Google Chrome CVE-2025-14766

Requires the victim to open attacker-controlled web content in a vulnerable Google Chrome build prior to 143.0.7499.147 - this is the UI:R user-interaction requirement (visiting a crafted HTML page or a page embedding malicious content). No authentication and no special server-side configuration are needed (PR:N). The primary limiting factors are: (1) mandatory user interaction of navigating to the malicious page, (2) the Chrome renderer sandbox, which typically requires a chained sandbox-escape for full host compromise rather than just renderer code execution, and (3) the victim must not yet be updated to 143.0.7499.147 or later.

This is a genuine high-priority issue despite the absence of exploitation telemetry. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8) indicates network-reachable, low-complexity, unauthenticated exploitation requiring only user interaction (visiting a page), with full confidentiality, integrity, and availability impact - the classic profile of a browser renderer memory-corruption flaw. V8 heap-corruption bugs in Chrome are historically among the most frequently weaponized vulnerability classes and a recurring presence in CISA KEV, so the real-world risk ceiling is high. Countervailing signals: no EPSS score, KEV status, or public POC was provided in the input, so at time of analysis there is no public exploit identified and no confirmed active exploitation. Note a minor data tension - the assigned CWE-125 (out-of-bounds read) understates the flaw, since the description explicitly states out-of-bounds read AND write leading to heap corruption, which is what justifies the I:H/A:H and RCE potential; the 'Information Disclosure' tag similarly captures only the read half. Google classifies the Chromium severity as High. Overall: treat as a priority patch-now item on exposure grounds, while acknowledging exploitation status is currently unconfirmed.

An attacker hosts a malicious web page (or injects a malicious ad/iframe into a legitimate site) containing crafted JavaScript that drives V8 into the out-of-bounds read/write condition. A victim running a vulnerable Chrome (before 143.0.7499.147) merely visits the page, triggering heap corruption in the renderer that can be groomed toward arbitrary code execution in the sandboxed renderer process. No public POC or exploit code was identified in the provided data.