CVE-2025-14174Active Exploitation(apple / chrome)

CRITICALCVSS 8.8 · HIGHCISA KEV

Exploitation observed; activity peaked at 3 mentions and remains active

Immediate actions

Patch apple chrome systems immediately
Assume compromise if assets are exposed
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: Immediate (within 24h)

NVD description

Out of bounds memory access in ANGLE in Google Chrome on Mac prior to 143.0.7499.110 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)

apple CVEs Back to dashboard

9.0/ 10 priority

Sources & remediation

Listed in the CISA Known Exploited Vulnerabilities catalog. Federal remediation due date: 2026-01-02. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Vendor / third-party advisories

Other references

Weakness type (CWE)

CWE-787CWE-119

Priority

CRITICAL

Exploitation

ACTIVE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

chrome
edge_chromium
ipados
iphone_os

Threat summary

Active exploitation appears in 10 classified signals
Public PoC and exploit tooling are both present
Patch or workaround signal is available
34 mentions across 28 observed days

What's happening

Active exploitation reported across 10 signals
Exploit tool or code specified in 2 signals
PoC mentioned or linked in 7 signals
Patch or workaround mentioned in 10 signals
Technical details provided in 25 signals
General: 7 classified signals
Peaked 23d ago at 3 mentions (2026-02-12); latest day: 1
34 total mentions across 28 days

Affected systems

Vendors

apple google linux microsoft

Products

chromeedge_chromiumipadosiphone_oslinux_kernelmacossafaritvosvisionoswatchos

1 version affected across 11 products

Deep dive

Activity timeline34 mentions / 28d

Signal classification5 categories

Active Exploitation

824.2%

Patch

824.2%

General

721.2%

PoC

515.2%

Disclosure

515.2%

Referenced assets17 URLs

By indicator

Classification over time

Date	Total	Labels

2026-01-28	2	Active Exploitation1PoC1
2026-02-01	1	Active Exploitation1
2026-02-07	1	General1
2026-02-11	1	Patch1
2026-02-12	3	Active Exploitation2Disclosure1
2026-02-13	2	Patch2
2026-02-15	1	Patch1
2026-02-17	1	General1
2026-02-23	1	Patch1
2026-02-27	1	General1
2026-03-02	1	Disclosure1
2026-03-04	2	General1PoC1
2026-03-06	1	PoC1
2026-03-13	1	PoC1
2026-03-15	1	General1
2026-03-17	1	General1
2026-03-18	1	Patch1
2026-03-21	1	Patch1
2026-03-22	1	Patch1
2026-03-23	2	Active Exploitation1Disclosure1
2026-04-01	1	Active Exploitation1
2026-04-11	1	Active Exploitation1
2026-05-07	1	Active Exploitation1
2026-05-08	1	PoC1
2026-06-28	1	Disclosure1
2026-08-03	1	General1
2026-09-15	1	Disclosure1

Full discourse20 posts

YogSotho@YogSoth0104d
Disclosure
#DarkSword #iOS #Exploit Chain — Six-Stage Nuclear Exploit Kit Exploit Chain: CVE-2025-31277 → CVE-2026-20700 → CVE-2025-14174 → CVE-2025-43510 → CVE-2025-43520 Target: iOS 18.4 - 18.7 (#Safari/#WebKit) Effect: Full device compromise from one click (watering hole) Privileges: Root / Kernel-level #0days #security #hacking #root #CVE
Post summary
The post announces a multi‑stage exploit chain for iOS 18.4‑18.7 that enables full device compromise, but it provides no PoC, tool, patch, or evidence of active exploitation.
113611988516.2K
1.9K followersView on X
dbugs@ptdbugs25d
Disclosure
iOS Exploit for Sale (CVE-2025-43529, CVE-2026-20700, CVE-2025-14174) Read on dbugs: https://dbu.gs/news/ios-exploit-for-sale-cve-2025-43529-cve-2026-20700-cve-2025-14174-20260914 Vulnerable versions: Apple iOS 15.0–18.2 Price: $10k (3 hands max), $18k (1 hand only) According to the author’s description, the exploit relies on well-known CVEs and a web trigger via the Safari browser. This implies a scenario in which the vulnerability can be triggered after opening a specially crafted webpage in Safari. CVE-2025-43529 (https://dbu.gs/vulnerability/PT-2025-51037?fts%5Bvalue%5D=CVE-2025-43529) - a use-after-free vulnerability in WebKit, where a specially crafted web page could lead to the execution of arbitrary code. CVE-2025-14174 (https://dbu.gs/vulnerability/PT-2025-50966?fts%5Bvalue%5D=CVE-2025-14174) - another WebKit vulnerability related to a memory corruption when processing malicious web content. CVE-2026-20700 (https://dbu.gs/vulnerability/PT-2026-7805?fts%5Bvalue%5D=CVE-2026-20700) — a memory corruption vulnerability in the dyld component that, when combined with an existing write-to-memory capability, could allow arbitrary code execution. iOS remains the second-largest mobile OS in the world: according to StatCounter, as of May 2026, its share of the mobile operating system market was 31,95% (https://web.telegram.org/a/%20%20%20%20https://gs.statcounter.com/os-market-share/mobile/worldwide) globally. CVE-2025-14174 — PT-2025-50966: https://dbu.gs/vulnerability/PT-2025-50966 CVE-2025-43529 — PT-2025-51037: https://dbu.gs/vulnerability/PT-2025-51037 CVE-2026-20700 — PT-2026-7805: https://dbu.gs/vulnerability/PT-2026-7805
Post summary
An iOS exploit targeting three newly disclosed vulnerabilities (CVE‑2025‑43529, CVE‑2025‑14174, CVE‑2026‑20700) is being sold, with technical details indicating a Safari‑triggered web exploit that can affect iOS versions 15.0 through 18.2.
7154825543.5K
3.7K followersView on X
blackorbird@blackorbird240d
Active Exploitation
CVE-2026-20700(Dynamic linker): An attacker with memory write capability may be able to execute arbitrary code. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 26. CVE-2025-14174 and CVE-2025-43529 were also issued in response to this report.
Post summary
Apple acknowledges possible exploitation of CVE-2026-20700 on iOS versions before iOS 26, where memory write can lead to arbitrary code execution; no PoC, patch, or workaround details are provided.
090653310.5K
39.9K followersView on X
ZEE JAILBREAK@ZeeJailbreak255d
PoC
Analysis of CVE-2025-43529 (WebKit UAF) + CVE-2025-14174 (ANGLE OOB) exploit chain - iOS Safari - iOS 26.1 https://github.com/zeroxjf/WebKit-UAF-ANGLE-OOB-Analysis/tree/main https://t.co/ZcGzBe18Tk
Post summary
The tweet announces an analysis of CVE‑2025‑43529 and CVE‑2025‑14174, linking to a GitHub repo that likely contains PoC code, but it does not provide exploit tool details or evidence of active exploitation.
013061276.5K
8.1K followersView on X
Hermes Tool@Hermes_tooll218d
PoC
Analysis of CVE-2025-43529 (WebKit UAF) + CVE-2025-14174 (ANGLE OOB) exploit chain - iOS Safari - iOS 26.1 https://github.com/zeroxjf/WebKit-UAF-ANGLE-OOB-Analysis/tree/main
Post summary
The post analyzes an exploit chain for CVE-2025-43529 and CVE-2025-14174, offering technical details and linking to a GitHub repository that likely hosts relevant PoC code.
08040364.9K
2.0K followersView on X
Hermes Tool@Hermes_tooll209d
General
Exploit chain analysis! CVE-2025-43529 (WebKit UAF) + CVE-2025-14174 https://github.com/SgtBattenHA/Analysis
Post summary
The post references a chain of CVEs (CVE‑2025‑43529 and CVE‑2025‑14174), links to a GitHub analysis, but does not provide exploit code, active exploitation evidence, or patch information.
18041172.5K
2.7K followersView on X
Aquads.xyz@_Aquads_202d
Patch
Google has released emergency updates to patch multiple actively exploited zero-day vulnerabilities in Chrome in early 2026, including CVE-2026-3909 (Skia out-of-bounds write) and CVE-2026-3910 (V8 inappropriate implementation). These critical flaws allow remote attackers to execute code via crafted websites, affecting desktop and mobile users. Update immediately to version 146.0.7680+. BleepingComputer BleepingComputer +3 Recent & Active Chrome Exploits (2025-2026) March 2026 (CVE-2026-3909/3910): Emergency patches for two zero-days, one in the Skia graphics library and another in the V8 JavaScript engine [3, BleepingComputer]. February 2026 (CVE-2026-2441): The first actively exploited zero-day of 2026 was patched in February, targeting Chrome, Android, and ChromeOS. February 2026 (CSS Sandbox Escape): A critical vulnerability in the CSS engine was reported to allow sandbox escapes, requiring immediate extension auditing and browser updates [2, Instagram]. December 2025 (CVE-2025-14174): An out-of-bounds memory access vulnerability in ANGLE was exploited, prompting urgent CISA action [12, The Hacker News]. September-November 2025 (CVE-2025-10585): A type confusion vulnerability in the V8 engine was actively exploited in the wild [7, YouTube]. YouTube YouTube +4 Vulnerability Types and Impact V8 Engine Vulnerabilities: The V8 JavaScript/WebAssembly engine is a frequent target for "type confusion" or "inappropriate implementation" bugs, allowing attackers to escape the browser sandbox. Out-of-Bounds (OOB) Write/Memory Access: Flaws in components like Skia or ANGLE allow attackers to write data outside intended memory areas, resulting in crashes or code execution. Remote Code Execution (RCE): Many of these exploits permit attackers to execute arbitrary code on the victim's machine, allowing them to steal data or install malware. CIS Center for Internet Security CIS Center for Internet Security +4 How to Protect Yourself Update Now: Go to chrome://settings/help to force an update to the latest version. Restart Chrome: Patches are only applied after restarting the browser. Check Extensions: Review installed extensions to ensure they are not malicious, as some attacks target browser security, per Instagram. Automatic Updates: Keep automatic updates enabled for your OS and browser
Post summary
Google released emergency Chrome patches for two actively exploited zero‑day CVEs (CVE‑2026‑3909 and CVE‑2026‑3910), urging users to update to version 146.0.7680+ to mitigate remote code execution risks.
791143327
686 followersView on X
Anas@Naz_style220d
General
@khanhduytran0 CVE that might be useful for IOS 18 JB Kernel CVE-2024-54518 CVE-2024-54522 CVE-2024-54523 Sandbox/ Privilege CVE-2024-54468 CVE-2024-54529 CVE-2024-54535 WebKit CVE-2024-54543 CVE-2025-14174 CVE-2025-43529 CVE-2025-43300
Post summary
The tweet lists a set of CVEs that may be useful for an iOS 18 jailbreak but provides no additional details, links, or evidence of exploitation.
010134902
75 followersView on X
𝕄𝕒𝕩@Mexrl229d
Patch
@PROGG_1 WebKit is still possible tho. 12.50 and 52 could work with WebKit because exploit bugs were found in WebKit that could work with ps4. CVE-2025-43529 (Use-After-Free in WebKit): Patched in December 2025, CVE-2025-24201 (Sandbox Escape), CVE-2025-14174. I read a lot so yeah.
Post summary
The tweet references several WebKit CVEs, noting that CVE-2025-43529 was patched in December 2025, and mentions other related vulnerabilities but does not provide PoC or active exploitation details.
10070346
533 followersView on X
ApplSec@ApplSec241d
Patch
🐛 CVE-2025-14174 (dyld) additional patches, 🐛 CVE-2025-43529 (dyld) additional patches, 🐛 CVE-2026-20700 (dyld): - iOS and iPadOS 26.3 - macOS Tahoe 26.3 - tvOS 26.3 - visionOS 26.3 - watchOS 26.3
Post summary
Patches for several dyld-related CVEs (CVE-2025-14174, CVE-2025-43529, CVE-2026-20700) have been released for iOS/iPadOS, macOS, tvOS, visionOS, and watchOS 26.3.
11031477
1.3K followersView on X
GenericCoding@GenericCoding68d
General
@MadAppleSider @D4RK7ET We are going to start implementing the ANGLE out of bounds write (CVE-2025-14174) next, I’m unsure how long it will take us to setup the needed GPU read / write primatives, sadly. We keep running into hardening mitigations.
Post summary
The author announces plans to work on the ANGLE out‑of‑bounds write vulnerability (CVE‑2025‑14174) but notes challenges from hardening mitigations.
11030211
765 followersView on X
Paul Ducklin@duckblog240d
Active Exploitation
New iPhone patches just dropped - lots of fixes including a zero-day malware implant vulnerability that’s already being exploited. CVE-2025-14174 and CVE-2025-43529 are the in-the-wild RCE holes. You’re looking for version 26.3 *after* the update. Enjoy! https://t.co/CArVRABz9x
Post summary
New iPhone patches address CVE-2025-14174 and CVE-2025-43529, which are actively exploited RCE vulnerabilities.
01021276
9.9K followersView on X
Grok@grok237d
Patch
The exact exploitation chain for CVE-2026-20700 involves prior WebKit zero-days (CVE-2025-14174 and CVE-2025-43529) to gain initial access, then memory corruption in dyld for arbitrary code execution. It's targeted and sophisticated, per reports. Browsers like Safari (using WebKit) can be entry points for the chain, potentially granting memory write access via those linked vulns, enabling this CVE's exploit. Update immediately.
Post summary
The post outlines a sophisticated exploitation chain for CVE-2026-20700 involving prior WebKit zero-days and urges users to update browsers immediately to mitigate the threat.
0002057
8.0M followersView on X
Muhd. Hasyimy@MHasyimy245d
General
I hope one day new PS4 webkit exploit on firmware 10.00 and higher finally see a day to abolish PS Vue and BD-JB Example vulnerability that missed on : CVE-2025-14174 CVE-2025-43529
Post summary
The post references a potential PS4 WebKit exploit affecting firmware 10.00+ and lists two CVEs, but provides no concrete evidence of exploitation or technical details.
00020327
4 followersView on X
Bo Shang@erolunar155d
PoC
scared? @grok 43 files changed, 1678 insertions(+), 1 deletion(-) create mode 100644 findings/CVE-2025-12727-V8-TYPECONF/README.md create mode 100644 findings/CVE-2025-12727-V8-TYPECONF/crashes/.analysis-note create mode 100644 findings/CVE-2025-12727-V8-TYPECONF/diff/patch-analysis.txt create mode 100644 findings/CVE-2025-12727-V8-TYPECONF/disclosure.md create mode 100644 findings/CVE-2025-12727-V8-TYPECONF/harness/.analysis-note create mode 100644 findings/CVE-2025-12727-V8-TYPECONF/intel/sources.md create mode 100644 findings/CVE-2025-12727-V8-TYPECONF/triage/.analysis-note create mode 100644 findings/CVE-2025-14174-WEBKIT/README.md create mode 100644 findings/CVE-2025-14174-WEBKIT/crashes/.analysis-note create mode 100644 findings/CVE-2025-14174-WEBKIT/diff/patch-analysis.txt create mode 100644 findings/CVE-2025-14174-WEBKIT/disclosure.md create mode 100644 findings/CVE-2025-14174-WEBKIT/harness/.analysis-note create mode 100644 findings/CVE-2025-14174-WEBKIT/intel/sources.md create mode 100644 findings/CVE-2025-14174-WEBKIT/triage/.analysis-note create mode 100644 findings/CVE-2025-15467-OPENSSL-CMS/README.md create mode 100644 findings/CVE-2025-15467-OPENSSL-CMS/crashes/vuln-db-analysis.txt create mode 100644 findings/CVE-2025-15467-OPENSSL-CMS/diff/patch-analysis.txt create mode 100644 findings/CVE-2025-15467-OPENSSL-CMS/disclosure.md create mode 100755 findings/CVE-2025-15467-OPENSSL-CMS/harness/poc-der-craft.py create mode 100644 findings/CVE-2025-15467-OPENSSL-CMS/intel/sources.md create mode 100644 findings/CVE-2025-15467-OPENSSL-CMS/triage/.analysis-note create mode 100644 findings/CVE-2026-31431-COPYFAIL/README.md create mode 100644 findings/CVE-2026-31431-COPYFAIL/crashes/variant-verification.txt create mode 100644 findings/CVE-2026-31431-COPYFAIL/diff/patch-analysis.txt create mode 100644 findings/CVE-2026-31431-COPYFAIL/disclosure.md create mode 100755 findings/CVE-2026-31431-COPYFAIL/harness/variant-checker.py create mode 100644 findings/CVE-2026-31431-COPYFAIL/intel/sources.md create mode 100644 findings/CVE-2026-31431-COPYFAIL/triage/.analysis-note create mode 100644 findings/CVE-2026-5450-GLIBC-SCANF/README.md create mode 100644 findings/CVE-2026-5450-GLIBC-SCANF/crashes/asan-log.txt create mode 100644 findings/CVE-2026-5450-GLIBC-SCANF/crashes/seeds/seed1.txt create mode 100644 findings/CVE-2026-5450-GLIBC-SCANF/crashes/seeds/seed2.txt create mode 100644 findings/CVE-2026-5450-GLIBC-SCANF/crashes/seeds/seed3.txt create mode 100644 findings/CVE-2026-5450-GLIBC-SCANF/diff/bug-locations.txt create mode 100644 findings/CVE-2026-5450-GLIBC-SCANF/diff/patch-v6.diff create mode 100644 findings/CVE-2026-5450-GLIBC-SCANF/diff/variant-analysis.txt create mode 100644 findings/CVE-2026-5450-GLIBC-SCANF/disclosure.md create mode 100644 findings/CVE-2026-5450-GLIBC-SCANF/harness/fuzz-harness.c create mode 100644 findings/CVE-2026-5450-GLIBC-SCANF/harness/poc-reproducer.c create mode 100644 findings/CVE-2026-5450-GLIBC-SCANF/intel/sources.md create mode 100644 findings/CVE-2026-5450-GLIBC-SCANF/triage/gdb-triage.txt
Post summary
The commit adds a PoC harness for CVE‑2025‑15467 (OpenSSL CMS), indicating disclosure of proof of concept code, with no signs of active exploitation or patching information.
10000513
8 followersView on X
CTIWatch@ctiwatchcloud182d
Active Exploitation
🚨 [HIGH] Active exploitation detected: CVE-2025-14174 Exploit in the wild confirmed for CVE-2025-14174 (CVSS 8.8). Google Chromium contains an out of bounds memory access vulnerability in ANGLE that could... 🔗 http://ctiwatch.cloud/alerts #ZeroDay #ExploitInWild #CyberSecurity
Post summary
The alert confirms the CVE-2025-14174 vulnerability is actively exploited in the wild, detailing an out-of-bounds memory access in Chromium's ANGLE component and its severity score.
00010335
5.6K followersView on X
bigmacd@bigmacd16684200d
Active Exploitation
"DarkSword" exploit chain, live since Nov 2025, linked 6 flaws: JavaScriptCore (CVE-2025-31277, CVE-2025-43529), dyld PAC bypass (CVE-2026-20700), WebContent sandbox escape (CVE-2025-14174). #cybersecurity
Post summary
The post announces the DarkSword exploit chain, which has been operational since November 2025 and targets multiple CVEs across JavaScriptCore, dyld, and WebContent, indicating active exploitation in the wild.
100006
4 followersView on X
Jugger@kkimjaechu25852201d
Disclosure
4/10 Step 4 ANGLE(그래픽 렌더링 라이브러리) 메모리 손상 CVE-2025-14174 → 커널 권한 상승 보조
Post summary
The entry reports a memory corruption vulnerability (CVE‑2025‑14174) in ANGLE that can lead to kernel privilege escalation.
1000089
104 followersView on X
Cleus@cleus_ai205d
Patch
Darksword hits six main bugs. cve-2025-31277 and cve-2025-43529 are javascript messes that let code run in safari. cve-2026-20700 skips pointer locks for real control. then sandbox breaks with cve-2025-14174 in graphics and cve-2025-43510 kernel copy bug. final kernel grab via cve-2025-43520 race flaw. all super dangerous memory issues with top danger scores, patched in ios 18.7+ and 26.x. those apple and russian flag pics nail it. update asap.
Post summary
The post lists six high‑severity bugs across Safari, graphics, and kernel components, confirms they are vulnerable to code execution or privilege escalation, and notes that iOS 18.7+ and 26.x patches address them, urging users to update.
00001184
434 followersView on X
Jλckλι@J4ck3LSyN211d
PoC
@isabelrosesss @atPakichu Until bro is to lazy to recompile and get hit with https://github.com/Satirush/CVE-2025-14174-Poc or others... (Not shitting on your approach just talking shit)
Post summary
The tweet references a GitHub repository containing a proof‑of‑concept for CVE‑2025‑14174, but offers no technical details, exploit code, patch guidance, or evidence of live exploitation.
00010368
174 followersView on X

CPE platform detail12 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

12 of 12 entries

Part	Vendor	Product	Version	Target SW	Target HW
OS	apple	ipados	-	-	-
OS	apple	iphone_os	-	-	-
OS	apple	macos	-	-	-
OS	apple	macos	-	-	-
App	apple	safari	-	-	-
OS	apple	tvos	-	-	-
OS	apple	visionos	-	-	-
OS	apple	watchos	-	-	-
App	google	chrome	-	-	-
OS	linux	linux_kernel	-	-	-
App	microsoft	edge_chromium	-	-	-
OS	microsoft	windows	-	-	-

Explore more

Back to dashboard apple CVEs google CVEs linux CVEs chrome vulnerabilities

What researchers are saying

CVE-2025-14174

YogSotho[verified]@YogSoth0Disclosure

The post announces a multi‑stage exploit chain for iOS 18.4‑18.7 that enables full device compromise, but it provides no PoC, tool, patch, or evidence of active exploitation.

dbugs[verified]@ptdbugsDisclosure

An iOS exploit targeting three newly disclosed vulnerabilities (CVE‑2025‑43529, CVE‑2025‑14174, CVE‑2026‑20700) is being sold, with technical details indicating a Safari‑triggered web exploit that can affect iOS versions 15.0 through 18.2.

blackorbird[verified]@blackorbirdActive Exploitation

Apple acknowledges possible exploitation of CVE-2026-20700 on iOS versions before iOS 26, where memory write can lead to arbitrary code execution; no PoC, patch, or workaround details are provided.

ZEE JAILBREAK[verified]@ZeeJailbreakPoC

The tweet announces an analysis of CVE‑2025‑43529 and CVE‑2025‑14174, linking to a GitHub repo that likely contains PoC code, but it does not provide exploit tool details or evidence of active exploitation.

Hermes Tool[verified]@Hermes_toollPoC

The post analyzes an exploit chain for CVE-2025-43529 and CVE-2025-14174, offering technical details and linking to a GitHub repository that likely hosts relevant PoC code.

Hermes Tool[verified]@Hermes_toollGeneral

The post references a chain of CVEs (CVE‑2025‑43529 and CVE‑2025‑14174), links to a GitHub analysis, but does not provide exploit code, active exploitation evidence, or patch information.

Aquads.xyz[verified]@_Aquads_Patch

Google released emergency Chrome patches for two actively exploited zero‑day CVEs (CVE‑2026‑3909 and CVE‑2026‑3910), urging users to update to version 146.0.7680+ to mitigate remote code execution risks.

Grok[verified]@grokPatch

The post outlines a sophisticated exploitation chain for CVE-2026-20700 involving prior WebKit zero-days and urges users to update browsers immediately to mitigate the threat.