Actively exploited
Listed in CISA’s Known Exploited Vulnerabilities catalog since December 12, 2025.
CVE-2025-14174
Google Chromium Out of Bounds Memory Access Vulnerability
Added to KEV December 12, 2025
Alert details
- Source feed
- CISA KEV
- CVE ID
- CVE-2025-14174
- Affected products
- Chromium · Google Chromium · Google
What happened
Google Chromium contains an out of bounds memory access vulnerability in ANGLE that could allow a remote attacker to perform out of bounds memory access via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
What it means for your business
Google Chromium is listed in CISA's Known Exploited Vulnerabilities catalog (CVE-2025-14174). Google Chromium contains an out of bounds memory access vulnerability in ANGLE that could allow a remote attacker to perform out of bounds memory access via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. CISA remediation due date: 2026-01-02. If you need help checking exposure, call (864) 335-9223.
Required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CISA due date: January 2, 2026
Sources
Related briefs
Google Pixel Improper Authorization Vulnerability
Google Pixel is listed in CISA's Known Exploited Vulnerabilities catalog (CVE-2026-58704). Google Pixel devices contain an improper authorization vulnerability in the cellular modem. A logic error may allow an attacker to bypass permission checks and escalate privileges. CISA remediation due date: 2026-09-19. If you need help checking exposure, call (864) 335-9223.
Google Chromium V8 Out of Bounds Write Vulnerability
Google Chromium V8 is listed in CISA's Known Exploited Vulnerabilities catalog (CVE-2026-87491). Google Chromium V8 contains an out of bounds write vulnerability that allows a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. CISA remediation due date: 2026-09-23. If you need help checking exposure, call (864) 335-9223.
Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability
Citrix NetScaler is listed in CISA's Known Exploited Vulnerabilities catalog (CVE-2026-88779). Citrix NetScaler ADC (formerly Citrix ADC) and Citrix NetScaler Gateway (formerly Citrix Gateway) contain an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow for a denial of service. CISA remediation due date: 2026-10-07. If you need help checking exposure, call (864) 335-9223.
Heap buffer overflow in ANGLE in Microsoft Edge vulnerability
Heap buffer overflow in ANGLE in Microsoft Edge vulnerability (CVE-2025-10502) was added to Microsoft’s security update guidance. Information published. If you need help checking exposure, call (864) 335-9223.
Need help patching?
PremierePC monitors KEV alerts for managed clients and helps teams prioritize remediation before attackers do.