CVE-2025-14174
Published 2025-12-12 · Updated 2026-10-07 · Source chrome-cve-admin@google.com
Summary
CVE-2025-14174 is a high-severity (CVSS 8.8) vulnerability in Google Chromium. CISA added it to the Known Exploited Vulnerabilities catalog on December 12, 2025, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by January 2, 2026. CISA does not currently list it as used in ransomware campaigns. Google has 76 vulnerabilities in the KEV catalog, 0 of them linked to ransomware.
All 76 known-exploited Google vulnerabilities →Description
Out of bounds memory access in ANGLE in Google Chrome on Mac prior to 143.0.7499.110 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CISA Known-Exploited Vulnerability
Product: Google — Chromium
Name: Google Chromium Out of Bounds Memory Access Vulnerability
Date added: 2025-12-12 · Due: 2026-01-02
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.