Live › vulnerability › CVE-2025-14174
Go to dashboardChromium's ANGLE graphics layer has an out-of-bounds memory access bug that a crafted HTML page can trigger. An attacker who gets a victim to open that page can read or write memory outside its intended bounds, which is the building block for browser compromise.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 5h before NVD. All times on this page are UTC.
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Google Chromium | vendor | – | – |
| google chrome | vendor | >= 143.0.7499.41, < 143.0.7499.110 | 143.0.7499.110 |
| google chrome | vendor | >= 143.0.7499.40, < 143.0.7499.109 | 143.0.7499.109 |
| google chrome | vendor | <= 143.0.7499.40 | – |
| apple safari | vendor | < 26.2 | 26.2 |
| apple ipados |
| vendor |
| < 18.7.3 |
| 18.7.3 |
| apple ipados | vendor | >= 26.0, < 26.2 | 26.2 |
| apple iphone os | vendor | < 18.7.3 | 18.7.3 |
| apple iphone os | vendor | >= 26.0, < 26.2 | 26.2 |
| apple macos | vendor | < 26.2 | 26.2 |
| apple tvos | vendor | < 26.2 | 26.2 |
| apple visionos | vendor | < 26.2 | 26.2 |
| apple watchos | vendor | < 26.2 | 26.2 |
| microsoft edge chromium | vendor | < 143.0.3650.80 | 143.0.3650.80 |
Check the browser version (chrome://version in Chrome, edge://version in Edge) and compare it to the fixed release in the vendor advisory.
Update Google Chrome, Microsoft Edge, Opera and other Chromium-based browsers to the vendor's patched release.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Google Chromium contains an out of bounds memory access vulnerability in ANGLE that could allow a remote attacker to perform out of bounds memory access via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
This page as .md · .json · in your agent: get_signal("CVE-2025-14174")
CISA KEV catalog, Creative Commons 0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.