CISA KEV · Known exploitedHigh

CVE-2025-14174

Google Chromium

Out of bounds memory access in ANGLE in Google Chrome on Mac prior to 143.0.7499.110 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)

CVSS
8.8
EPSS
22.7%
97.5% percentile
CISA KEV
Listed
Published
2025.12.13
PRIORITY ASSESSMENT

Immediate review

CISA has listed this vulnerability in the Known Exploited Vulnerabilities catalog.

Known exploitationConfirmed by CISA KEV
Exploit probability22.7%
Technical severityCVSS 8.8

Vulnerability overview

Out of bounds memory access in ANGLE in Google Chrome on Mac prior to 143.0.7499.110 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)

Affected product and versions

Product
Google Chromium
Affected versions
143.0.7499.110, >= 143.0.7499.41 < 143.0.7499.110, >= 143.0.7499.40 < 143.0.7499.109, <= 143.0.7499.40, < 26.2, < 18.7.3, >= 26.0 < 26.2, < 143.0.3650.80
Fixed versions
143.0.7499.110, 143.0.7499.109, 26.2, 18.7.3, 143.0.3650.80

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide
CISA required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Due date: 2026.01.02
  1. 1
    Identify

    Confirm that Google Chromium and an affected version are present.

  2. 2
    Prioritize

    Combine exploitation signals with asset exposure and business criticality.

  3. 3
    Remediate

    Follow the vendor advisory or supported update path and preserve rollback options.

  4. 4
    Verify

    Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE
CWE-119, CWE-787
KEV added
2025.12.12
Ransomware use
미확인