CVE-2025-14372: Google Chrome Use After Free Vulnerability

CVE-2025-14372 Overview

CVE-2025-14372 is a use-after-free vulnerability in the Password Manager component of Google Chrome prior to version 143.0.7499.110. A remote attacker can exploit the flaw by serving a crafted HTML page that triggers reuse of freed memory in the Password Manager. Successful exploitation can lead to a sandbox escape, allowing attacker-controlled code to break out of the renderer's isolation boundary. The issue is tracked under [CWE-416: Use After Free] and was addressed in the Chrome Stable Channel update released on December 10, 2025. Google rates the Chromium security severity as Medium.

Critical Impact
Remote attackers can trigger a sandbox escape in Chrome by enticing a user to visit a malicious HTML page, undermining a core browser security boundary.

Affected Products

Google Chrome versions prior to 143.0.7499.110
Chrome installations on Microsoft Windows, Apple macOS, and Linux
Downstream Chromium-based browsers that have not merged the upstream fix

Discovery Timeline

2025-12-12 - CVE-2025-14372 published to the National Vulnerability Database
2025-12-19 - Last updated in NVD database

Technical Details for CVE-2025-14372

Vulnerability Analysis

The vulnerability is a use-after-free condition in Chrome's Password Manager component. A use-after-free occurs when a program continues to reference memory after that memory has been released. An attacker who controls the freed object's contents can manipulate the dangling pointer to redirect program execution or corrupt internal state.

In this case, a crafted HTML page drives the Password Manager into a state where an object is freed while another code path still holds a reference to it. When that reference is subsequently dereferenced, attacker-influenced data is treated as a valid object. Chromium classifies the resulting impact as enabling a sandbox escape, meaning the flaw can be chained to move execution out of the constrained renderer process.

The issue tracks under [CWE-416] and impacts all supported desktop platforms shipping Chrome before 143.0.7499.110. The EPSS score is 0.052%, indicating low observed exploitation likelihood at the time of publication.

Root Cause

The root cause is improper object lifetime management within the Password Manager code path. A reference to a Password Manager object outlives the object itself, leaving a dangling pointer that is later reused. Browser components such as Password Manager interact with renderer-supplied data, which provides an attacker with the input needed to influence object allocations and timing.

Attack Vector

Exploitation is network-based and requires user interaction. The target must navigate to or load attacker-controlled HTML content, for example through a malicious site, a compromised page, or an embedded iframe. No authentication is required. Once the crafted page executes, it manipulates Password Manager interactions to reach the vulnerable code path and trigger the use-after-free. Practical exploitation typically requires chaining the bug with additional primitives to achieve a full renderer-to-system sandbox escape.

No public proof-of-concept code is available. Technical details are restricted in the Chromium Issue Tracker #460599518 pending broad patch deployment.

Detection Methods for CVE-2025-14372

Indicators of Compromise

Chrome renderer process crashes with heap corruption signatures correlated to recent navigation events
Unexpected child processes spawned by chrome.exe or the Chrome helper process following web browsing activity
Outbound connections from browser processes to previously unseen domains immediately after a renderer crash
Browser telemetry showing Password Manager interactions on pages without legitimate credential fields

Detection Strategies

Inventory Chrome installations across the fleet and flag any host running a version below 143.0.7499.110
Monitor browser process integrity using EDR rules that detect anomalous memory access patterns and renderer-to-system transitions
Correlate web proxy logs with endpoint crash telemetry to identify users visiting pages that consistently destabilize Chrome

Monitoring Recommendations

Forward Chrome crash reports and Windows Error Reporting data to a centralized analytics pipeline for review
Track post-exploitation behaviors such as credential dumping, persistence creation, or lateral movement originating from browser process trees
Alert on execution of unsigned binaries or scripts whose parent process is a Chrome renderer or helper

How to Mitigate CVE-2025-14372

Immediate Actions Required

Update Google Chrome to version 143.0.7499.110 or later on Windows, macOS, and Linux endpoints
Restart Chrome after the update to ensure the patched binary is loaded into memory
Push the update through enterprise management tooling such as Chrome Browser Cloud Management, Group Policy, or MDM to enforce compliance
Audit Chromium-derived browsers in the environment and apply equivalent vendor patches once available

Patch Information

Google released the fix in the Chrome Stable Channel update covered by the Chrome Releases blog post for December 10, 2025. Users on 143.0.7499.110 or later for Windows and macOS, and the corresponding Linux build, are protected. Issue details are referenced in the Chromium Issue Tracker #460599518.

Workarounds

Restrict browsing to trusted sites using web filtering or DNS-based controls until patching is complete
Disable the built-in Password Manager via the PasswordManagerEnabled enterprise policy where operationally feasible to reduce exposure to the vulnerable code path
Enforce site isolation and ensure default Chrome sandboxing protections remain enabled on all managed endpoints

bash

# Verify installed Chrome version on Windows
reg query "HKLM\Software\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv

# Verify installed Chrome version on macOS
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version

# Verify installed Chrome version on Linux
google-chrome --version