CVE-2025-14174
Google Chromium Out of Bounds Memory Access Vulnerability
Description
CVE-2025-14174 is a high-severity out-of-bounds memory access vulnerability in the ANGLE graphics layer of Google Chrome on macOS. With a CVSS v3.1 base score of 8.8, this flaw allows a remote attacker to perform out-of-bounds memory access via a crafted HTML page, potentially leading to arbitrary code execution. The vulnerability affects Chrome versions prior to 143.0.7499.110 on Mac, as well as multiple Apple products that share the underlying WebKit/graphics engine components. It is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of January 2, 2026, and carries an EPSS score of 0.00836 (74.3rd percentile), indicating elevated exploitation probability.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| chrome | >= 143.0.7499.41, < 143.0.7499.110; >= 143.0.7499.40, < 143.0.7499.109; <= 143.0.7499.40 | |
| apple | safari | < 26.2 |
| apple | ipados | < 18.7.3; >= 26.0, < 26.2 |
| apple | iphone os | < 18.7.3; >= 26.0, < 26.2 |
| apple | macos | < 26.2 |
| apple | tvos | < 26.2 |
| apple | visionos | < 26.2 |
| apple | watchos | < 26.2 |
| microsoft | edge chromium | < 143.0.3650.80 |
References
- https://chromereleases.googleblog.com/2025/12/stable-channel-update-for-desktop_10.html(Release Notes)
- https://issues.chromium.org/issues/466192044(Permissions Required)
- https://learn.microsoft.com/en-us/deployedge/microsoft-edge-relnotes-security(Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-14174(Third Party Advisory)
Weakness Type
CWE-787: Out-of-bounds Write
CVE-2025-14174 is primarily classified under CWE-787, which describes a condition where software writes data past the end or before the beginning of an allocated memory buffer. In the context of the ANGLE (Almost Native Graphics Layer Engine) component, out-of-bounds writes can occur during GPU-accelerated rendering operations when input data causes the graphics processing code to write beyond allocated buffer boundaries. This can corrupt adjacent memory, overwrite critical data structures, and ultimately enable arbitrary code execution. Learn more about CWE-787
CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
The vulnerability is also classified under CWE-119, the parent category for buffer boundary violations. CWE-119 encompasses any scenario where operations on a memory buffer are not properly constrained to remain within the buffer's allocated boundaries. In ANGLE's case, the improper bounds checking during graphics operations allows an attacker-controlled HTML page to trigger memory operations that exceed the intended buffer limits, creating exploitable memory corruption conditions. Learn more about CWE-119
Impact Analysis
Confidentiality, Integrity, and Availability are all rated as high impact (C:H/I:H/A:H). An attacker who successfully exploits the out-of-bounds memory access in ANGLE can achieve arbitrary code execution within the browser's renderer process. From there, additional sandbox escape techniques may be chained to gain full system access. Even without a sandbox escape, code execution in the renderer process allows reading sensitive data from other web pages, stealing authentication tokens, and manipulating browser behavior.
Business Impact is significant because the vulnerability affects the Chrome browser on macOS, one of the most widely used browser-platform combinations in enterprise environments. Additionally, the affected configurations extend to Apple Safari and multiple Apple operating systems (iOS, iPadOS, macOS, tvOS, visionOS, watchOS), indicating a shared vulnerable component in the graphics rendering pipeline. Organizations with heterogeneous Apple and Chrome deployments face a broad exposure surface.
Exploitation Probability is elevated. The EPSS score of 0.00836 (74.3rd percentile) indicates that this vulnerability is more likely to be exploited than approximately 74% of all known CVEs. Its inclusion in the CISA KEV catalog confirms that active exploitation has been observed. The fact that the vulnerability can be triggered simply by visiting a crafted HTML page makes it an effective vector for watering hole attacks and malvertising campaigns. The ransomware association is listed as "Unknown" by CISA.
Exploit Maturity
CVE-2025-14174 has confirmed active exploitation in the wild, as evidenced by its inclusion in the CISA Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of January 2, 2026. The EPSS score of 0.00836 (74.3rd percentile) further indicates that exploitation activity is above average for this vulnerability.
The vulnerability targets ANGLE, Chrome's graphics abstraction layer that translates OpenGL ES calls to platform-specific graphics APIs. ANGLE vulnerabilities are particularly valuable to exploit developers because the graphics pipeline handles complex data transformations with performance-critical code paths that are prone to memory safety issues. The attack requires only that the victim visit a crafted HTML page (UI:R), making it suitable for deployment through compromised websites, malicious advertisements, or targeted phishing links. Google has acknowledged the vulnerability in its Chrome stable channel update, and Microsoft has also addressed it in Edge security updates. The ransomware association is listed as "Unknown" by CISA, but browser-based code execution vulnerabilities can serve as initial access vectors in sophisticated attack chains.
Remediation
-
Update Google Chrome to Version 143.0.7499.110 or Later — This is the primary remediation for Chrome users on macOS. Chrome's auto-update mechanism should apply this update automatically, but administrators should verify that all managed Chrome installations are running the patched version. For Chromium-based browsers like Microsoft Edge, apply the corresponding vendor update.
-
Update All Affected Apple Products — Since the vulnerability also affects Apple platforms, update Safari to version 26.2, iOS to 18.7.3 or 26.2, iPadOS to 18.7.3 or 26.2, macOS to Tahoe 26.2, tvOS to 26.2, visionOS to 26.2, and watchOS to 26.2. Apple's security advisories provide detailed version information.
-
Enable Browser Auto-Updates in Enterprise Environments — Configure managed browser deployments to receive automatic updates with minimal delay. For Chrome, use Group Policy or MDM profiles to ensure the browser auto-update service is enabled and not restricted to infrequent update windows.
-
Deploy Web Content Filtering — Use DNS-based security services, secure web gateways, or browser isolation solutions to reduce the likelihood of users encountering malicious HTML pages designed to trigger this vulnerability. Block known malicious domains and apply URL reputation checking.
-
Monitor for Exploitation Indicators — Review browser crash reports and system logs for signs of ANGLE-related crashes or unexpected renderer process behavior on macOS systems. Frequent renderer crashes accessing graphics-related code paths may indicate attempted exploitation.
Technical Details
CVE-2025-14174 is an out-of-bounds memory access vulnerability in ANGLE (Almost Native Graphics Layer Engine), a critical component of Google Chrome that provides a translation layer between OpenGL ES API calls and platform-native graphics APIs (Metal on macOS, Direct3D on Windows, Vulkan on Linux). The flaw specifically affects Chrome on macOS prior to version 143.0.7499.110.
CVSS Vector Breakdown: The CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H vector indicates high severity with a user interaction requirement. Attack Vector (AV:N) means the vulnerability is exploitable remotely. Attack Complexity (AC:L) indicates no special conditions are needed. Privileges Required (PR:N) confirms no authentication is necessary. User Interaction (UI:R) means the victim must navigate to or be directed to a malicious page. Scope (S:U) is unchanged. Confidentiality, Integrity, and Availability (C:H/I:H/A:H) are all maximally impacted.
Attack Mechanism: The attacker constructs a malicious HTML page containing WebGL or other graphics API calls designed to trigger a code path in ANGLE that performs out-of-bounds memory operations. When the victim's browser renders the page, ANGLE processes the graphics commands and, due to insufficient bounds checking, writes data beyond the allocated buffer boundary. The attacker leverages this out-of-bounds access to corrupt critical data structures in the renderer process memory, such as virtual function tables or object metadata, redirecting execution flow to attacker-controlled code. On macOS, the Metal graphics backend translates ANGLE operations to Apple's GPU framework, and the vulnerability may reside in the translation logic specific to this backend, which explains why the flaw is Mac-specific in Chrome. The cross-platform impact on Apple products suggests a shared vulnerable component in the graphics rendering pipeline.
Frequently Asked Questions
What is ANGLE and why is it vulnerable?
ANGLE (Almost Native Graphics Layer Engine) is a component in Chrome that translates OpenGL ES graphics calls to platform-specific APIs like Metal on macOS. Graphics processing code handles complex data transformations under performance pressure, making it prone to memory safety issues like out-of-bounds access when processing attacker-crafted input.
Is CVE-2025-14174 being actively exploited?
Yes. CISA has added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation. The EPSS score of 0.00836 (74.3rd percentile) further indicates elevated exploitation activity.
Why does this Chrome vulnerability also affect Apple products?
The vulnerability affects shared graphics rendering components. The affected configurations include Apple Safari, iOS, iPadOS, macOS, tvOS, visionOS, and watchOS, indicating that the vulnerable code path exists in components shared between Chrome's ANGLE on Mac and Apple's graphics processing pipeline.
Can this vulnerability be exploited just by visiting a webpage?
Yes. The attack requires only that the victim navigate to a malicious HTML page (UI:R). The crafted page triggers the out-of-bounds memory access in the graphics layer without any additional user action, making it suitable for drive-by attacks through compromised websites or malicious advertisements.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.