Loading story…
CISA has added the Google Chromium vulnerability CVE-2025-14174 to its Known Exploited Vulnerabilities (KEV) catalog after confirming active exploitation in the wild. This high-severity flaw, found in the ANGLE graphics abstraction layer used by Chromium-based browsers, allows out-of-bounds memory access due to improper buffer sizing in the Metal renderer. The vulnerability affects Google Chrome on macOS prior to version 143.0.7499.110, with related fixes also applied to Windows and Linux builds. Exploitation of this vulnerability can lead to memory corruption, browser crashes, or potentially arbitrary code execution within the browser context.
Under Binding Operational Directive (BOD) 22-01, Federal Civilian Executive Branch agencies are required to remediate this vulnerability by the specified deadline, while CISA strongly encourages all organizations to prioritize patching. The addition of CVE-2025-14174 to the KEV catalog highlights its active exploitation and the significant risk it poses to federal and other enterprise environments. Organizations are urged to update affected systems promptly to mitigate the threat posed by this vulnerability.
See which actors are running it and whether you're in range.
2 events from the most recent confirmed update back to the earliest known activity.
Under Binding Operational Directive 22-01, Federal Civilian Executive Branch agencies were required to remediate the newly listed KEV vulnerabilities by January 2, 2026. CISA also urged all organizations to prioritize patching to reduce exposure to active exploitation.
CISA added Sierra Wireless AirLink ALEOS flaw CVE-2018-4063 and Google Chromium flaw CVE-2025-14174 to its Known Exploited Vulnerabilities Catalog after evidence of active exploitation. The KEV additions made both issues priority remediation items for federal agencies.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**CISA** added two **Google Chrome** vulnerabilities to its **Known Exploited Vulnerabilities (KEV)** catalog after Google disclosed active exploitation in the wild. The flaws are **CVE-2026-3909**, an out-of-bounds write in **Skia**, and **CVE-2026-3910**, a **Chromium V8** memory-safety issue that can allow arbitrary code execution inside the browser sandbox via a crafted HTML page. Google rated both issues as high severity with **CVSS 8.8** and released fixes in Chrome **146.0.7680.75/76** for Windows and Mac and **146.0.7680.75** for Linux. CISA's KEV entry states that **CVE-2026-3910** may affect multiple Chromium-based browsers, including **Google Chrome, Microsoft Edge, and Opera**, while **CVE-2026-3909** impacts the shared **Skia** component and may affect **Chrome, ChromeOS, Android, Flutter, and other products** depending on vendor implementation. Federal agencies were directed to apply vendor mitigations or discontinue use if fixes are unavailable, with a remediation due date of **2026-03-27**. Neither source attributes the exploitation to a specific threat actor, but both confirm the vulnerabilities are being exploited and require prompt patching.
Jun 29, 2026
**Google Chrome** received a security update for **CVE-2026-3909**, an **out-of-bounds write** flaw in the **Skia** graphics component, and **CISA** added the vulnerability to its **Known Exploited Vulnerabilities (KEV)** catalog. The issue affects Chrome desktop versions prior to `146.0.7680.80` on Windows, macOS, and Linux, and CISA’s KEV entry states the bug could allow a remote attacker to trigger out-of-bounds memory access through a crafted HTML page. The KEV record also notes that the vulnerable component is widely used and may affect **ChromeOS, Android, Flutter, and other products** depending on vendor implementation and patch status. The available reporting indicates **active exploitation awareness** at the time of disclosure, elevating the issue from a routine browser patch to a priority remediation item. Canadian Centre for Cyber Security guidance directs administrators to review Google’s advisory and apply updates, while the KEV entry instructs organizations to follow vendor mitigations, comply with applicable **BOD 22-01** requirements for cloud services, or discontinue use if no mitigation is available. Other advisories in the set cover unrelated vendor and ICS vulnerability bulletins and do not describe the same specific event.
Jun 29, 2026
CISA has added CVE-2025-10585, a type confusion vulnerability in Google Chromium's V8 engine, to its Known Exploited Vulnerabilities (KEV) Catalog following evidence of active exploitation. Google released a security update for Chrome addressing this zero-day, which is the sixth such exploited vulnerability in 2025. Federal agencies are required to remediate this vulnerability by October 14, 2025, and all organizations are strongly urged to prioritize patching.
Jun 29, 2026