CVE-2025-14174: Google Chromium ANGLE -- Out-of-Bounds Memory Access

Background

ANGLE (Almost Native Graphics Layer Engine) is Google’s cross-platform OpenGL ES implementation, used by Chromium-based browsers to translate WebGL and GPU-accelerated rendering calls to the underlying platform’s native graphics APIs (Direct3D on Windows, Metal on macOS). ANGLE sits between web content and native GPU drivers, which makes it a recurring target for browser exploitation.

CVE-2025-14174 is an out-of-bounds memory access in Chromium’s ANGLE component, triggerable by visiting a malicious webpage with crafted WebGL or canvas content. All Chromium-based browsers share this code — Chrome, Edge, Opera, Brave, and others — so the affected population is large.

CISA added this to the KEV catalog on 2025-12-12. Graphics component bugs in browsers are routinely chained with renderer sandbox escapes to achieve full system compromise in drive-by campaigns.

Technical Mechanism

CWE classification was not listed in the NVD entry. Out-of-bounds memory access in graphics libraries typically stems from incorrect buffer size calculations when processing GPU shader programs or texture operations.

// Conceptual vulnerable pattern in ANGLE shader compilation
void compileShader(const char* source, size_t length) {
    char buffer[MAX_SHADER_SIZE];
    // Bug: length not validated against MAX_SHADER_SIZE
    memcpy(buffer, source, length);  // OOB write if length > MAX_SHADER_SIZE
    processShader(buffer);
}

An attacker serving a webpage with a specially crafted WebGL shader or canvas operation can trigger the out-of-bounds access, leading to memory corruption. This is typically exploitable for arbitrary code execution within the renderer process, often chained with a sandbox escape for full system impact.

Real-World Exploitation Evidence

CISA’s KEV listing confirms active exploitation. Browser graphics bugs are core to the drive-by download ecosystem. Exploit kit operators and nation-state groups maintain browser RCE chains for use against victims visiting attacker-controlled or compromised sites. The fact that all Chromium-based browsers are affected means the potential victim pool is substantial.

Impact Assessment

• Remote code execution in the Chromium renderer process
• When chained with a sandbox escape: full user-level code execution on the host
• Silent drive-by exploitation by visiting a malicious webpage
• All Chromium-based browsers affected: Chrome, Edge, Opera, Brave, and more
• High exposure due to browser’s role as primary internet-facing application

Affected Versions

Remediation Steps

1. Update Google Chrome, Microsoft Edge, and all Chromium-based browsers immediately.
2. Enable automatic browser updates to ensure future patches are applied promptly.
3. Consider disabling WebGL if not required (--disable-webgl flag or enterprise policy).
4. Deploy web content filtering to block access to known malicious domains.
5. Enable enhanced safe browsing in Chrome for additional protection.

Detection Guidance

Log Sources: EDR process telemetry, network proxy/DNS logs, browser crash reports.

IOCs: Chrome renderer process crashes followed by new child process spawns; unusual outbound connections from browser processes; WebGL-heavy pages triggering GPU process anomalies.

Sigma rule:

title: Chromium ANGLE Exploitation Attempt CVE-2025-14174
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    ParentImage|endswith: '\chrome.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\wscript.exe'
      - '\mshta.exe'
  condition: selection
level: high

Timeline

References

• NVD — CVE-2025-14174
• CISA KEV — CVE-2025-14174
• Google Security Advisory — CVE-2025-14174