Executive brief
Google Chrome and other Chromium-based browsers like Microsoft Edge are affected by a memory safety vulnerability. By tricking a user into visiting a specially crafted website, a remote attacker can access sensitive information or potentially crash the browser. This vulnerability is reportedly being exploited in the wild, making immediate updates critical to protect user data and system stability.
Technical details
An out-of-bounds memory access vulnerability exists in the ANGLE (Almost Native Graphics Layer Engine) component of Google Chromium. The root cause is improper restriction of operations within the bounds of a memory buffer (CWE-119/CWE-787). A remote, unauthenticated attacker can exploit this by inducing a user to visit a malicious HTML page. Successful exploitation allows the attacker to perform unauthorized memory reads or writes, which can lead to sensitive data exposure or process termination. This vulnerability has been observed in active exploitation (KEV) and is patched in Chrome version 143.0.7499.110 and Edge version 143.0.3650.80.
Affected products
- Google Chrome prior to 143.0.7499.110
- Microsoft Edge Chromium prior to 143.0.3650.80
Timeline
- 2025-12-12: disclosed
- 2025-12-12: advisory
- 2025-12-12: kev added: Added to CISA KEV catalog due to active exploitation.
- 2025-12-12: exploited