CVE-2025-14174
Published: December 12, 2025
Official Description
Google Chromium contains an out of bounds memory access vulnerability in ANGLE that could allow a remote attacker to perform out of bounds memory access via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
CISA KEV Advisory
Google Chromium Out of Bounds Memory Access Vulnerability
Google Chromium contains an out of bounds memory access vulnerability in ANGLE that could allow a remote attacker to perform out of bounds memory access via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Risk Analysis
This out-of-bounds memory access vulnerability in Google Chromium's ANGLE component allows a remote attacker to perform out-of-bounds memory access via a crafted HTML page. This flaw affects multiple web browsers utilizing Chromium, including Chrome and Edge. The high CVSS score of 8.8 and inclusion in CISA's KEV catalog confirm its severity and active exploitation, making it an urgent threat.
Active exploitation of this vulnerability has been observed in the wild. It is remotely exploitable, requiring user interaction (UI:R) to visit a crafted HTML page.
Users should update Google Chrome, Microsoft Edge, Opera, and any other Chromium-based browsers to the latest versions immediately. Exercise caution when visiting untrusted websites.
Technical Analysis
CVE-2025-14174 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.
Exploitation does not require any privileges, though user interaction (Required) is needed, which slightly reduces the risk of mass automated attacks.
A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 8.8.
CISA has added CVE-2025-14174 to the Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. U.S. federal agencies are required to patch this within the mandated timeframe, and all organizations should treat remediation as urgent.
CVSS v3.1 Vector Breakdown
Affected Vendors & Products
Exploit & PoC Resources
All References (3)
Quick Facts
Recommended Actions
- →Apply vendor patches immediately
- →Monitor CVE-2025-14174 in threat intel feeds
- →Review IDS/IPS signatures for exploitation attempts
- !CISA KEV: Federal agencies must patch per BOD 22-01 timeline
- !Active exploitation confirmed — treat as P1