CVE-2025-14174: Google Chromium Out of Bounds Memory Access Vulnerability

Google Chromium contains an out of bounds memory access vulnerability in the ANGLE component. A remote attacker could exploit it by serving a crafted HTML page to a victim browser. This affects multiple Chromium-based browsers and requires attention from IT and security teams because it can lead to unauthorized memory access.

How it works

The vulnerability is an out of bounds memory access in ANGLE. An attacker can trigger this by delivering a specially crafted HTML page that the browser renders.

Technical readers should treat this as a classic memory-safety issue in a graphics translation layer. The browser processes untrusted web content and may read or write memory outside expected bounds.

Am I affected? How to find it in your systems

Chromium powers several common web browsers. Inventory all instances of Google Chrome, Microsoft Edge, Opera, and other Chromium-derived browsers in your environment. Confirm the presence of the vulnerability and affected versions against the vendor advisory.

• Use endpoint management platforms or software inventory tools to list installed browsers and their versions.
• Review enterprise browser policies for any custom configurations that affect rendering or graphics layers.
• Examine web proxy or endpoint logs for repeated requests to suspicious domains that serve HTML content, noting any associated browser crashes or memory-related errors.

How to remediate

Apply the update provided in the vendor advisory. Follow any additional instructions from the browser vendors.

• Deploy patches through centralized management consoles for enterprise browser fleets.
• Verify that updates have reached all managed and unmanaged endpoints after rollout.
• Reassess any internal web applications that rely on advanced graphics features once patches are in place.

If you can't patch immediately

Apply mitigations according to vendor instructions. Follow applicable BOD 22-01 guidance for cloud services. Discontinue use of the product if mitigations cannot be applied.

• Restrict browser access to untrusted sites through network controls or proxy policies until updates are installed.
• Monitor endpoint telemetry for signs of memory corruption or unexpected process behavior in browser processes.
• Evaluate temporary removal of affected browsers from high-risk user populations where feasible.

If your data may have been exposed

Actively exploited vulnerabilities can lead to data breaches. You can run a free exposure scan of your email addresses to check against known breach data.