Type Vulnerability
Google Chromium contains an out of bounds memory access vulnerability in ANGLE that could allow a remote attacker to perform out of bounds memory access via a crafted HTML page.
Google · Memory corruption
Google Chromium Out of Bounds Memory Access Vulnerability
CVE-2025-14174
What this means
This is rated high severity (8.8 out of 10). It is on the known-exploited catalogue, which means attacks using it have already been seen. Ask IT whether Google Chrome, Apple Macos and Linux Linux Kernel, and 8 more are in your estate, and treat that as the priority.
Full vendor description
Out of bounds memory access in ANGLE in Google Chrome on Mac prior to 143.0.7499.110 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)
Scoring and exploitation
8.8/ 10
CVSS 3.1 base scoreHigh
Exploitable over the network without any account, but only if a user takes an action, such as opening a file or link. High impact on confidentiality, integrity and availability.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Exploitability
Longer bar: easier to attack
Attack vectorNetworkAV:N
Attack complexityLowAC:L
Privileges requiredNonePR:N
User interactionRequiredUI:R
ScopeUnchangedS:U
Impact
Longer bar: more harm
ConfidentialityHighC:H
IntegrityHighI:H
AvailabilityHighA:H
- Elevated attack likelihood (~55.3% in 30 days)Model estimate (): a probability signal, not confirmed exploitation
- Exploited in the wild
- Yes — confirmed exploitation (US CISA )
- Not reported
- Listed product
- Google Chromium
Weaknesses
CWE-787CWE-119
Affected products ()
- Google Chrome
- Apple Macos
- Linux Linux Kernel
- Microsoft Windows
- Apple Safari
- Apple Ipados
- Apple Iphone Os
- Apple Tvos
- Apple Visionos
- Apple Watchos
- Microsoft Edge Chromium
Show the raw CPE strings (12)
- cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
- cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*
- cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*
- cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*
- cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*
- cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*
- cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*
- cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*
- cpe:2.3:o:apple:visionos:*:*:*:*:*:*:*:*
- cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*
- cpe:2.3:a:microsoft:edge_chromium:*:*:*:*:*:*:*:*
References
4 links from the CVE record, grouped by site.
chromereleases.googleblog.com1 link
issues.chromium.org1 link
- 466192044 (opens in a new tab)Permissions Required
learn.microsoft.com1 link
- microsoft-edge-relnotes-security (opens in a new tab)Third Party Advisory
cisa.gov1 link
- known-exploited-vulnerabilities-catalog (opens in a new tab)Third Party Advisory