QtWebEngine CVE-2025-14174

Exploitation requires the victim to render attacker-controlled web content in a Chromium-based engine build (Chrome, Edge Chromium, or an application embedding qt6-qtwebengine such as Qt apps on Alpine Linux) that predates the fix - qt6-qtwebengine before 6.10.1-r2 on Alpine, or the pre-patch Chrome/Edge stable builds referenced. No authentication or elevated privileges are needed (PR:N), but user interaction IS required (UI:R): the victim must load a malicious or compromised page. The primary limiting factor is that the attacker must get the victim to visit crafted content; there is no server-side or listening-service exposure. Sandbox escape is not indicated by the S:U scope, so impact is bounded to the browser/renderer process context unless chained with a separate escape.

This is a genuine top-priority vulnerability, and the signals are unusually well-aligned rather than conflicting. CISA KEV = YES confirms active in-the-wild exploitation, which is the single strongest risk signal available and overrides the otherwise modest EPSS score of 0.30% (53rd percentile). The low EPSS is not contradictory: EPSS models broad, automated, commodity exploitation, whereas browser 0-days like this are typically used in targeted, sophisticated campaigns (often via malicious/compromised web pages) - so low EPSS alongside KEV listing suggests targeted exploitation rather than mass scanning, which does NOT reduce urgency for patching. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8 High) is consistent with a CWE-787 out-of-bounds write in the Chromium/qtwebengine rendering engine: network-reachable, no privileges, low complexity, requiring only that a victim visit a malicious page (UI:R). The full C:H/I:H/A:H triad reflects renderer memory corruption leading to arbitrary code execution in the browser process context. The one caveat worth flagging: the CPE list mixes Google Chrome, Microsoft Edge (Chromium), AND Apple Safari/iOS/iPadOS/macOS/tvOS entries, which is internally inconsistent - a Chromium V8/Blink flaw would not normally affect Safari/WebKit. This CPE set appears to be an aggregated/merged mapping and should be treated with caution; the authoritative affected component per the description is qt6-qtwebengine (Chromium engine) on Alpine, fixed in 6.10.1-r2, and per references Chrome Stable and Edge Chromium.

An attacker lures a victim to a malicious or compromised web page (or serves a malicious ad/iframe) that triggers an out-of-bounds write in the Chromium-based rendering engine embedded in qt6-qtwebengine. The memory corruption is leveraged to achieve arbitrary code execution in the browser/renderer process with no authentication and only a single page visit required. CISA KEV confirms this is already being exploited in the wild, though no standalone public POC is referenced.