{"id":9194,"date":"2025-12-14T10:03:33","date_gmt":"2025-12-14T10:03:33","guid":{"rendered":"https:\/\/serisec.com\/index.php\/2025\/12\/14\/cisa-warns-of-google-chromium-0-day-vulnerability-exploited-in-attacks\/"},"modified":"2025-12-14T10:03:33","modified_gmt":"2025-12-14T10:03:33","slug":"cisa-warns-of-google-chromium-0-day-vulnerability-exploited-in-attacks","status":"publish","type":"post","link":"https:\/\/serisec.com\/index.php\/2025\/12\/14\/cisa-warns-of-google-chromium-0-day-vulnerability-exploited-in-attacks\/","title":{"rendered":"CISA Warns of Google Chromium 0-Day Vulnerability Exploited in Attacks"},"content":{"rendered":"

CISA Warns of Google Chromium 0-Day Vulnerability Exploited in Attacks
\n \t

\n
<\/BR>
\n
\n \t

\n
<\/BR><\/p>\n

\n

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a critical zero-day vulnerability<\/a> in Google Chromium\u2019s ANGLE graphics engine to its Known Exploited Vulnerabilities (KEV) catalog.<\/p>\n

Tracked as CVE-2025-14174<\/a>, the flaw allows remote attackers to trigger out-of-bounds memory access via a malicious HTML page, potentially leading to arbitrary code execution in browsers.<\/p>\n

Discovered and patched just days ago, this vulnerability underscores ongoing threats to Chromium-based browsers dominating the web. Attackers could exploit it for drive-by compromises, data theft, or ransomware deployment, though CISA notes no confirmed ransomware ties yet. Federal agencies must apply mitigations by January 2, 2026, or discontinue affected products.<\/p>\n

CVE-2025-14174<\/a> resides in ANGLE, Chromium\u2019s OpenGL ES interface layer, where improper bounds checking allows memory corruption. A crafted webpage can invoke the flaw during rendering, bypassing sandbox protections in some scenarios.<\/p>\n

The National Vulnerability Database (NVD) rates it high severity, with early CVSS v3.1 assessments pointing to remote code execution risks.<\/p>\n

\n\n\n\n\n\n
CVE ID<\/th>\nDescription<\/th>\nCVSS v3.1 Score<\/th>\nAffected Versions<\/th>\nPatched Versions<\/th>\n<\/tr>\n<\/thead>\n
CVE-2025-14174<\/td>\nOut-of-bounds memory access in ANGLE via HTML<\/td>\n8.8 (High)<\/td>\nChromium < 131.0.6778.200<\/td>\nChrome 131.0.6778.201+
Edge 131.0.3139.95+<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/figure>\n

No public indicators of compromise (IoCs) have surfaced, but threat actors are likely to chain it to phishing<\/a> or malvertising.<\/p>\n

CISA urges immediate patching per Binding Operational Directive (BOD) 22-01 for federal systems, especially cloud services. Organizations should scan for unpatched browsers, enforce automatic updates, and monitor for anomalous rendering crashes.<\/p>\n

Google rolled out Stable Channel fixes on December 10, bumping Chrome to version 131.0.6778.201. Microsoft Edge followed with 131.0.3139.95, while Opera users should check vendor channels. \u201cUsers are advised to relaunch browsers post-update,\u201d Google stated in its release notes.<\/p>\n

This incident highlights Chromium\u2019s vast attack surface, affecting over 70% of desktop browsers. Security teams worldwide should prioritize remediation amid rising zero-day exploits.<\/p>\n

Follow us on Google News<\/a>, LinkedIn<\/a>, and X<\/a> for daily cybersecurity updates. Contact us<\/a> to feature your stories.<\/strong><\/p>\n

The post CISA Warns of Google Chromium 0-Day Vulnerability Exploited in Attacks<\/a> appeared first on Cyber Security News<\/a>.<\/p>\n<\/div>\n

\t

\n
<\/BR>
\n Guru Baran
\n \t

\n
<\/BR>
\nGo to cyber-security-news<\/a>
\n \t

\n
<\/BR><\/p>\n","protected":false},"excerpt":{"rendered":"

CISA Warns of Google Chromium 0-Day Vulnerability Exploited in Attacks The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a critical zero-day vulnerability in Google Chromium\u2019s ANGLE graphics engine to its Known Exploited Vulnerabilities (KEV) catalog. Tracked as CVE-2025-14174, the flaw allows remote attackers to trigger out-of-bounds memory access via a malicious HTML page, […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[129,63,131,648],"tags":[130],"class_list":["post-9194","post","type-post","status-publish","format-standard","hentry","category-cyber-security","category-cyber-security-news","category-vulnerability","category-vulnerability-news","tag-cyber-security-news"],"_links":{"self":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/9194"}],"collection":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/comments?post=9194"}],"version-history":[{"count":0,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/9194\/revisions"}],"wp:attachment":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/media?parent=9194"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/categories?post=9194"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/tags?post=9194"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}