# CVE-2025-14174: Google Chromium out of bounds memory access in ANGLE

Source: https://junglewise.ai/threats/cve-2025-14174-google-chromium-out-of-bounds-memory-access-in-angle  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-12-12. Updated: 2026-05-15  
License: CC BY 4.0 with a link back

CVE-2025-14174 · Severity: critical · CVSS 8.8 · Exploited in the wild · Published 2025-12-12

Google Chrome and other Chromium-based browsers like Microsoft Edge are affected by a memory safety vulnerability. By tricking a user into visiting a specially crafted website, a remote attacker can access sensitive information or potentially crash the browser. This vulnerability is reportedly being exploited in the wild, making immediate updates critical to protect user data and system stability.

Technologies: [Google Chrome](https://junglewise.ai/threats/technologies/chrome), [Google Chromium](https://junglewise.ai/threats/technologies/chromium), [Microsoft Edge](https://junglewise.ai/threats/technologies/edge). Vendors: [Google](https://junglewise.ai/threats/vendors/google), [Microsoft](https://junglewise.ai/threats/vendors/microsoft).

## Quick answers

**Is CVE-2025-14174 exploited in the wild?** Yes. CVE-2025-14174 is known to be exploited in the wild, first recorded on 12 December 2025. Treat it as urgent.

**How severe is CVE-2025-14174?** Critical severity, with a CVSS score of 8.8, published 12 December 2025.

**Which products and versions are affected?** Google Chrome prior to 143.0.7499.110; Microsoft Edge prior to 143.0.3650.80.

**Is there a fix for CVE-2025-14174?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2025-14174 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2025-14174?** Check whether you run Google Chrome, Google Chromium or Microsoft Edge at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An out-of-bounds memory access vulnerability exists in the ANGLE (Almost Native Graphics Layer Engine) component of Google Chromium. The root cause is improper restriction of operations within the bounds of a memory buffer (CWE-119/CWE-787). A remote, unauthenticated attacker can exploit this by inducing a user to visit a malicious HTML page. Successful exploitation allows the attacker to perform unauthorized memory reads or writes, which can lead to sensitive data exposure or process termination. This vulnerability has been observed in active exploitation (KEV) and is patched in Chrome version 143.0.7499.110 and Edge version 143.0.3650.80.

## Affected products

- Google Chrome prior to 143.0.7499.110
- Microsoft Edge Chromium prior to 143.0.3650.80

## Timeline

- 2025-12-12: disclosed
- 2025-12-12: advisory
- 2025-12-12: kev added: Added to CISA KEV catalog due to active exploitation.
- 2025-12-12: exploited

## Related threats

- [Google Chrome out of bounds read in Skia](https://junglewise.ai/threats/cve-2026-126922-out-of-bounds-read-in-skia-in-google-chrome-prior-to-157-0-8103)
- [Google Chrome use after free in Accessibility](https://junglewise.ai/threats/cve-2026-126921-use-after-free-in-accessibility-in-google-chrome-prior-to-157-0)
- [Google Chrome information leak in Skia](https://junglewise.ai/threats/cve-2026-126920-information-leak-in-skia-in-google-chrome-prior-to-157-0-8103-78)
- [Google Chrome use-after-free in BrowserTag](https://junglewise.ai/threats/cve-2026-126919-use-after-free-in-browsertag-in-google-chrome-prior-to-157-0)
- [Google Chrome use-after-free in Layout](https://junglewise.ai/threats/cve-2026-126918-use-after-free-in-layout-in-google-chrome-prior-to-157-0-8103-78)