Grafana has rolled out security updates to address four high-severity vulnerabilities in the Chromium library used in the Grafana Image Renderer plugin and Synthetic Monitoring Agent.
The most important of these issues is CVE-2025-6554, a type confusion in Chrome’s V8 JavaScript engine that could be exploited remotely to perform arbitrary read/write operations, which was exploited in the wild as a zero-day.
“Google is aware that an exploit for CVE-2025-6554 exists in the wild,” Google said last week, when it announced that Chrome versions 138.0.7204.96/.97 for Windows, versions 138.0.7204.92/.93 for macOS, and version 138.0.7204.96 for Linux contain patches for the bug.
Grafana also released patches for CVE-2025-5959, a type confusion bug in the V8 engine that could allow remote attackers to execute arbitrary code within the sandbox, using crafted HTML pages.
Google resolved the issue in Chrome versions 137.0.7151.103/.104 for Windows and macOS, and in version 137.0.7151.103 for Linux.
Additionally, the Image Renderer plugin and Synthetic Monitoring Agent received patches for CVE-2025-6191, an integer overflow defect in Chrome’s V8 engine, and CVE-2025-6192, a use-after-free in the browser’s Profiler component.
Resolved in Chrome versions 137.0.7151.119/.120 for Windows and macOS, and version 137.0.7151.119 for Linux, these flaws could allow remote attackers to potentially perform out-of-bounds memory access and exploit heap corruption, respectively.
According to Grafana, these vulnerabilities impact Grafana Image Renderer versions prior to 3.12.9 and Synthetic Monitoring Agent releases before 0.38.3 and users should update to the patched iterations as soon as possible.
“Users who operate the Grafana Image Renderer plugin or have a local installation of the Synthetic Monitoring Agent are advised to update their systems,” Grafana says, noting that cloud deployments have been automatically updated.
“Security is a continuous and collaborative process, and we acted quickly to mitigate these third-party vulnerabilities once they were disclosed. As soon as we were made aware of the Chromium-related issues via our bug bounty program, we prioritized updates to impacted components, issued patches to all affected Grafana Cloud services, and worked closely with our managed service partners to ensure full coverage. While these CVEs originate in the Chromium library, we take our responsibility to the community and our customers seriously and encourage all users to update immediately,” Grafana Labs CISO Joe McManus said in an emailed statement.
Related: Grafana Flaws Likely Targeted in Broad SSRF Exploitation Campaign
Related: Code Execution Vulnerability Patched in GitHub Enterprise Server
Related: Critical Authentication Bypass Flaw Patched in Teleport
Related:High-Severity Vulnerabilities Patched by Cisco, Atlassian
