Chrome Targeted by Active In-the-Wild Exploit Tied to Undisclosed High-Severity Flaw
Summary: Google released Chrome security updates on Wednesday for three flaws, including a high-severity vulnerability tracked as Chromium issue 466192044 that it says is being actively exploited in the wild. The flaw was later assigned CVE-2025-14174 (CVSS 8.8), an out-of-bounds memory access in the ANGLE library that CISA says could let a remote attacker trigger it via a crafted HTML page, and CISA added it to its KEV catalog with a January 2, 2026 fix deadline for FCEB agencies.
Bottom line: Google has now patched eight Chrome zero-days since the start of the year, and this one was reported by Apple SEAR and Google TAG on December 5, 2025 - with the attacker, targets, and scale still undisclosed. CISA's January 2, 2026 deadline gives federal agencies a fixed clock, and every Chromium-based browser in your estate inherits the same exposure until its vendor ships the fix.