{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/google-chrome--143.0.7499.110/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*","cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*","cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*","cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*","cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*","cpe:2.3:o:apple:visionos:*:*:*:*:*:*:*:*","cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*","cpe:2.3:a:microsoft:edge_chromium:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.8,"id":"CVE-2025-14174"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Google Chrome (\u003c 143.0.7499.110)","Safari (\u003c 143.0.7499.110)","Edge (\u003c 143.0.7499.110)"],"_cs_severities":["critical"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Google","Apple","Microsoft"],"content_html":"\u003cp\u003eCVE-2025-14174 is a critical memory corruption vulnerability (CWE-119) within the ANGLE graphics engine, which is utilized by major web browsers across Windows, macOS, Android, and iOS. The vulnerability allows an attacker to achieve remote code execution (RCE) by tricking a user into navigating to a malicious webpage containing crafted WebGL or shader content. A functional Proof-of-Concept (PoC) exploit has been published that reportedly bypasses existing vendor patches, indicating that previous remediations may be incomplete for certain configurations.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker hosts a malicious web page containing crafted WebGL/shader content.\u003c/li\u003e\n\u003cli\u003eVictim browses to the malicious URL using an affected browser.\u003c/li\u003e\n\u003cli\u003eBrowser renders the crafted graphics content using the vulnerable ANGLE engine.\u003c/li\u003e\n\u003cli\u003eOut-of-bounds memory access is triggered during shader processing.\u003c/li\u003e\n\u003cli\u003eExploitation of heap corruption allows for arbitrary memory read/write.\u003c/li\u003e\n\u003cli\u003eAttacker-supplied shellcode is executed within the context of the browser process.\u003c/li\u003e\n\u003cli\u003ePost-exploitation hooks facilitate memory dumping or privilege escalation on the host system.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability allows for remote code execution, unauthorized access to sensitive memory, and potential full system compromise. The exploit has been observed in real-world targeted attacks against iOS users and is reported to succeed on systems previously thought to be patched.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eInventory all systems running web browsers using the ANGLE graphics engine (Chrome, Edge, Safari).\u003c/li\u003e\n\u003cli\u003ePrioritize updating Google Chrome to version 143.0.7499.110 or later.\u003c/li\u003e\n\u003cli\u003eImplement browser-based security controls such as disabling WebGL if not required for business-critical applications until patches are verified.\u003c/li\u003e\n\u003cli\u003eMonitor for unusual browser process activity, such as child processes spawning or unexpected memory usage patterns associated with high-risk web browsing.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-30T03:31:00Z","date_published":"2026-10-30T03:31:00Z","id":"https://feed.craftedsignal.io/briefs/2026-10-cve-2025-14174-angle/","summary":"An out-of-bounds memory access vulnerability in the ANGLE graphics engine enables remote code execution via crafted WebGL content, with active exploitation and a functional PoC now available.","title":"ANGLE Graphics Engine: Out-of-bounds memory access RCE (CVE-2025-14174)","url":"https://feed.craftedsignal.io/briefs/2026-10-cve-2025-14174-angle/"}],"language":"en","title":"CraftedSignal Threat Feed - Google Chrome (\u003c 143.0.7499.110)","version":"https://jsonfeed.org/version/1.1"}