Source: www.securityweek.com – Author: Ionut Arghire
Grafana has rolled out security updates to address four high-severity vulnerabilities in the Chromium library used in the Grafana Image Renderer plugin and Synthetic Monitoring Agent.
The most important of these issues is CVE-2025-6554, a type confusion in Chrome’s V8 JavaScript engine that could be exploited remotely to perform arbitrary read/write operations, which was exploited in the wild as a zero-day.
“Google is aware that an exploit for CVE-2025-6554 exists in the wild,” Google said last week, when it announced that Chrome versions 138.0.7204.96/.97 for Windows, versions 138.0.7204.92/.93 for macOS, and version 138.0.7204.96 for Linux contain patches for the bug.
Grafana also released patches for CVE-2025-5959, a type confusion bug in the V8 engine that could allow remote attackers to execute arbitrary code within the sandbox, using crafted HTML pages.
Google resolved the issue in Chrome versions 137.0.7151.103/.104 for Windows and macOS, and in version 137.0.7151.103 for Linux.
Additionally, the Image Renderer plugin and Synthetic Monitoring Agent received patches for CVE-2025-6191, an integer overflow defect in Chrome’s V8 engine, and CVE-2025-6192, a use-after-free in the browser’s Profiler component.
Resolved in Chrome versions 137.0.7151.119/.120 for Windows and macOS, and version 137.0.7151.119 for Linux, these flaws could allow remote attackers to potentially perform out-of-bounds memory access and exploit heap corruption, respectively.
According to Grafana, these vulnerabilities impact Grafana Image Renderer versions prior to 3.12.9 and Synthetic Monitoring Agent releases before 0.38.3 and users should update to the patched iterations as soon as possible.
Advertisement. Scroll to continue reading.
“Users who operate the Grafana Image Renderer plugin or have a local installation of the Synthetic Monitoring Agent are advised to update their systems,” Grafana says, noting that cloud deployments have been automatically updated.
Related: Grafana Flaws Likely Targeted in Broad SSRF Exploitation Campaign
Related: Code Execution Vulnerability Patched in GitHub Enterprise Server
Related: Critical Authentication Bypass Flaw Patched in Teleport
Related:High-Severity Vulnerabilities Patched by Cisco, Atlassian
Original Post URL: https://www.securityweek.com/grafana-patches-chromium-bugs-including-zero-day-exploited-in-the-wild/
Category & Tags: Vulnerabilities – Vulnerabilities
Views: 1
