# SSA-365200: Google Chrome V8 Type Confusion Vulnerability (CVE-2025-6554) in Siemens HyperLynx and Industrial Edge App Publisher

> Siemens advisory SSA-365200 reports that HyperLynx and Industrial Edge App Publisher embed Google Chrome versions prior to 138.0.7204.96 that are affected by the V8 type confusion flaw CVE-2025-6554. A remote attacker could achieve arbitrary read/write via a crafted HTML page. Fixes are HyperLynx V2510.0001 and Industrial Edge App Publisher V1.23.5.

- **Published:** 2026-11-07T03:30:07Z
- **Last reviewed:** 2026-11-07T03:30:07Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5477
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5477.png
- **ID:** TL-2026-5477
- **Severity:** HIGH (CVSS 8.1)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 (1 shown free below) · **IOCs:** 9
- **CVEs:** CVE-2025-6554

## Description

CVE-2025-6554 is a type confusion flaw (CWE-843) in the V8 JavaScript and WebAssembly engine of Google Chrome prior to 138.0.7204.96. Per NVD and Chromium, it allowed a remote attacker to perform arbitrary read/write via a crafted HTML page, and Chromium rated it High severity. Google's Threat Analysis Group (Clement Lecigne) reported it on 2025-06-25. Google stated that an exploit for CVE-2025-6554 exists in the wild and mitigated the issue on 2025-06-26 with a configuration change to the Stable channel on all platforms. Fixed Stable builds were 138.0.7204.96/.97 (Windows), 138.0.7204.92/.93 (macOS) and 138.0.7204.96 (Linux). CISA added the CVE to the Known Exploited Vulnerabilities catalog on 2025-07-02 with a due date of 2025-07-23.

Siemens ProductCERT published SSA-365200 on 2025-10-14 (revision 1.1 on 2026-01-13 added HyperLynx remediation details). It states that two Siemens products embed a vulnerable Chrome component: HyperLynx (all versions before V2510.0001) and Industrial Edge App Publisher (all versions before V1.23.5). The general CVSS v3.1 score is 8.1 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N) and the CVSS v4.0 score is 7.0. For HyperLynx, Siemens assigns a lower product-specific score of CVSS v3.1 6.6 (AV:L/AC:L/PR:L/UI:R) and CVSS v4.0 6.8, because exploitation requires local file modification and application access.

The advisory lists no specific workarounds. Siemens recommends applying the fixed versions and following its operational guidelines for industrial security. The Siemens advisory does not state that these Siemens products have been exploited. The in-the-wild exploitation applies to the upstream Chrome flaw. No public proof-of-concept, malware family, C2 infrastructure or network indicators are tied to this advisory in the sources reviewed.

## MITRE ATT&CK

- T1203 Exploitation for Client Execution
- T1204.001 User Execution: Malicious Link
- T1005 Data from Local System
- T1565 Data Manipulation

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**CVE-2025-6554 Vulnerable Chrome/Embedded Chromium (< 138.0.7204.96) Executing — Exploitation Exposure** (`TL-2026-5477-SPL-001`)

Detects execution of chrome.exe (including Chromium copies bundled with Siemens HyperLynx and Industrial Edge App Publisher, SSA-365200) whose file version is below 138.0.7204.96, the fixed build for the V8 type confusion flaw CVE-2025-6554 (CWE-843). Google and CISA KEV confirm in-the-wild exploitation of the upstream flaw via a crafted HTML page, so any running vulnerable build is exposed to drive-by arbitrary read/write.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1203, T1189
- **Data sources:** sysmon, microsoft_defender_endpoint
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h Image="*chrome.exe" | rex field=FileVersion "^(?<v1>[0-9]+)[.](?<v2>[0-9]+)[.](?<v3>[0-9]+)[.](?<v4>[0-9]+)" | eval v1=tonumber(v1), v3=tonumber(v3), v4=tonumber(v4) | where v1<138 OR (v1=138 AND (v3<7204 OR (v3=7204 AND v4<96))) | stats count AS executions min(_time) AS first_seen max(_time) AS last_seen values(ParentImage) AS parents dc(User) AS users BY host, Image, FileVersion | convert ctime(first_seen) ctime(last_seen)
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName =~ 'chrome.exe'
| where isnotempty(ProcessVersionInfoProductVersion)
| where parse_version(ProcessVersionInfoProductVersion) < parse_version('138.0.7204.96')
| summarize Executions=count(), FirstSeen=min(Timestamp), LastSeen=max(Timestamp), Parents=make_set(InitiatingProcessFileName, 10), Folders=make_set(FolderPath, 10) by DeviceName, ProcessVersionInfoProductVersion
| project DeviceName, ProcessVersionInfoProductVersion, Executions, FirstSeen, LastSeen, Parents, Folders
```

### Sigma

```yaml
title: Vulnerable Chrome Build Executing (CVE-2025-6554 V8 Type Confusion)
id: 5b1c7e42-3a6d-4f0e-9c58-7d21e0a4b601
status: experimental
description: Detects chrome.exe, including Chromium bundled with Siemens HyperLynx and Industrial Edge App Publisher (SSA-365200), running a version below 138.0.7204.96, which is exposed to the actively exploited V8 type confusion CVE-2025-6554.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-6554
    - https://cert-portal.siemens.com/productcert/html/ssa-365200.html
    - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/07
tags:
    - attack.execution
    - attack.t1203
    - attack.initial-access
    - attack.t1189
    - cve.2025-6554
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        Image|endswith: '\chrome.exe'
    version_old_major:
        FileVersion|re: '^([0-9]|[1-9][0-9]|1[0-2][0-9]|13[0-7])[.]'
    version_138_old_branch:
        FileVersion|re: '^138[.]0[.](?:[0-6][0-9]{3}|7[01][0-9]{2}|720[0-3])[.]'
    version_138_old_build:
        FileVersion|re: '^138[.]0[.]7204[.](?:[0-9]|[1-8][0-9]|9[0-5])(?:[^0-9]|$)'
    condition: selection_img and 1 of version_*
falsepositives:
    - Portable or offline Chrome copies that are intentionally pinned to an older build
    - Software-packaging or test labs that keep legacy browser versions
level: high
```

**Known false positives:**

- Intentionally pinned legacy Chrome builds in test or packaging labs
- Portable Chrome copies on isolated systems with no web exposure

**Tuning notes:** Sysmon must log EventCode 1 with FileVersion populated. Run as a scheduled exposure report rather than a real-time alert. Extend the Image filter to other Chromium-based binaries bundled with Siemens tools, and exclude hosts already ticketed for patching. Fixed builds are 138.0.7204.96/.97 (Windows).

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- CVE-2025-6554 Embedded Chromium Launched with Sandbox/Web-Security Disabled in Siemens Tooling — Exploitation (locked: unlock with TL Creds)
- CVE-2025-6554 Chrome / Siemens App Host Spawning File-Collection Utilities — Post-Exploitation Collection (locked: unlock with TL Creds)
- CVE-2025-6554 Chrome / Siemens App Host Spawning Download Utilities — Ingress Tool Transfer (locked: unlock with TL Creds)
- CVE-2025-6554 Vulnerable Chrome Launched from Mail/Office/Chat Link — User Execution of Malicious Link (locked: unlock with TL Creds)
- CVE-2025-6554 Chrome / Siemens App Host Spawning Shell or Script Interpreter — Post-Exploitation Execution (locked: unlock with TL Creds)
- CVE-2025-6554 Siemens [indicator] / [indicator] DNS Lookup to Non-Vendor Domain — C2 Resolution (locked: unlock with TL Creds)
- CVE-2025-6554 Siemens [indicator] / [indicator] Local Web/Project File Tampering — Post-Exploitation Precondition (locked: unlock with TL Creds)
- CVE-2025-6554 Siemens [indicator] / [indicator] Outbound Connection to Public IP — C2 / Exfil (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [Siemens Security Advisory SSA-365200](https://cert-portal.siemens.com/productcert/html/ssa-365200.html)
- [NVD - CVE-2025-6554](https://nvd.nist.gov/vuln/detail/CVE-2025-6554)
- [Chrome Releases: Stable Channel Update for Desktop (2025-06-30)](https://chromereleases.googleblog.com/2025/06/stable-channel-update-for-desktop_30.html)
- [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
- [Security Affairs: CISA adds Google Chromium V8 flaw to KEV catalog](https://securityaffairs.com/179682/hacking/u-s-cisa-adds-google-chromium-v8-flaw-to-its-known-exploited-vulnerabilities-catalog.html)
- [The Hacker News: Google Patches Critical Zero-Day Flaw](https://thehackernews.com/2025/07/google-patches-critical-zero-day-flaw.html)
- [Infosecurity Magazine: Google Issues Emergency Patch for Fourth Chrome Zero-Day of 2025](https://www.infosecurity-magazine.com/news/google-patch-chrome-zero-day/)
- [Siemens Operational Guidelines for Industrial Security](https://www.siemens.com/cert/operational-guidelines-industrial-security)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5477