Google Chrome CVE-2025-14372

Exploitation requires the victim to open a crafted HTML page in a vulnerable Chrome build (prior to 143.0.7499.110), so user interaction is mandatory (UI:R) even though no authentication is needed (PR:N). The trigger is specific to the Password Manager component's handling that leads to a use-after-free. The primary limiting factor is that this yields only a memory-corruption primitive toward a sandbox escape (C:L/I:L/A:N), meaning practical impact realistically depends on chaining a second renderer/RCE bug; there is no single-bug remote code execution. Chrome's default auto-update mechanism also narrows the real-world exposure window.

This is a moderate-risk, not high-priority, issue when all signals are weighed together. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, 6.1) shows a network-reachable, low-complexity, unauthenticated flaw that nonetheless requires user interaction (UI:R - the victim must visit a crafted page) and yields only low confidentiality and integrity impact with a scope change, consistent with a memory-corruption bug that could contribute to a sandbox escape rather than deliver full code execution on its own. Google itself rated the Chromium security severity as Medium. Exploitation signals are reassuring: EPSS is low at 0.24% (14th percentile), there is no CISA KEV listing, and no public exploit identified at time of analysis. The stated impact is 'potentially perform a sandbox escape,' which is inherently a chained primitive - a single UAF in the Password Manager component typically must be combined with a renderer RCE to become dangerous, so real-world weaponization is non-trivial. One inconsistency to note: the input Tags include 'Denial Of Service,' but the CVSS vector sets A:N (no availability impact) and the description describes a sandbox escape (an integrity/confidentiality concern), so the DoS characterization appears inaccurate. Net: a real but medium-priority browser bug best handled through routine Chrome auto-update rather than emergency patching.

An attacker hosts or compromises a web page containing crafted HTML/JavaScript that manipulates Chrome's Password Manager to trigger a use-after-free, then lures a victim into visiting it (UI:R). By grooming the freed object, the attacker gains a memory-corruption primitive that, chained with a separate renderer exploit, could help escape the browser sandbox. No public exploit code is known, and the low complexity is offset by the need for the victim to load the page and the requirement to chain additional bugs for meaningful impact.