Apple patches security flaw exploited in Chrome zero-day attacks

Apple and Google addressed a high-severity zero-day (CVE-2025-6558) in the ANGLE graphics layer that allows remote code execution in the browser GPU process and may enable sandbox escape; Google TAG discovered the flaw, Google patched Chrome on July 15 noting active exploitation, and Apple released WebKit updates across iOS, iPadOS, macOS, tvOS, visionOS, and watchOS. CISA added the vulnerability to its catalog of known-exploited vulnerabilities and set a remediation deadline for federal agencies, while Apple also disclosed several other zero-days patched earlier in the year.