one report, two browsers: chrome and safari zero-days patched
Google and Apple patched browser-engine bugs flagged as exploited in the wild — reported by Apple and Google's Threat Analysis Group — across Chrome, Safari and Apple's operating systems.
- cve
- CVE-2025-14174; CVE-2025-43529
- cvss
- 8.8 (v3.1, ADP score listed by NVD) for each
- fixed in
- Chrome 143.0.7499.109/.110; Safari 26.2; iOS/iPadOS 26.2 and 18.7.3; macOS Tahoe 26.2
- exploited
- yes — CVE-2025-14174 added to CISA KEV 2025-12-12; CVE-2025-43529 added 2025-12-15
- platforms
- Chrome and Chromium-based browsers; Safari and WebKit on iOS, iPadOS, macOS, tvOS, visionOS, watchOS
what happened
- Google updated Chrome stable to 143.0.7499.109/.110 for Windows and Mac and 143.0.7499.109 for Linux on 2025-12-10; the release notes, updated 2025-12-12 with more detail on the bug, say Google is aware an exploit for CVE-2025-14174 exists in the wild.[1]
- CVE-2025-14174 is an out-of-bounds memory access in ANGLE, reported by Apple Security Engineering and Architecture (SEAR) and Google Threat Analysis Group on 2025-12-05.[1]
- Apple released iOS 26.2 and iPadOS 26.2 on 2025-12-12, fixing WebKit bugs CVE-2025-43529 (use-after-free, arbitrary code execution) and CVE-2025-14174 (memory corruption).[2]
- Apple said it is aware of a report that the issues may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 26.[2]
- Fixes for CVE-2025-43529 also shipped in Safari 26.2, iOS and iPadOS 18.7.3, macOS Tahoe 26.2, tvOS 26.2, visionOS 26.2 and watchOS 26.2.[3]
- NVD lists a CVSS v3.1 score of 8.8 for both CVEs.[3,4]
- CISA added CVE-2025-14174 to KEV on 2025-12-12 and CVE-2025-43529 on 2025-12-15, noting the Chromium bug could affect Chrome, Edge and Opera and the WebKit bug could affect non-Apple products that rely on WebKit.[5]
where sources differNVD's description of CVE-2025-14174 names Chrome on Mac prior to 143.0.7499.110, while Google's release covered Windows, Mac and Linux builds.
sources5
- 01Stable Channel Update for Desktop (2025-12-10) ↗ primaryGoogle Chrome Releasesaccessed 2026-10-21
- 02About the security content of iOS 26.2 and iPadOS 26.2 ↗ primaryAppleaccessed 2026-10-21
- 03NVD CVE API record for CVE-2025-43529 ↗ primaryNIST NVDaccessed 2026-10-21
- 04NVD CVE API record for CVE-2025-14174 ↗ primaryNIST NVDaccessed 2026-10-21
- 05CISA Catalog of Known Exploited Vulnerabilities (JSON feed, catalogVersion 2026.10.21) ↗ primaryCISAaccessed 2026-10-21