ANGLE Graphics Engine: Out-of-bounds memory access RCE (CVE-2025-14174)

CVE-2025-14174 is a critical memory corruption vulnerability (CWE-119) within the ANGLE graphics engine, which is utilized by major web browsers across Windows, macOS, Android, and iOS. The vulnerability allows an attacker to achieve remote code execution (RCE) by tricking a user into navigating to a malicious webpage containing crafted WebGL or shader content. A functional Proof-of-Concept (PoC) exploit has been published that reportedly bypasses existing vendor patches, indicating that previous remediations may be incomplete for certain configurations.

Attack Chain

1. Attacker hosts a malicious web page containing crafted WebGL/shader content.
2. Victim browses to the malicious URL using an affected browser.
3. Browser renders the crafted graphics content using the vulnerable ANGLE engine.
4. Out-of-bounds memory access is triggered during shader processing.
5. Exploitation of heap corruption allows for arbitrary memory read/write.
6. Attacker-supplied shellcode is executed within the context of the browser process.
7. Post-exploitation hooks facilitate memory dumping or privilege escalation on the host system.

Impact

The vulnerability allows for remote code execution, unauthorized access to sensitive memory, and potential full system compromise. The exploit has been observed in real-world targeted attacks against iOS users and is reported to succeed on systems previously thought to be patched.

Recommendation

• Inventory all systems running web browsers using the ANGLE graphics engine (Chrome, Edge, Safari).
• Prioritize updating Google Chrome to version 143.0.7499.110 or later.
• Implement browser-based security controls such as disabling WebGL if not required for business-critical applications until patches are verified.
• Monitor for unusual browser process activity, such as child processes spawning or unexpected memory usage patterns associated with high-risk web browsing.