Yes. CISA added CVE-2025-14174 to its Known Exploited Vulnerabilities catalogue on 12 December 2025, which it does only when there is reliable evidence of active exploitation. CISA has not linked it to known ransomware campaigns. Google Chromium contains an out of bounds memory access vulnerability in ANGLE that could allow a remote attacker to perform out of bounds memory access via a crafted HTML page.
What CISA’s KEV listing means for this Chromium flaw
CISA’s KEV catalogue is a high-signal operational marker, not a theoretical risk list. When a browser flaw appears there, the practical assumption is that real exploitation has already been observed, so defenders should treat exposure as immediate rather than speculative. For Chromium issues, that means inventorying browsers, embedded Chromium runtimes, and any product that ships the affected engine.
For this kind of browser vulnerability, version checking is only the first step. The more important question is whether users can reach the vulnerable rendering path through normal browsing, email, chat, or other content that can deliver a crafted HTML page. A browser-based exploit often succeeds because users do not need to download or run anything manually.
Authoritative tracking should come from the CISA Known Exploited Vulnerabilities Catalog and the NIST National Vulnerability Database, with the vendor advisory used for exact product guidance and remediation timing.
How an out of bounds memory access in ANGLE becomes dangerous
Out of bounds memory access is a memory safety failure, and in a browser context that usually matters because untrusted web content can trigger it at scale. The ANGLE graphics translation layer sits in a path that processes complex rendering input, so a malformed page can potentially drive the browser into unsafe memory access without requiring any privilege beyond normal page delivery.
This is why browser memory corruption bugs are treated as serious even when the immediate symptom sounds narrow. Once a remote attacker can influence memory access through crafted content, the issue can become a stepping stone to code execution, sandbox escape attempts, or chained exploitation, depending on the surrounding hardening and exploitability.
For the underlying weakness class, the CWE Top 25 Guide is useful context because out of bounds access falls into the family of memory safety weaknesses that repeatedly show up in high-impact software bugs. The broader exploitation pattern is also covered in the Zero-Day and Exploited Vulnerabilities Guide.
What to do when patching cannot happen immediately
If patching is delayed, the goal is to reduce the chance that users ever render hostile content in the vulnerable browser path. In practice, that means tightening browser exposure, limiting untrusted browsing contexts, and reducing the number of endpoints that can receive externally delivered HTML from high-risk channels such as email, chat, or webmail.
When browser hardening is available, apply it before relying on user behaviour. The most useful controls are isolation, extension restraint, managed policies, and rapid update enforcement, because they shrink the number of ways a crafted page can reach the vulnerable renderer or be paired with a second-stage payload.
NHIMG’s Enterprise Browser and Browser Security Guide covers the browser controls that matter most when a browser exploit is being actively discussed, including isolation and policy enforcement. For broader vulnerability prioritisation, the Vulnerability Management Guide is the right operational companion.
Risk and Threat Considerations
Browser exploits are attractive because they sit at the boundary between internet content and trusted user sessions. A successful attack can start with something as ordinary as a visited page, then move into session theft, internal reachability, or follow-on compromise if the browser is highly trusted or poorly isolated.
Failure mechanism: A crafted HTML page triggers out of bounds memory access in the browser’s graphics stack, giving the attacker a foothold in a process that handles untrusted content and may be chained with other bugs for broader execution or persistence.
Impact: Users can be compromised simply by browsing or opening content, and the organisation may face endpoint compromise, session exposure, and rapid spread if patching, isolation, or browser management is inconsistent.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack surface, CIS Controls v8, NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the technical controls, and ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | CIS-7 — Continuous Vulnerability Management | Browser CVEs in KEV require fast identification, prioritization, and remediation. |
| Recommendation — Prioritize and remediate KEV-listed browser vulnerabilities through continuous scanning and rapid patch SLAs. | ||
| NIST CSF 2.0 | PR.IP-12 — Vulnerability Management | This subject is about finding and fixing an actively exploited vulnerability quickly. |
| Recommendation — Use vulnerability management workflows to track, prioritize, and remediate exploited browser flaws. | ||
| NIST SP 800-53 Rev 5 | SI-2 — Flaw Remediation | An exploited Chromium flaw requires prompt remediation and update enforcement. |
| SI-4 — System Monitoring | Active exploitation makes monitoring and hunting for suspicious browser activity materially relevant. | |
| Recommendation — Apply flaw remediation processes to deploy the browser fix and verify installation. Monitor for indicators of browser exploit activity and investigate suspicious rendering or crash patterns. | ||
| ISO/IEC 27001:2022 | A.8.8 — Management of technical vulnerabilities | The page is about an actively exploited technical vulnerability and its remediation urgency. |
| Recommendation — Manage the browser flaw as a technical vulnerability with urgent assessment and remediation. | ||
| MITRE ATT&CK | T1203 — Exploitation for Client Execution | A crafted page triggering browser memory corruption fits client-side exploitation behavior. |
| Recommendation — Map browser exploit telemetry to client-execution techniques and hunt for follow-on activity. | ||
Practitioner Guidance
What to prioritise: Treat the KEV listing as a triage trigger. Confirm whether Chromium is present in standard browsers, embedded applications, or managed desktop builds, then prioritise the paths that can render externally supplied HTML before chasing lower-risk installations.
What to verify: Check whether update enforcement is actually reaching users, whether vulnerable browsers are still allowed to run, and whether browser isolation or hardened profiles are consistently applied to higher-risk populations such as executives, developers, and remote workers.
Practitioner takeaway: For browser CVEs that land in KEV, the operational question is not whether exploitation is possible, but how quickly the vulnerable rendering path can be removed from real user exposure.
Related resources from NHI Mgmt Group
- CVE-2025-14174 (Google Chromium Out of Bounds Memory Access)
- CVE-2024-0519 (Google Chromium V8 Out-of-Bounds Memory Access)
- Is CVE-2025-21043 (Samsung Mobile Devices Out-of-Bounds Write) being exploited in the wild?
- Is CVE-2025-21042 (Samsung Mobile Devices Out-of-Bounds Write) being exploited in the wild?