CVE-2025-14766

HighCVSS 8.8/10Last modified Sep 30, 2026

Description

Out of bounds read and write in V8 in Google Chrome prior to 143.0.7499.147 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-125 CWE-787

Affected software

Vendor	Product	Versions
Google	Chrome	>= 143.0.7499.147, < 143.0.7499.147

References

https://chromereleases.googleblog.com/2025/12/stable-channel-update-for-desktop_16.htmlRelease Notes, Vendor Advisory
https://issues.chromium.org/issues/466786677Issue Tracking, Permissions Required

Timeline

Published: Dec 16, 2025
Last modified: Sep 30, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-147675.5The WPC Badge Management for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'text' attribute of the `CVE-2025-147697.5In some cases, the `tcp-setmss` handler may free the packet data and throw an error without halting the rule processing engine. A subsequen CVE-2025-14777.5An issue has been discovered in GitLab CE/EE affecting all versions from 8.14 before 18.0.6, 18.1 before 18.1.4, and 18.2 before 18.2.2 that CVE-2025-147707.5The Shipping Rate By Cities plugin for WordPress is vulnerable to SQL Injection via the 'city' parameter in all versions up to, and includin CVE-2025-147719.9Files or directories accessible to external parties vulnerability in ABB T-MAC Plus. This issue affects T-MAC Plus: 4.0-24.CVE-2025-147728.8Authorization bypass through User-Controlled key vulnerability in ABB T-MAC Plus. This issue affects T-MAC Plus: 4.0-24.CVE-2025-147735.4Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in ABB T-MAC Plus. This issue affects T-CVE-2025-147747.4Incorrect Authorization vulnerability in ABB T-MAC Plus. This issue affects T-MAC Plus: 4.0-24.CVE-2025-147776.0A flaw was found in Keycloak. An IDOR (Broken Access Control) vulnerability exists in the admin API endpoints for authorization resource man CVE-2025-147785.4A flaw was found in Keycloak. A significant Broken Access Control vulnerability exists in the UserManagedPermissionService (UMA Protection A CVE-2025-147793.8The Secret Type Management REST API does not correctly isolate access controls when deleting a secret type. The on-delete cascade logic, whe CVE-2025-14787.5An issue has been discovered in GitLab CE/EE affecting all versions from 8.13 before 17.10.7, 17.11 before 17.11.3, and 18.0 before 18.0.1.