CVE-2025-14174: Google Chromium Out of Bounds Memory Access Vulnerability
Vulnerability summary
CVE-2025-14174 is a high (CVSS 8.8) Out-of-bounds Write vulnerability in Google Chromium. It is known to be exploited: CISA lists it, first on 12-12-2025. EPSS estimates a 22.33% chance of exploitation in the next 30 days, higher than 97.6% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 22 · Related 10Timeline
- 12-12-2025PublishedVulnerability first disclosed.
- 12-12-2025Added to CISA KEVGoogle Chromium Out of Bounds Memory Access Vulnerability
- 02-01-2026CISA remediation dueApply mitigations per vendor instructions.
- 21-09-2026Last modifiedVulnerability information updated.
Description
Out of bounds memory access in ANGLE in Google Chrome on Mac prior to 143.0.7499.110 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)
CVSS metrics
6 scores · 6 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- OSV · WolfiEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- OSV · ChainguardEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- NVDNIST8.8HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS trend
Probability
22.33%
Chance of exploitation in the next 30 days
Percentile
98%
Versus all other CVEs
30-day change
0.00 pp
From 22.33% on 19-09-2026
Known exploited
Compare KEV catalogs
CISA KEVListed- Added
- 12-12-2025
- Federal due date
- 02-01-2026
CISA required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. chromereleases.googleblog.com/2025/12/stable-channel-update-for-desktop_10.html learn.microsoft.com/en-us/deployedge/microsoft-edge-relnotes-security nvd.nist.gov/vuln/detail/CVE-2025-14174
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-787Out-of-bounds WriteThe product writes data past the end, or before the beginning, of the intended buffer.
- CWE-119Improper Restriction of Operations within the Bounds of a Memory BufferThe product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Affected systems
Apple7 products
Ubuntu5 products
- qtwebkit-opensource-srcAll versions (No fix recorded)
- qtwebkit-sourceAll versions (No fix recorded)
- webkit2gtkAll versions (No fix recorded) | < 2.50.4-0ubuntu0.22.04.1 | < 2.50.4-0ubuntu0.24.04.1 | < 2.50.4-0ubuntu0.25.10.1
- webkitgtkAll versions (No fix recorded)
- wpewebkitAll versions (No fix recorded)
Debian2 products
- webkit2gtk< 2.50.4-1~deb12u1 | < 2.50.4-1~deb13u1 | < 2.50.4-1
- wpewebkitAll versions (No fix recorded) | < 2.50.4-1
Chainguard1 product
- chromium< 143.0.7499.169-r0
Google1 product
- chrome≥ 143.0.7499.110, < 143.0.7499.110 | ≥ 143.0.7499.41, < 143.0.7499.110 | ≥ 143.0.7499.40, < 143.0.7499.109 | ≤ 143.0.7499.40
Microsoft1 product
- edge_chromium< 143.0.3650.80
Wolfi1 product
- chromium< 143.0.7499.169-r0
7 vendors · 18 products
References
10 links- chromereleases.googleblog.com/2025/12/stable-channel-update-for-desktop_10.htmlAdvisoryRelease Notes
- www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-14174Government ResourceAdvisoryThird Party Advisory
