Security readout for executives and security teams
Plain-English summary
CVE-2025-14174 is a high-severity Chrome for Mac vulnerability in ANGLE, Chrome’s graphics translation layer. A malicious web page could trigger unsafe memory access. The provided sources do not show confirmed active exploitation, but browser flaws with high confidentiality, integrity, and availability impact warrant prompt patching.
Executive priority
Make this a rapid browser update item for Mac fleets. It is not currently supported as actively exploited by the provided sources, but the impact is high and browser exposure is broad.
Technical view
The CVE describes out-of-bounds memory access in ANGLE in Google Chrome on Mac before 143.0.7499.110. It is mapped to CWE-119 with CVSS 3.1 score 8.8: network, low complexity, no privileges, user interaction required, and high C/I/A impact.
Likely exposure
Exposure is most likely on macOS endpoints running Google Chrome versions before 143.0.7499.110. Risk is higher where browser updates are delayed, unmanaged, or users commonly access untrusted websites or HTML content.
Exploitation context
A remote attacker would need a user to load crafted HTML content. The source bundle marks KEV as false, and the cited CISA KEV reference does not support active exploitation status here. No public exploit details are provided in the sources.
Researcher notes
The Chromium issue may have limited public detail. Avoid assuming exploitability beyond the CVE text: remote crafted HTML, user interaction required, and out-of-bounds memory access in ANGLE. No sandbox escape, exploit chain, or non-Mac Chrome exposure is established by the provided sources.
Mitigation direction
- Update Google Chrome on Mac to 143.0.7499.110 or later.
- Prioritize managed macOS fleets and users with high web exposure.
- Confirm automatic browser updates are enabled and functioning.
- Review vendor guidance for Chromium-based browser applicability.
- Monitor Chrome release notes for follow-up fixes or clarifications.
Validation and detection
- Inventory Chrome versions on macOS endpoints.
- Flag Chrome for Mac versions below 143.0.7499.110.
- Verify updated systems report 143.0.7499.110 or later.
- Check browser management tooling for update failures.
- Review CISA KEV status for any future exploitation listing.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-119: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2025-14174 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.8 (3.1)
- Known Exploited
- Yes
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CISA KEV status
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H2.85.9Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
8.8HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://chromereleases.googleblog.com/2025/12/stable-channel-update-for-desktop_10.htmlCVE reference
- https://issues.chromium.org/issues/466192044CVE reference
- https://learn.microsoft.com/en-us/deployedge/microsoft-edge-relnotes-securityCVE reference · third-party-advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-14174CVE reference · government-resource
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Restriction of Operations within the Bounds of a Memory Buffer
Improper Restriction of Operations within the Bounds of a Memory Buffer represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.