AppleExploited incident

WebKit/ANGLE flaws exploited against targeted iPhone users, publicly flagged by Google two days before Apple's fix

CVE-2025-43529, CVE-2025-14174High, CVSS 8.8In CISA's Known Exploited Vulnerabilities catalog since 15 Dec 2025

Exploited before a fix

FixedFixed for every supported version 2 days after the first public report.

Response

Silence: 2d
Exposure: 2d
Follow-through: 2d

Vendor silent
Vendor statement, no fix
Fixed for some versions
Fixed when disclosed
Date only, no time of day

Timeline and evidence

First public report
10 Dec 2025, 18:25 UTC
Chrome Releases Atom feed, entry 'Stable Channel Update for Desktop' (2025-12-10)CuratedQuote verified
2025-12-10T10:25:00.000-08:00
The feed entry's <published> time (= 18:25 UTC) for Google's Chrome 143 stable update, which flagged an in-the-wild exploit for Chromium bug 466192044, later CVE-2025-14174 ('Out of bounds memory access in ANGLE'). The original post text read 'Google is aware that an exploit for 466192044 exists in the wild.' (Wayback capture of 2025-12-11 00:03 UTC); the feed carries the 2025-12-12 updated wording. ANGLE is shared with Apple's WebKit, and Apple says CVE-2025-14174 'was also issued in response to this report'.
Source
Chrome Releases Atom feed, entry 'Stable Channel Update for Desktop' (2025-12-10) vendor blog
Recorded time
10 Dec 2025, 18:25 UTC
Precision
To the minute
Origin
Curated. Found by a researcher, with a verbatim quote and link.
Quote check
Found in the archived copy
Snapshot
sha256:4ee3c7d3636ef84b…
Used in metrics
Yes
Dispute this timestamp
8 more sources for this moment
Chrome Releases Atom feed, entry 'Stable Channel Update for Desktop' (2025-12-10)CuratedQuote verified10 Dec 2025
Google is aware that an exploit for CVE-2025-14174 exists in the wild.
Current wording of the 2025-12-10 post (updated 2025-12-12 with the CVE number: '2025-12-12: Updated to include more details for bug number 466192044'). Re-sourced 2026-10-23: the HTML post keeps its body in a script template, which some verifiers drop.
Source
Chrome Releases Atom feed, entry 'Stable Channel Update for Desktop' (2025-12-10) vendor blog
Recorded time
10 Dec 2025
Precision
Date only (no time of day is shown)
Origin
Curated. Found by a researcher, with a verbatim quote and link.
Quote check
Found in the archived copy
Snapshot
sha256:4ee3c7d3636ef84b…
Used in metrics
No, kept for the record
Dispute this timestamp
Apple advisory 125884/CVE-2025-14174ClaimedQuote verified12 Dec 2025
been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 26. CVE-2025-43529 was also issued in response to this report. Description: A memory corruption issue was addressed with improved validation.
The vendor's own disclosure.
Source
Apple advisory 125884/CVE-2025-14174 vendor advisory
Recorded time
12 Dec 2025
Precision
Date only (no time of day is shown)
Origin
Claimed. The date the source gives.
Quote check
Found in the archived copy
Snapshot
sha256:2f45f7226b61f2ef…
Used in metrics
No, kept for the record
Dispute this timestamp
CISA KEV (CVE-2025-14174)ClaimedQuote verified12 Dec 2025
Google Chromium Out of Bounds Memory Access Vulnerability
Added to CISA's KEV catalog on 2025-12-12.
Source
CISA KEV (CVE-2025-14174) kev
Recorded time
12 Dec 2025
Precision
Date only (no time of day is shown)
Origin
Claimed. The date the source gives.
Quote check
Found in the archived copy
Snapshot
sha256:ef8fffede5c47200…
Used in metrics
No, kept for the record
Dispute this timestamp
Bluesky postClaimedQuote not checked yet12 Dec 2025, 02:57 UTC
「Microsoft Edge」でもゼロデイ脆弱性「CVE-2025-14174」が修正、実環境での悪用を確認／v143.0.3650.80が安定チャネルでリリース
Earliest third-party post we hold.
Source
Bluesky post social
Recorded time
12 Dec 2025, 02:57 UTC
Precision
To the minute
Origin
Claimed. The date the source gives.
Quote check
Not checked yet
Snapshot
No archived snapshot
Used in metrics
No, kept for the record
Dispute this timestamp
CVE.org record CVE-2025-14174ClaimedQuote verified12 Dec 2025, 19:20 UTC
Out of bounds memory access in ANGLE in Google Chrome on Mac prior to 143.0.7499.110 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security
CVE record published.
Source
CVE.org record CVE-2025-14174 cve record
Recorded time
12 Dec 2025, 19:20 UTC
Precision
To the minute
Origin
Claimed. The date the source gives.
Quote check
Found in the archived copy
Snapshot
sha256:3f0974f5830f813d…
Used in metrics
No, kept for the record
Dispute this timestamp
Mastodon postClaimedQuote not checked yet14 Dec 2025, 19:34 UTC
Update Now Warning Issued to All iPhone Users https://www. forbes.com/sites/kateoflaherty uk/2025/12/14/ios-262-update-now-waning-issued-to-all-iphone-users/ # ycombinator # ios_26_2update #
Earliest third-party post we hold.
Source
Mastodon post social
Recorded time
14 Dec 2025, 19:34 UTC
Precision
To the minute
Origin
Claimed. The date the source gives.
Quote check
Not checked yet
Snapshot
No archived snapshot
Used in metrics
No, kept for the record
Dispute this timestamp
CISA KEV (CVE-2025-43529)ClaimedQuote verified15 Dec 2025
Apple Multiple Products Use-After-Free WebKit Vulnerability
Added to CISA's KEV catalog on 2025-12-15.
Source
CISA KEV (CVE-2025-43529) kev
Recorded time
15 Dec 2025
Precision
Date only (no time of day is shown)
Origin
Claimed. The date the source gives.
Quote check
Found in the archived copy
Snapshot
sha256:ef8fffede5c47200…
Used in metrics
No, kept for the record
Dispute this timestamp
Hacker NewsClaimedQuote not checked yet11 Jan 2026, 20:01 UTC
> CVE-2025-43529 allows threat actors a direct code execution capability, while CVE-2025-14174 provides the much needed sandbox escape and privilege escalation capabilities which makes it devastating Good news for people wanting to run the code they want
Earliest third-party post we hold.
Source
Hacker News hn
Recorded time
11 Jan 2026, 20:01 UTC
Precision
To the minute
Origin
Claimed. The date the source gives.
Quote check
Not checked yet
Snapshot
No archived snapshot
Used in metrics
No, kept for the record
Dispute this timestamp
Vendor statement
12 Dec 2025date only+2d
Apple advisory 125885/CVE-2025-14174ClaimedQuote verified
Released December 12, 2025
From the advisory's revision history.
Source
Apple advisory 125885/CVE-2025-14174 vendor advisory
Recorded time
12 Dec 2025
Precision
Date only (no time of day is shown)
Origin
Claimed. The date the source gives.
Quote check
Found in the archived copy
Snapshot
sha256:7ba32cb0d1cb9c5b…
Used in metrics
Yes
Dispute this timestamp
6 more sources for this moment
Apple advisory 125886/CVE-2025-14174ClaimedQuote verified12 Dec 2025
Released December 12, 2025
From the advisory's revision history.
Source
Apple advisory 125886/CVE-2025-14174 vendor advisory
Recorded time
12 Dec 2025
Precision
Date only (no time of day is shown)
Origin
Claimed. The date the source gives.
Quote check
Found in the archived copy
Snapshot
sha256:23936de96bf50f21…
Used in metrics
No, kept for the record
Dispute this timestamp
Apple advisory 125889/CVE-2025-14174ClaimedQuote verified12 Dec 2025
Released December 12, 2025
From the advisory's revision history.
Source
Apple advisory 125889/CVE-2025-14174 vendor advisory
Recorded time
12 Dec 2025
Precision
Date only (no time of day is shown)
Origin
Claimed. The date the source gives.
Quote check
Found in the archived copy
Snapshot
sha256:a81c1e1e0bc1adde…
Used in metrics
No, kept for the record
Dispute this timestamp
Apple advisory 125890/CVE-2025-14174ClaimedQuote verified12 Dec 2025
Released December 12, 2025
From the advisory's revision history.
Source
Apple advisory 125890/CVE-2025-14174 vendor advisory
Recorded time
12 Dec 2025
Precision
Date only (no time of day is shown)
Origin
Claimed. The date the source gives.
Quote check
Found in the archived copy
Snapshot
sha256:5a8298e0d5bb0e27…
Used in metrics
No, kept for the record
Dispute this timestamp
Apple advisory 125891/CVE-2025-14174ClaimedQuote verified12 Dec 2025
Released December 12, 2025
From the advisory's revision history.
Source
Apple advisory 125891/CVE-2025-14174 vendor advisory
Recorded time
12 Dec 2025
Precision
Date only (no time of day is shown)
Origin
Claimed. The date the source gives.
Quote check
Found in the archived copy
Snapshot
sha256:b02855c3fbdc1cb7…
Used in metrics
No, kept for the record
Dispute this timestamp
Apple advisory 125892/CVE-2025-14174ClaimedQuote verified12 Dec 2025
Released December 12, 2025
From the advisory's revision history.
Source
Apple advisory 125892/CVE-2025-14174 vendor advisory
Recorded time
12 Dec 2025
Precision
Date only (no time of day is shown)
Origin
Claimed. The date the source gives.
Quote check
Found in the archived copy
Snapshot
sha256:c55b879a300bfd62…
Used in metrics
No, kept for the record
Dispute this timestamp
Apple security content of iOS 26.2 and iPadOS 26.2CuratedQuote not checked yet12 Dec 2025
iOS 26.2 and iPadOS 26.2 Released December 12, 2025
Source
Apple security content of iOS 26.2 and iPadOS 26.2 vendor advisory
Recorded time
12 Dec 2025
Precision
Date only (no time of day is shown)
Origin
Curated. Found by a researcher, with a verbatim quote and link.
Quote check
Not checked yet
Snapshot
No archived snapshot
Used in metrics
No, kept for the record
Dispute this timestamp
First workaround
No official mitigation found yet.
First fix
12 Dec 2025date only+2dUnverified: no archived copy, quote not checked yet
Apple security content of iOS 26.2 and iPadOS 26.2CuratedQuote not checked yet
Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 26. CVE-2025-14174 was also issued in response to this report.
WebKit entry for CVE-2025-43529 (credited to Google Threat Analysis Group) in the iOS 26.2 advisory, released December 12, 2025.
Source
Apple security content of iOS 26.2 and iPadOS 26.2 vendor advisory
Recorded time
12 Dec 2025
Precision
Date only (no time of day is shown)
Origin
Curated. Found by a researcher, with a verbatim quote and link.
Quote check
Not checked yet
Snapshot
No archived snapshot
Used in metrics
Yes
Dispute this timestamp
6 more sources for this moment
Apple advisory 125885/CVE-2025-14174ClaimedQuote verified12 Dec 2025
Released December 12, 2025
fixed in iOS 18.7.3 and iPadOS 18.7.3; one candidate per OS branch
Source
Apple advisory 125885/CVE-2025-14174 vendor advisory
Recorded time
12 Dec 2025
Precision
Date only (no time of day is shown)
Origin
Claimed. The date the source gives.
Quote check
Found in the archived copy
Snapshot
sha256:7ba32cb0d1cb9c5b…
Used in metrics
No, kept for the record
Dispute this timestamp
Apple advisory 125886/CVE-2025-14174ClaimedQuote verified12 Dec 2025
Released December 12, 2025
fixed in macOS Tahoe 26.2; one candidate per OS branch
Source
Apple advisory 125886/CVE-2025-14174 vendor advisory
Recorded time
12 Dec 2025
Precision
Date only (no time of day is shown)
Origin
Claimed. The date the source gives.
Quote check
Found in the archived copy
Snapshot
sha256:23936de96bf50f21…
Used in metrics
No, kept for the record
Dispute this timestamp
Apple advisory 125889/CVE-2025-14174ClaimedQuote verified12 Dec 2025
Released December 12, 2025
fixed in tvOS 26.2; one candidate per OS branch
Source
Apple advisory 125889/CVE-2025-14174 vendor advisory
Recorded time
12 Dec 2025
Precision
Date only (no time of day is shown)
Origin
Claimed. The date the source gives.
Quote check
Found in the archived copy
Snapshot
sha256:a81c1e1e0bc1adde…
Used in metrics
No, kept for the record
Dispute this timestamp
Apple advisory 125890/CVE-2025-14174ClaimedQuote verified12 Dec 2025
Released December 12, 2025
fixed in watchOS 26.2; one candidate per OS branch
Source
Apple advisory 125890/CVE-2025-14174 vendor advisory
Recorded time
12 Dec 2025
Precision
Date only (no time of day is shown)
Origin
Claimed. The date the source gives.
Quote check
Found in the archived copy
Snapshot
sha256:5a8298e0d5bb0e27…
Used in metrics
No, kept for the record
Dispute this timestamp
Apple advisory 125891/CVE-2025-14174ClaimedQuote verified12 Dec 2025
Released December 12, 2025
fixed in visionOS 26.2; one candidate per OS branch
Source
Apple advisory 125891/CVE-2025-14174 vendor advisory
Recorded time
12 Dec 2025
Precision
Date only (no time of day is shown)
Origin
Claimed. The date the source gives.
Quote check
Found in the archived copy
Snapshot
sha256:b02855c3fbdc1cb7…
Used in metrics
No, kept for the record
Dispute this timestamp
Apple advisory 125892/CVE-2025-14174ClaimedQuote verified12 Dec 2025
Released December 12, 2025
fixed in Safari 26.2; one candidate per OS branch
Source
Apple advisory 125892/CVE-2025-14174 vendor advisory
Recorded time
12 Dec 2025
Precision
Date only (no time of day is shown)
Origin
Claimed. The date the source gives.
Quote check
Found in the archived copy
Snapshot
sha256:c55b879a300bfd62…
Used in metrics
No, kept for the record
Dispute this timestamp
Fixed for all versions
12 Dec 2025date only+2d
Apple security content of iOS 18.7.3 and iPadOS 18.7.3CuratedQuote verified
iOS 18.7.3 and iPadOS 18.7.3 Released December 12, 2025
The exploited versions were 'versions of iOS before iOS 26'; iOS 18.7.3, macOS Sequoia 15.7.3, macOS Sonoma 14.8.3, Safari 26.2 and the other 26.2 releases were all listed on Apple's security releases page for 12 Dec 2025. No fixes for older iOS lines (16.x, 15.x) appear on that date; whether Apple later backported was not checked.
Source
Apple security content of iOS 18.7.3 and iPadOS 18.7.3 vendor advisory
Recorded time
12 Dec 2025
Precision
Date only (no time of day is shown)
Origin
Curated. Found by a researcher, with a verbatim quote and link.
Quote check
Found in the archived copy
Snapshot
sha256:7ba32cb0d1cb9c5b…
Used in metrics
Yes
Dispute this timestamp
1 more source for this moment
Apple advisory 125884/CVE-2025-14174Inferred12 Dec 2025
been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 26. CVE-2025-43529 was also issued in response to this report. Description: A memory corruption issue was addressed with improved validation.
Patch-day rule: Apple ships fixes in the advisory that discloses a bug, and this advisory states that fixed versions exist. So the vendor statement, first fix and fix for all versions all take the advisory's publication time.
Source
Apple advisory 125884/CVE-2025-14174 vendor advisory
Recorded time
12 Dec 2025
Precision
Date only (no time of day is shown)
Origin
Inferred. Derived by a documented rule.
Quote check
Found in the archived copy
Snapshot
sha256:2f45f7226b61f2ef…
Used in metrics
No, kept for the record
Dispute this timestamp

Send this to your boss

No brief for this incident yet. We write one for every open incident and every critical bug exploited before a fix.

Affected products

iOS and iPadOS before 26.2 and before 18.7.3
macOS Tahoe before 26.2, Sequoia before 15.7.3, Sonoma before 14.8.3
Safari before 26.2
tvOS, watchOS and visionOS before 26.2

How we built this timeline

Selected as a patch-day exception: the routine inference would set world = Apple's own disclosure (12 Dec 2025), but exploitation of the shared ANGLE bug was public from Google's 10 Dec 2025 Chrome release, two days earlier. Grouping: CVE-2025-43529 (WebKit use-after-free) and CVE-2025-14174 (ANGLE) are fixed in the same Apple advisories and tied to the same exploitation report;

CVE-2025-43529 is the Apple-assigned primary. CVE-2025-14174 is also a Google/Chrome CVE (KEV vendor 'Google', added 12 Dec 2025);

Chrome's own timeline for it is routine (disclosed with the fix) and is left to the pipeline. Apple gives no CVSS; 8.8 is the CISA-ADP score for both CVEs.

Apple's CVE-2025-43529 record was only published 17 Dec 2025.

Multiple Products Classic Buffer Overflow Vulnerability CVE-2025-43520
Multiple Products Improper Locking Vulnerability CVE-2025-43510

Apple report card

Response

Timeline and evidence

First public report

Vendor statement

First workaround

First fix

Fixed for all versions

Send this to your boss

Affected products

Related