PT-2025-50966 · Google+4 · Google Chromium+6

Published 2025-12-10 · Updated 2026-05-08 · CVE-2025-14174

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 143.0.7499.110 Google Chromium (affected versions not specified) Microsoft Edge (affected versions not specified) Opera (affected versions not specified) WebKitGTK (affected versions not specified)

Description An out-of-bounds memory access issue exists in the ANGLE component, a graphics library that translates OpenGL ES calls to Direct3D for Windows systems. This occurs due to improper validation of memory boundaries during rendering operations. A remote attacker can exploit this by enticing a user to visit a specially crafted HTML page, potentially leading to arbitrary code execution or a denial of service. This issue affects browsers built on the Chromium open-source project and the WebKitGTK package.

Recommendations Update Google Chrome to version 143.0.7499.110 or later. Update Google Chromium, Microsoft Edge, and Opera to the latest available versions containing the fix. Update WebKitGTK packages to version 2.50.4-0ubuntu0.25.04.1.

Fix

RCE

Buffer Overflow

Memory Corruption

Weakness Enumeration

CWE-119

CWE-787

Related Identifiers

BDU:2026-00800

CVE-2025-14174

DLA-4414-1

DSA-6083-1

OPENSUSE-SU-2025:15831-1

OPENSUSE-SU-2025:20178-1

OPENSUSE-SU-2026:20065-1

RHSA-2025:23663

RHSA-2025:23700

RHSA-2025:23967

RHSA-2025:23968

RHSA-2025:23969

RHSA-2025:23970

RHSA-2025:23971

RHSA-2025:23972

RHSA-2025:23973

RHSA-2025:23974

RHSA-2025:23975

SUSE-SU-2025:4527-1

SUSE-SU-2025:4528-1

SUSE-SU-2026:0021-1

SUSE-SU-2026:20102-1

USN-7957-1

Affected Products

Angle

Debian

Google Chrome

Google Chromium

Linuxmint

Apple Macos

Ubuntu

References · 256

• https://ubuntu.com/security/CVE-2025-14174 · Vendor Advisory
• https://learn.microsoft.com/en-us/deployedge/microsoft-edge-relnotes-security · Security Note
• https://ubuntu.com/security/CVE-2025-43535 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-00800 · Security Note
• https://osv.dev/vulnerability/USN-7957-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-43541 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-14174 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-14174 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:0021-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:20065-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-14174 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-43536 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-7957-1 · Vendor Advisory
• https://chromereleases.googleblog.com/2025/12/stable-channel-update-for-desktop_10.html · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2025:4527-1 · Vendor Advisory