CISA Alerts On Chromium 0-Day Vulnerability Exploited In Live Attacks

3

A Chromium 0-day vulnerability was added to CISA’s Known Exploited Vulnerabilities catalog after confirmed exploitation of CVE-2025-14174. The flaw in Chromium’s ANGLE layer enables out-of-bounds memory access via malicious HTML.

Google patched Chrome in 131.0.6778.201, and Microsoft updated Edge. CISA set a January 2, 2026, federal remediation deadline.

Organizations should deploy updates immediately, enable auto-updates, and watch for rendering crashes tied to exploit attempts.

Chromium 0-day vulnerability: What You Need to Know

• CVE-2025-14174 is being exploited; update Chrome 131.0.6778.201 or Edge 131.0.3139.95 and relaunch now.

CISA’s alert and what’s in scope

CISA added CVE-2025-14174 to its Known Exploited Vulnerabilities catalog, signaling active abuse across Chromium-based browsers.

In the CISA KEV catalog CVE-2025-14174 entry, federal agencies are directed to apply vendor fixes or remove affected products from use by January 2, 2026 under Binding Operational Directive 22-01.

CISA assesses that attackers can leverage the Chromium 0-day vulnerability for drive-by compromises, data theft, and ransomware staging.

Given ongoing malvertising campaigns, users are at elevated risk when following poisoned ads; see our coverage of malvertising on Google Ads.

What is CVE-2025-14174?

The bug enables out-of-bounds memory access during HTML rendering, leading to memory corruption and potential arbitrary code execution.

A crafted webpage can trigger the condition and may aid sandbox escape in specific scenarios. As a Chromium 0-day vulnerability, exploitation preceded broad patch deployment.

Where the risk sits: ANGLE

The issue resides in ANGLE, Chromium’s OpenGL ES compatibility layer. Improper bounds checking during rendering creates an ANGLE graphics engine vulnerability reachable via hostile webpages.

The remote reachability makes the Chromium 0-day vulnerability especially dangerous in phishing and malvertising chains.

Understanding the Chromium 0-day vulnerability

Google released Stable Channel fixes on December 10, moving Chrome to 131.0.6778.201. Microsoft’s Edge 131.0.3139.95 followed.

Other Chromium-based browsers (including Opera) require vendor-issued updates. Because the Chromium 0-day vulnerability is actively exploited, administrators should prioritize patching and ensure browsers are relaunched to complete installation.

For a broader browser update context, see Stable Channel key fixes.

Affected versions and fixes

• Chromium prior to 131.0.6778.200 is affected
• Google Chrome fixed in 131.0.6778.201 and later
• Microsoft Edge fixed in 131.0.3139.95 and later
• Opera and other Chromium-based browsers: check vendor advisories

NVD lists CVE-2025-14174 as high severity with remote code execution potential. To reduce exposure to the Chromium 0-day vulnerability, enforce automatic updates across managed fleets and verify build versions post-restart.

Detection and immediate steps

No public indicators of compromise are available yet. Threat actors are likely pairing the Chromium 0-day vulnerability with phishing or malvertising. Immediate actions include:

• Fleet-wide discovery of outdated Chromium-based browsers
• Enforcing auto-update policies and mandatory restarts
• Monitoring crash telemetry and GPU/renderer anomalies
• Tightening email/web filtering; review phishing-avoidance guidance

Authoritative resources and further reading

Official guidance and deadlines: CISA KEV Catalog. Technical scoring and details: NVD CVE-2025-14174. Track vendor updates: Chrome Releases.

For additional context, review our coverage of exploited Chrome zero-days (2023), the Chrome 131 memory bug fixes, and CISA’s 2025 cloud security mandate. See recent patching guidance for active zero-days in Microsoft’s exploited zero-day fixes.

Implications for organizations and end users

Rapid patching immediately reduces exposure to drive-by exploits and improves compliance with federal directives.

Swift remediation also limits incident response costs resulting from credential theft, data exfiltration, and device compromise tied to the Chromium 0-day vulnerability.

Operationally, urgent browser rollouts can disrupt testing and break extensions or legacy workflows. Delayed updates, however, extend the attack window.

Once an endpoint is breached via the Chromium 0-day vulnerability, lateral movement risk increases, especially where privilege controls and segmentation are weak.

Conclusion

CVE-2025-14174 underscores how a single rendering bug in ANGLE can expose billions of users. With confirmed exploitation, treating the Chromium 0-day vulnerability as a top-priority patch is essential.

Apply vendor updates now, relaunch browsers, and verify versions. Strengthen email and web filtering to blunt phishing and malvertising delivering exploit pages while the Chromium 0-day vulnerability remains favored by attackers.

Track the CISA KEV Catalog and vendor advisories for changes in exploitation patterns tied to the Chromium 0-day vulnerability, and adjust defenses accordingly.

Questions Worth Answering

What is CVE-2025-14174?

– A high-severity memory flaw in Chromium’s ANGLE layer that can enable arbitrary code execution via malicious HTML.

Which browsers are affected?

– Any Chromium-based browser before patched builds, including Chrome prior to 131.0.6778.201 and Edge before 131.0.3139.95.

How are attackers exploiting it?

– Through booby-trapped sites in phishing or malvertising campaigns that exploit the Chromium 0-day vulnerability.

Are there indicators of compromise?

– None public yet; watch for abnormal rendering crashes, unexpected browser behavior, and suspicious outbound traffic.

Does it bypass the sandbox?

– In limited cases, memory corruption may aid sandbox escape. Patching is the most reliable mitigation.

What immediate steps should organizations take?

– Force updates, verify versions, enforce auto-updates, and monitor crash telemetry and filtering logs.

About CISA

The Cybersecurity and Infrastructure Security Agency (CISA) leads U.S. cyber and infrastructure resilience efforts.

Its Known Exploited Vulnerabilities catalog drives timely patching across federal networks and critical sectors.

CISA issues directives, advisories, and guidance to reduce risk from high-impact threats and active exploitation.

About Guru Baran

Guru Baran is Co‑Founder and Editor‑in‑Chief of CyberSecurityNews.com.

He covers vulnerability research, malware operations, ransomware trends, and digital forensics.

His reporting focuses on emerging threats and practical remediation strategies for defenders.