CVE-2025-14174: listed in the CISA KEV catalog

CVE-2025-14174 · CVSS 8.8 HIGH · EPSS 43% · KEV 2025-12-12 · patch available

Out of bounds memory access in ANGLE in Google Chrome on Mac prior to 143.0.7499.110 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)

Is CVE-2025-14174 exploited?

• Listed in the CISA KEV catalog on 2025-12-12.
• Federal remediation due 2026-01-02.
• Past that date by 315 days.
• EPSS puts exploitation in the next 30 days at 43%.
• Public exploit code: none found in monitored sources.

Which products and versions are affected?

• Google · Chrome · >= 143.0.7499.110, < 143.0.7499.110
• apple · safari · < 26.2
• apple · ipados · < 18.7.3, >= 26.0, < 26.2
• apple · iphone os · < 18.7.3, >= 26.0, < 26.2
• apple · macos · < 26.2
• apple · tvos · < 26.2
• apple · visionos · < 26.2
• apple · watchos · < 26.2
• microsoft · edge chromium · < 143.0.3650.80

Is there a patch?

Yes. Update to one of these or later:

From NVD's analysis

What PlainSec published about CVE-2025-14174

• Coruna and DarkSword go mass-market (2026-08-10)
• 90 Zero-Days Hit Enterprise Security and Networking Devices (2026-03-07)

Primary sources

• NVD record
• CISA KEV catalog

KEV and EPSS are re-checked daily. Record last updated 2026-11-12.