CVE-2025-14174

A malicious website can exploit a mistake in how the browser handles graphics-related data. Think of it like a visitor using a bad key to reach rooms outside the part of a building they should be allowed to enter, potentially letting them damage systems or steal information.

This matters if your business uses Google Chrome on macOS, Safari or Apple device software, or Microsoft Edge. For the Chrome issue, the risk applies when a person using an affected Mac opens the attacker’s webpage.

Attackers are already exploiting this vulnerability, so treat it as an urgent update. CISA added it to its catalog of vulnerabilities known to be used in real attacks, and its remediation deadline was January 2, 2026.

Confirm installed versions through your device-management tool or each browser’s About screen. Upgrade Chrome on macOS to 143.0.7499.110 or later, Edge to 143.0.3650.80 or later, and deploy the applicable Apple updates: 26.2 for Safari, macOS, tvOS, visionOS, and watchOS; 18.7.3 for iOS and iPadOS.

If patching is delayed, temporarily prevent affected Macs from browsing untrusted sites and use network filtering to block known malicious domains where available. The CISA KEV remediation due date was 2026-01-02, so overdue systems should be prioritized. Review browser crash reports, endpoint alerts, unusual child processes launched by browsers, and suspicious downloads after updating.

Severity is CVSS 8.8 High (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). The weakness is out-of-bounds memory access, mapped to CWE-787 and CWE-119, in ANGLE; the network attack requires a victim to render crafted HTML. No public exploit code is recorded, but exploitation is confirmed through CISA’s Known Exploited Vulnerabilities catalog. EPSS was rising before that confirmation, but the predictive score is not relevant once real-world exploitation is confirmed.