CVE-2025-14174
High 8.8 Exploited in the wild (KEV)
Confirmed active exploitation — CISA KEV catalog
- Name
- Google Chromium Out of Bounds Memory Access Vulnerability
- Added to catalog
- Remediation due date (US federal)
- Required action
- Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Description
Out of bounds memory access in ANGLE in Google Chrome on Mac prior to 143.0.7499.110 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)
Metrics
- CVSS 3.1
-
8.8 (HIGH)
Score source: CNA
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - EPSS — exploit probability
- 55% (percentile: 99) as of 1 November 2026
- CWE
- CWE-787, CWE-119
Affected products
google: chrome; apple: macos; linux: linux kernel; microsoft: windows; apple: safari; apple: ipados; apple: iphone os; apple: tvos; apple: visionos; apple: watchos; microsoft: edge chromium
References
- https://chromereleases.googleblog.com/2025/12/stable-channel-update-for-desktop… Release Notes
- https://issues.chromium.org/issues/466192044 Permissions Required
- https://learn.microsoft.com/en-us/deployedge/microsoft-edge-relnotes-security Third Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025… Third Party Advisory