CVE-2025-14174KEV · OVERDUECWE-119CWE-787

Google Chromium Out of Bounds Memory Access Vulnerability

High · published December 13, 2025

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 8.8. It is confirmed in active exploitation. It sits in the 97.7th percentile for exploit probability.

295
days past CISA
deadline
CVSS v3.1
8.8
EPSS
22%
Percentile
97.7
In the wild
Confirmed
What it is

🚨 An attacker can exploit a crafty HTML page to access memory outside its bounds in Chrome on Mac versions before 143.0.7499.110! Hang tight, this one is a big deal! ⚡ Think of it like a waiter who accidentally serves someone else’s dish because they didn’t check the order properly — accessing memory that’s not yours can lead to all sorts of trouble, just like mixing up who gets what at dinner. With this vulnerability, a remote attacker could potentially gain access to sensitive information or execute arbitrary code on your machine. The consequences could lead to significant data breaches or system compromises, making it a serious concern for any user.

Put simply

Think of it like a waiter who accidentally serves someone else’s dish because they didn’t check the order properly — accessing memory that’s not yours can lead to all sorts of trouble, just like mixing up who gets what at dinner. This out of bounds memory access flaw in ANGLE allows attackers to manipulate memory in ways that the application doesn't expect, creating a pathway for malicious code execution via specially crafted HTML content.

What to do

With this vulnerability, a remote attacker could potentially gain access to sensitive information or execute arbitrary code on your machine. The consequences could lead to significant data breaches or system compromises, making it a serious concern for any user. To protect yourself, update Google Chrome on your Mac to version 143.0.7499.110 or later immediately. Additionally, ensure any extensions are also up to date, and consider enabling security features like Safe Browsing for added protection. You've got this! Stay proactive and keep your browser secure! 🛡️

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.22327 · 97.7th percentile
Weaknesses
CWE-119 · Improper Restriction of Operations within the Bounds of a Memory Buffer; CWE-787 · Out-of-bounds Write
Published
2025-12-13T01:15Z
KEV added
2025-12-12 · due 2026-01-02
Affected products (13)
ProductVersionsFixed in
google/chrome≥ 143.0.7499.41, < 143.0.7499.110143.0.7499.110
google/chrome≥ 143.0.7499.40, < 143.0.7499.109143.0.7499.109
google/chrome≤ 143.0.7499.40—
apple/safari< 26.226.2
apple/ipados< 18.7.318.7.3
apple/ipados≥ 26.0, < 26.226.2
apple/iphone_os< 18.7.318.7.3
apple/iphone_os≥ 26.0, < 26.226.2
apple/macos< 26.226.2
apple/tvos< 26.226.2
apple/visionos< 26.226.2
apple/watchos< 26.226.2
microsoft/edge_chromium< 143.0.3650.80143.0.3650.80
References (4)
EPSS history
Timeline
  • 12 DEC 19:20Z
    Out of bounds memory access in ANGLE in Google Chrome on Mac prior to 143.0.7499.110 allowed a remote attacker to perform out of bounds memory access via a…
    cvelistv5
  • 12 DEC 00:00Z
    Added to CISA KEV — remediate by Jan 2
    kev