TL Creds
• 🔒 CVE-2025-6554 Chrome / Siemens App Host Spawning Shell or Script Interpreter — Post-Exploitation Execution · unlock with TL Creds
• 🔒 CVE-2025-6554 Siemens [indicator] / [indicator] DNS Lookup to Non-Vendor Domain — C2 Resolution · unlock with TL Creds
• 🔒 CVE-2025-6554 Siemens [indicator] / [indicator] Local Web/Project File Tampering — Post-Exploitation Precondition · unlock with TL Creds
• 🔒 CVE-2025-6554 Siemens [indicator] / [indicator] Outbound Connection to Public IP — C2 / Exfil · unlock with TL Creds

Indicators of compromise for HyperLynx Chrome V8 flaw

As of 2026-11-07, Threadlinqs Intelligence tracks 9 indicators of compromise for TL-2026-5477.

How HyperLynx Chrome V8 flaw works

Fixes are HyperLynx V2510.0001 and Industrial Edge App Publisher V1.23.5.

CVE-2025-6554 is a type confusion flaw (CWE-843) in the V8 JavaScript and WebAssembly engine of Google Chrome prior to 138.0.7204.96. Per NVD and Chromium, it allowed a remote attacker to perform arbitrary read/write via a crafted HTML page, and Chromium rated it High severity. Google's Threat Analysis Group (Clement Lecigne) reported it on 2025-06-25. Google stated that an exploit for CVE-2025-6554 exists in the wild and mitigated the issue on 2025-06-26 with a configuration change to the Stable channel on all platforms. Fixed Stable builds were 138.0.7204.96/.97 (Windows), 138.0.7204.92/.93 (macOS) and 138.0.7204.96 (Linux). CISA added the CVE to the Known Exploited Vulnerabilities catalog on 2025-07-02 with a due date of 2025-07-23.

Siemens ProductCERT published SSA-365200 on 2025-10-14 (revision 1.1 on 2026-01-13 added HyperLynx remediation details). It states that two Siemens products embed a vulnerable Chrome component: HyperLynx (all versions before V2510.0001) and Industrial Edge App Publisher (all versions before V1.23.5). The general CVSS v3.1 score is 8.1 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N) and the CVSS v4.0 score is 7.0. For HyperLynx, Siemens assigns a lower product-specific score of CVSS v3.1 6.6 (AV:L/AC:L/PR:L/UI:R) and CVSS v4.0 6.8, because exploitation requires local file modification and application access.

The advisory lists no specific workarounds. Siemens recommends applying the fixed versions and following its operational guidelines for industrial security. The Siemens advisory does not state that these Siemens products have been exploited. The in-the-wild exploitation applies to the upstream Chrome flaw. No public proof-of-concept, malware family, C2 infrastructure or network indicators are tied to this advisory in the sources reviewed.

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System

Execution

T1203 Exploitation for Client Execution; T1204.001 User Execution: Malicious Link

Impact

T1565 Data Manipulation

Remediation for HyperLynx Chrome V8 flaw

Patches

• HyperLynx V2510.0001
• Industrial Edge App Publisher V1.23.5
• Google Chrome 138.0.7204.96 or later

Immediate actions

• Update HyperLynx to V2510.0001 or later
• Update Industrial Edge App Publisher to V1.23.5 or later
• Inventory systems embedding Chromium/Chrome components older than 138.0.7204.96

Workarounds

• No specific workarounds listed by Siemens; apply updates and network protections per Siemens guidelines

Longer-term hardening

• Follow Siemens operational guidelines for industrial security
• Track embedded browser engine versions in engineering and OT tooling
• Restrict engineering workstations from browsing untrusted web content

Affected and fixed versions

• Siemens — HyperLynx
  Vulnerable versions: < V2510.0001
  Fixed in: V2510.0001
• Siemens — Industrial Edge App Publisher
  Vulnerable versions: < V1.23.5
  Fixed in: V1.23.5
• Google — Chrome
  Vulnerable versions: < 138.0.7204.96
  Fixed in: 138.0.7204.96

Timeline of HyperLynx Chrome V8 flaw

• 2025-06-25 locked-ioc-8 of locked-ioc-6 reports the V8 type confusion bug (CVE-2025-6554) to Chrome
• 2025-06-26 Google mitigates the issue with a configuration change pushed to the Stable channel on all platforms
• 2025-06-30 Chrome 138.0.7204.96/.97 (Windows), 138.0.7204.92/.93 (macOS) and 138.0.7204.96 (Linux) released; CVE-2025-6554 published to NVD; Google confirms an exploit exists in the wild
• 2025-07-02 CISA adds CVE-2025-6554 to the Known Exploited Vulnerabilities catalog
• 2025-07-23 CISA KEV remediation due date for federal agencies
• 2025-10-14 Siemens publishes SSA-365200 (V1.0) covering locked-ioc-9 and locked-ioc-5
• 2026-01-13 Siemens releases SSA-365200 V1.1, adding locked-ioc-9 remediation details (fixed in V2510.0001)

Sources cited for HyperLynx Chrome V8 flaw

• Siemens Security Advisory SSA-365200 cert-portal.siemens.com · Advisory · 2025-10-14
• NVD - CVE-2025-6554 NVD (NIST) · Advisory · 2025-06-30
• CISA Known Exploited Vulnerabilities Catalog CISA · Government advisory · 2025-07-02
• Chrome Releases: Stable Channel Update for Desktop (2025-06-30) chromereleases.googleblog.com · Vendor report · 2025-06-30
• Siemens Operational Guidelines for Industrial Security siemens.com · Vendor report · 2025-10-14
• Security Affairs: CISA adds Google Chromium V8 flaw to KEV catalog securityaffairs.com · News · 2025-07-02
• The Hacker News: Google Patches Critical Zero-Day Flaw The Hacker News · News · 2025-07-01
• Infosecurity Magazine: Google Issues Emergency Patch for Fourth Chrome Zero-Day of 2025 infosecurity-magazine.com · News · 2025-07-01

More in vulnerability

• Local Privilege Escalation in Siemens TeleControl Server Basic before V3.1.2.4 (CVE-2025-40942)
• Privilege Escalation in WIBU CodeMeter Runtime Affecting Siemens Desigo CC Product Family and SENTRON Powermanager (CVE-2025-47809)
• Siemens SSA-282044: DLL Hijacking in Siemens Web Installer (SIWA) used by Online Software Delivery (CVE-2025-30033)
• Siemens SSA-364175: Multiple Vulnerabilities in Palo Alto Networks Virtual NGFW on RUGGEDCOM APE1808 (CVE-2024-3596, CVE-2025-4231 and others)
• PHP2Shell (CVE-2026-109618, CVE-2026-109619) and Node2Shell (CVE-2026-111497) exploited vulnerabilities; Insignary-Chk detection tool released

Other reports on CVE-2025-6554

• Hack-for-Hire Espionage Campaign Targeting MENA Civil Society via Predator/Intellexa Mercenary Spyware