CVE-2025-14174
Out of bounds memory access in ANGLE in Google Chrome on Mac prior to 143.0.7499.110 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)
Actively exploited
- In the CISA exploited-vulnerabilities catalogue since Dec 12, 2025
- US federal agencies must remediate it by Jan 2, 2026 (BOD 22-01)
- Attacked 1 day before the vulnerability was made public
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Source: CISA KEV · Sep 8, 2026 Apr 19, 2026 Mar 18, 2026 Mar 18, 2026 Feb 23, 2026 Jan 20, 2026
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HAffected products
| Vendors | Product | Versions |
|---|---|---|
| chrome | < 143.0.7499.110 | |
| apple | macos | - |
| linux | linux kernel | - |
| microsoft | windows | - |
| apple | safari | < 26.2 |
| apple | ipados | < 18.7.3 |
| apple | iphone os | < 18.7.3 |
| apple | tvos | < 26.2 |
| apple | visionos | < 26.2 |
| apple | watchos | < 26.2 |
| microsoft | edge chromium | < 143.0.3650.80 |
Related articles
APTCoruna and DarkSword: Advanced iOS Exploits Fall into Cybercriminal Hands
The Coruna and DarkSword iOS exploit chains, initially associated with state-sponsored actors and mercenary surveillance vendors, are now spreading among
VulnerabilitiesApple Closes CoreGraphics Memory Flaw Linked to Precision iPhone Attacks
Apple patched CVE-2026-86950, a CoreGraphics out-of-bounds flaw enabling code execution in targeted iPhone attacks. Update iOS 26.7.1 and macOS now.
This product uses the NVD API but is not endorsed or certified by the NVD.