CVE-2025-14174High· 8.8▾ Abyssal⚠ Exploited in the wild0dayPoC availableOut of bounds memory access in ANGLE in Google Chrome on Mac prior to 143.0.7499.110 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)
▾ Abyssal zone — Critical with a public exploit or in-the-wild use
impact 48.4 · likelihood 11.1 · exploitation 25
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 21.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Federal remediation due Jan 2, 2026
22%
Last analysed / modified upstream
22% → 55%
3 GitHub repos (last check)
Added to the CISA catalog on Dec 12, 2025. Federal remediation due Jan 2, 2026. View catalog ↗
Out of bounds memory access in ANGLE in Google Chrome on Mac prior to 143.0.7499.110 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)
chrome >= 143.0.7499.41, < 143.0.7499.110chrome >= 143.0.7499.40, < 143.0.7499.109chrome <= 143.0.7499.40safari < 26.2ipados < 18.7.3ipados >= 26.0, < 26.2iphone_os < 18.7.3iphone_os >= 26.0, < 26.2macos < 26.2tvos < 26.2visionos < 26.2watchos < 26.2edge_chromium < 143.0.3650.80Upgrade past the affected range:
chrome 143.0.7499.109safari 26.2ipados 26.2iphone_os 26.2macos 26.2tvos 26.2visionos 26.2watchos 26.2edge_chromium 143.0.3650.80Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-87491High· 8.8Out of bounds write in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page
CVE-2026-113331High· 8.8Memory corruption in Controls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page
CVE-2026-85046High· 8.8Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page
CVE-2026-113341Medium· 6.5Memory corruption in Skia in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page
CVE-2026-113279High· 8.8Memory corruption in Accessibility in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page
CVE-2026-113280High· 8.8Memory corruption in Paint in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page