CVE-2025-14174: Google Chrome Buffer Overflow Vulnerability

CVE-2025-14174 Overview

CVE-2025-14174 is an out-of-bounds memory access vulnerability in ANGLE (Almost Native Graphics Layer Engine), a graphics abstraction layer used by Google Chrome and other Chromium-based browsers. The vulnerability exists in versions of Google Chrome prior to 143.0.7499.110 and allows a remote attacker to perform out-of-bounds memory access through a specially crafted HTML page. This vulnerability has been assigned a Chromium security severity rating of High.

Critical Impact

This vulnerability is actively exploited in the wild and has been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. Remote attackers can leverage this flaw to potentially execute arbitrary code, crash the browser, or access sensitive memory contents by enticing victims to visit malicious web pages.

Affected Products

• Google Chrome prior to version 143.0.7499.110 on macOS, Windows, and Linux
• Microsoft Edge (Chromium-based) - affected versions prior to security update
• Apple Safari, iOS, iPadOS, tvOS, visionOS, and watchOS (related WebKit/graphics components)

Discovery Timeline

• 2025-12-12 - CVE-2025-14174 published to NVD
• 2025-12-15 - Last updated in NVD database

Technical Details for CVE-2025-14174

Vulnerability Analysis

This vulnerability is classified under CWE-787 (Out-of-bounds Write) and CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer). The flaw resides in ANGLE, which serves as the translation layer between OpenGL ES API calls and the underlying graphics APIs (such as Metal on macOS, Direct3D on Windows, and OpenGL on Linux).

When processing certain graphics operations triggered by malicious HTML/JavaScript content, ANGLE fails to properly validate memory boundaries during buffer operations. This allows an attacker to read from or write to memory locations outside the intended buffer boundaries. The vulnerability can be triggered remotely through a network attack vector, requiring only that a user interact with a crafted HTML page (such as visiting a malicious website or viewing compromised web content).

The impact of successful exploitation includes potential arbitrary code execution within the browser's renderer process, information disclosure from adjacent memory regions, and denial of service through browser crashes.

Root Cause

The root cause of CVE-2025-14174 lies in insufficient bounds checking within ANGLE's memory management routines when handling graphics buffer operations. ANGLE processes complex graphics data structures that may contain attacker-controlled size or offset values. When these values are not properly validated against allocated buffer sizes, memory operations can occur outside the intended boundaries.

This type of vulnerability often occurs in graphics processing code where performance optimizations may bypass traditional safety checks, or where complex state management leads to edge cases not properly handled by bounds validation logic.

Attack Vector

The attack vector for this vulnerability is network-based, requiring user interaction. An attacker can exploit this vulnerability by:

1. Crafting a malicious HTML page containing JavaScript that triggers specific ANGLE graphics operations
2. Hosting the malicious content on a compromised or attacker-controlled website
3. Enticing the victim to visit the malicious page through phishing, social engineering, or compromised advertisements
4. When the victim's browser renders the malicious content, the crafted graphics commands trigger the out-of-bounds memory access

The vulnerability has been confirmed as actively exploited in the wild, with CISA adding it to the Known Exploited Vulnerabilities catalog. This indicates that threat actors are leveraging this flaw in real-world attacks.

For detailed technical information, refer to the Chromium Issue Tracker and the Google Chrome Release Update.

Detection Methods for CVE-2025-14174

Indicators of Compromise

• Unexpected browser crashes, particularly when visiting unfamiliar websites or loading graphics-intensive content
• Anomalous memory access patterns in Chrome or Chromium-based browser processes detected by endpoint protection solutions
• Network connections to known malicious domains hosting exploit kits targeting browser vulnerabilities
• Evidence of renderer process crashes in Chrome crash reports with ANGLE-related stack traces

Detection Strategies

• Deploy endpoint detection and response (EDR) solutions capable of monitoring browser process memory operations for anomalous behavior
• Implement network monitoring to detect connections to known malicious infrastructure distributing browser exploits
• Enable browser crash reporting and analyze crash dumps for indicators of exploitation attempts targeting graphics subsystems
• Use threat intelligence feeds to block known malicious URLs and domains associated with this vulnerability

Monitoring Recommendations

• Monitor Chrome and Chromium-based browser version deployments across the organization to identify unpatched instances
• Configure security information and event management (SIEM) systems to alert on browser crash events, particularly those involving renderer processes
• Implement browser isolation technologies to contain potential exploitation of browser vulnerabilities
• Review web proxy logs for access to suspicious or newly registered domains that may host exploit content

How to Mitigate CVE-2025-14174

Immediate Actions Required

• Update Google Chrome to version 143.0.7499.110 or later immediately across all systems
• Update Microsoft Edge to the latest security release that addresses this vulnerability
• Apply vendor patches for Apple Safari, iOS, iPadOS, and other affected Apple products when available
• Prioritize patching for systems with internet-facing browser usage, particularly in high-risk environments

Patch Information

Google has released Chrome version 143.0.7499.110 which addresses this vulnerability. Organizations should deploy this update immediately given the active exploitation status.

For detailed release information, see the Google Chrome Release Update. Microsoft Edge users should consult the Microsoft Edge Security Release Notes for applicable updates.

Due to the inclusion in the CISA Known Exploited Vulnerabilities Catalog, federal agencies and organizations following CISA guidance are required to remediate this vulnerability according to the specified timeline.

Workarounds

• Restrict access to untrusted websites using web filtering solutions until patches can be applied
• Consider enabling site isolation features in Chrome to limit the impact of potential renderer process compromises
• Implement browser isolation solutions to execute web content in sandboxed environments separate from the endpoint
• Deploy network segmentation to limit lateral movement in case of successful exploitation

# Verify Chrome version on Linux/macOS
google-chrome --version
# Expected output: Google Chrome 143.0.7499.110 or higher

# Force Chrome update check (macOS/Linux)
# Navigate to chrome://settings/help in the browser to trigger update

# Windows PowerShell - Check installed Chrome version
Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*' | Where-Object { $_.DisplayName -like "*Google Chrome*" } | Select-Object DisplayName, DisplayVersion