CVE-2025-14766CWE-125CWE-787

CVE-2025-14766

High · published December 17, 2025

CVSS v3.1
8.8
EPSS
3%
Percentile
88.1
In the wild
Unconfirmed
What it is

⚡ A crafty crafted HTML page can crash your Chrome experience! This out-of-bounds read and write in V8 may let attackers mess with your heap memory. 🔥 Think of it like a chef who mistakenly adds ingredients in the wrong order, causing a recipe to boil over. Here, the V8 engine is the kitchen, and the mismanaged memory leads to unpredictable results, potentially crashing the whole operation. An attacker could exploit this vulnerability to cause heap corruption, leading to crashes or even executing malicious code. This is particularly concerning as it could allow unauthorized actions on the user's system. Protecting against this could mean the difference between a seamless browsing experience and chaos!

Put simply

Think of it like a chef who mistakenly adds ingredients in the wrong order, causing a recipe to boil over. Here, the V8 engine is the kitchen, and the mismanaged memory leads to unpredictable results, potentially crashing the whole operation. This vulnerability involves out-of-bounds reading and writing in the V8 engine of Google Chrome. It allows for potential heap corruption when handling crafted HTML pages, which can be exploited to manipulate memory.

What to do

An attacker could exploit this vulnerability to cause heap corruption, leading to crashes or even executing malicious code. This is particularly concerning as it could allow unauthorized actions on the user's system. Protecting against this could mean the difference between a seamless browsing experience and chaos! Update Google Chrome to version 143.0.7499.147 or later immediately to mitigate this risk. Regularly check for browser updates as part of your overall security hygiene. It’s always better to be proactive! You've got this! Stay safe and keep your browser updated! 🛡️

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.03218 · 88.1th percentile
Weaknesses
CWE-125 · Out-of-bounds Read; CWE-787 · Out-of-bounds Write
Published
2025-12-17T04:15Z
Affected products (1)
ProductVersionsFixed in
google/chrome< 143.0.7499.146143.0.7499.146
References (2)
EPSS history
Timeline
  • 16 DEC 22:54Z
    Out of bounds read and write in V8 in Google Chrome prior to 143.0.7499.147 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML…
    cvelistv5