CVE-2025-14174: Chrome ANGLE flaw and Apple CVE overlap

Google confirmed Chrome ANGLE exploitation. Apple uses this CVE for a separate WebKit memory-init issue.

💡 Plain English Explainer (ELI5)

Imagine a clerk copying a form who writes past the assigned box and into the next record: that is the kind of boundary failure an out-of-bounds bug describes. A case ledger can also reuse one case number for two different entries; that shared label does not prove the underlying defects are the same.

Core Concepts & Subsystem Terms

ANGLE: Almost Native Graphics Layer Engine: Google's open-source library that translates OpenGL ES and WebGL calls to native APIs such as Metal, Direct3D and Vulkan.
Metal backend: The part of ANGLE that targets Apple's Metal graphics API. Google identifies CVE-2025-14174 as an ANGLE issue in Chrome on Mac; its advisory does not identify the exact ANGLE function or disclose the patch mechanics.
Out-of-bounds access (CWE-787): An operation accesses memory outside its intended buffer bounds. CWE-787 is the more specific out-of-bounds write classification; Google’s public description says out-of-bounds memory access but does not disclose the exact operation or root-cause calculation.
Checked arithmetic: Integer operations that report overflow instead of silently wrapping, such as base::CheckedNumeric in Chromium and ANGLE.
Zero-day: A flaw exploited before a fix is available. Google said an exploit for the Chrome ANGLE issue existed in the wild. Apple separately described targeted exploitation involving WebKit issues in its iOS 26.2 advisory.

Framework mappings

CWE reference for the weakness described in this guide: CWE-787
CISA KEV — added 2025-12-12 — CVE-2025-14174

Incident Timeline

2025-12-10

Google releases Chrome 143.0.7499.110 for Mac and says an exploit for the ANGLE issue exists in the wild (Chromium issue 466192044).

2025-12-12

Apple's iOS 26.2 advisory lists CVE-2025-14174 for a WebKit memory-initialization issue and separately lists CVE-2025-43529 for a WebKit memory-corruption issue. Apple says the latter report may relate to targeted exploitation; this is not evidence that Apple's WebKit entries share Chrome's ANGLE root cause. CISA adds CVE-2025-14174 to KEV.

Step-by-Step Attack Flow

Step 1

A crafted page reaches Chrome on Mac

The CVE record describes a remote attacker triggering the Chrome-on-Mac ANGLE flaw through a crafted HTML page. The CVSS vector requires user interaction, so the documented path depends on a victim opening attacker-controlled web content.

Step 2

Chrome reaches ANGLE

Google identifies ANGLE as the affected Chrome component. The public advisory does not name the responsible function or establish that WebKit uses the same vulnerable code.

Step 3

An out-of-bounds memory access occurs

Google describes an out-of-bounds memory access, but its public release does not say whether the operation reads or writes, identify the affected buffer, or explain the root-cause calculation. The code below is a generic bounds-checking example, not ANGLE source or a reconstruction of this CVE.

Step 4

Google confirms exploitation in the wild

Google says an exploit for CVE-2025-14174 exists in the wild. Apple separately reports targeted exploitation of WebKit issues and reuses the CVE-2025-14174 identifier for a WebKit memory-initialization entry. Public advisories do not establish one shared exploit chain across the Chrome and WebKit flaws.

Source Code: Flaw vs. Secure Implementation

Google has not published the function-level cause or patch details in its release notes. This generic C++20 example demonstrates one defensive invariant for a range copy: validate the offset first, then compare the requested length with the remaining capacity using subtraction to avoid overflow. It is not a reproduction of CVE-2025-14174 or ANGLE's actual fix.

UNPATCHED FLAW

// Generic example only; not ANGLE source or the CVE-2025-14174 implementation.
bool copyRange(std::span<std::byte> destination,
               std::size_t offset,
               std::span<const std::byte> source)
{
    std::copy(source.begin(), source.end(), destination.begin() + offset);
    return true;
}

HARDENED SECURE PATCH

// Generic example only; not ANGLE source or the CVE-2025-14174 patch.
bool copyRange(std::span<std::byte> destination,
               std::size_t offset,
               std::span<const std::byte> source)
{
    if (offset > destination.size() ||
        source.size() > destination.size() - offset) {
        return false;
    }

    std::copy(source.begin(), source.end(), destination.begin() + offset);
    return true;
}

Engineering & System Hardening Checklist

✓Update Chrome on Mac to 143.0.7499.110 or later; for current deployments, install the latest supported Chrome release.
✓Inventory embedded Chromium and ANGLE consumers, including desktop apps and browser-based shells, and verify each vendor's fixed build instead of assuming Chrome's update covers them.
✓For every buffer copy, validate offset and length against destination capacity before pointer arithmetic; use overflow-safe checks such as length <= capacity - offset.
✓Add boundary tests for zero length, exact-fit ranges, offset equal to capacity, and ranges one byte beyond capacity; run memory-safety instrumentation in CI.
✓Track the Chrome ANGLE advisory separately from Apple's WebKit entries: matching CVE labels or release dates do not establish a shared root cause or exploit chain.