Log in Start free

Actively exploited · Published Dec 12, 2025 · Assigned by Chrome

CVE-2025-14174

High 8.8 Exploited

In plain English

A high-severity memory corruption in Chrome from Google. Attackers are actively exploiting it in the wild (listed by CISA on December 12, 2025). The chance it is exploited in the next 30 days is estimated at 55.3% (higher than 99.0% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.8High
Exploit odds (30 days)55.3%top 1.0% of all CVEs
Exploited in the wildYesCISA KEV since Dec 12, 2025
Attack tooling1Public PoC

CISA guidance

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Federal agencies must remediate by Jan 2, 2026.

Official description

Out of bounds memory access in ANGLE in Google Chrome on Mac prior to 143.0.7499.110 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8webkit2gtk32.50.4-1.el8_10ALSA-2025:23663
AlmaLinux:8webkit2gtk3-devel2.50.4-1.el8_10ALSA-2025:23663
AlmaLinux:8webkit2gtk3-jsc2.50.4-1.el8_10ALSA-2025:23663
AlmaLinux:8webkit2gtk3-jsc-devel2.50.4-1.el8_10ALSA-2025:23663
Alpine:v3.23qt6-qtwebengine6.10.1-r1ALPINE-CVE-2025-14174
Alpine:v3.24qt6-qtwebengine6.10.1-r2ALPINE-CVE-2025-14174
Debian:12webkit2gtk2.50.4-1~deb12u1DEBIAN-CVE-2025-14174
Debian:12webkit2gtk2.50.4-1~deb12u1DSA-6083-1
Debian:13webkit2gtk2.50.4-1~deb13u1DSA-6083-1
Debian:13webkit2gtk2.50.4-1~deb13u1DEBIAN-CVE-2025-14174
Debian:14webkit2gtk2.50.4-1DEBIAN-CVE-2025-14174
Debian:12wpewebkitno fix listedDEBIAN-CVE-2025-14174
Debian:13wpewebkitno fix listedDEBIAN-CVE-2025-14174
Debian:14wpewebkit2.50.4-1DEBIAN-CVE-2025-14174
Ubuntu:22.04:LTSqtwebkit-opensource-srcno fix listedUBUNTU-CVE-2025-14174
Ubuntu:24.04:LTSqtwebkit-opensource-srcno fix listedUBUNTU-CVE-2025-14174
Ubuntu:22.04:LTSwebkit2gtk2.50.4-0ubuntu0.22.04.1UBUNTU-CVE-2025-14174
Ubuntu:22.04:LTSwebkit2gtk2.50.4-0ubuntu0.22.04.1USN-7957-1
Ubuntu:24.04:LTSwebkit2gtk2.50.4-0ubuntu0.24.04.1UBUNTU-CVE-2025-14174
Ubuntu:24.04:LTSwebkit2gtk2.50.4-0ubuntu0.24.04.1USN-7957-1
Ubuntu:25.10webkit2gtk2.50.4-0ubuntu0.25.10.1UBUNTU-CVE-2025-14174
Ubuntu:25.10webkit2gtk2.50.4-0ubuntu0.25.10.1USN-7957-1
Ubuntu:22.04:LTSwpewebkitno fix listedUBUNTU-CVE-2025-14174

Affected products (as reported)

VendorProductVersions
Google Chrome 143.0.7499.110 – before 143.0.7499.110

Weakness: CWE-119 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References