Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2025-14766: Google Chrome Heap Corruption via Malicious HTML Page

CVE-2025-14766 · published 10 months ago

Summary

Google Chrome versions before 143.0.7499.147 allow an attacker to potentially cause Chrome to malfunction by loading a specially crafted HTML page. This could lead to unpredictable behavior or crashes. Update to the latest version of Google Chrome to fix this issue.

What to do

Update google chrome to version 143.0.7499.146 or later.

Affected software

Vendor	Product	Affected versions
google	chrome	< 143.0.7499.146 `cpe:2.3:a:google:chrome::::::::`

Original advisory text

Out of bounds read and write in V8 in Google Chrome prior to 143.0.7499.147 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

References

https://chromereleases.googleblog.com/2025/12/stable-channel-update-for-desktop_... Release Notes Vendor Advisory
https://issues.chromium.org/issues/466786677 Issue Tracking Permissions Required

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker full control

Severity

8.8 High

Exploitation

3% chance of attack within 30 days

Type

CWE-125Out-of-bounds Read

CWE-787Out-of-bounds Write

Timeline

Published16 Dec 2025

Updated4 Nov 2026

First seen7 Mar 2026

Sources

CVE-2025-14766 · NVD

Track software like this

Free during beta