Everything you need to know about Google and Apple’s emergency zero-day patches
A serious zero-day bug was spotted in Chrome systems that impacts Apple users too, forcing both companies to issue emergency patches
Sign up today and you will receive a free copy of our Future Focus 2025 report - the leading guidance on AI, cybersecurity and other IT challenges as per 700+ senior executives
You are now subscribed
Your newsletter sign-up was successful
Apple, Google, and other browser makers have rolled out patches for zero-day bugs that are already being used by threat actors in "sophisticated" attacks.
Google noted that an exploit for one of the bugs exists in the wild already and was spotted by its Threat Analysis Group – that largely works on serious attacks led by state actors or similar – and was sorted via coordination with Apple engineers.
"For these Apple- and ANGLE-related issues, the quiet, coordinated disclosure strongly suggests the vendors viewed the bugs as high-risk and potentially already known to capable adversaries," Douglas McKee, director of vulnerability intelligence at Rapid7, told Dark Reading.
One of the bugs impacts other browser makers using Chromium, including Microsoft Edge and Vivaldi, which have also rolled out patches this week.
Patches for Apple
Alongside a set of other updates, Apple issued emergency patches for two issues in WebKit for devices running versions of its software before iOS 26. The flaws, CVE-2025-14174 and CVE-2025-43529, were credited, in full or in part, to Google Threat Analysis Group.
The first meant that accessing a webpage with "maliciously crafted" content could lead to arbitrary code execution. "A use-after-free issue was addressed with improved memory management," Apple said in a support document.
For the second, Apple said that malicious websites could lead to memory corruption, saying the issue was "addressed with improved validation."
Sign up today and you will receive a free copy of our Future Focus 2025 report - the leading guidance on AI, cybersecurity and other IT challenges as per 700+ senior executives
"Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 26," the company said in a support document detailing both issues.
The patches for the zero-day flaws are available for devices going back to iPhone 11, iPad Pro 12.9-inch 3rd generation, iPad Pro 11-inch 1st generation, iPad Air 3rd generation, iPad 8th generation, and iPad mini 5th generation.
Apple gave little extra detail about the zero-day flaws, saying it "doesn't disclose, discuss or confirm security issues". However, the tech giant issued a patch for the bugs alongside a set of other security issues that included further fixes for WebKit, the ScreenTime tool and more.
Google patches flaws
Google revealed its flaw via an update to the Stable Channel for the desktop version of its Chrome browser, crediting the discovery of CVE-2025-14174 to the Google Threat Analysis Group as well as Apple Security Engineering and Architecture.
Google had initially patched the flaw last week without any details beyond a "high" rating, but has now filled in a few details.
That flaw, labelled as a high-risk vulnerability, was first spotted December 5 and is caused by out-of-bounds memory access in Chrome's Almost Native Graphics Layer Engine (ANGLE), which is also used by WebKit, hence the impact on Apple.
"Out of bounds memory access in ANGLE in Google Chrome on Mac prior to 143.0.7499.110 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page," said the CVE.org support page for the flaw.
"Google is aware that an exploit for CVE-2025-14174 exists in the wild," Google added in a blog post.
The company also patched two other medium-level flaws in the stable channel at the same time.
FOLLOW US ON SOCIAL MEDIA
Make sure to follow ITPro on Google News to keep tabs on all our latest news, analysis, and reviews.
You can also follow ITPro on LinkedIn, X, Facebook, and BlueSky.
Freelance journalist Nicole Kobie first started writing for ITPro in 2007, with bylines in New Scientist, Wired, PC Pro and many more.
Nicole the author of a book about the history of technology, The Long History of the Future.
-
Low-budget devices are the biggest casualty of the RAM crisisNews Say goodbye to budget devices; vendors are doubling down on high-end options to absorb costs
-
Sectigo taps Clint Maddox to lead global field operationsReviews The appointment follows a year of strong momentum for the security vendor as it expands its global channel footprint
-
Flaw in Chrome’s Gemini Live gave attackers access to user cameras and microphonesNews The in-browser AI assistant loads differently in the side panel, rather than a regular tab, exposing users to risks
-
Security agencies issue warning over critical Cisco Catalyst SD-WAN vulnerabilityNews Threat actors have been exploiting the vulnerability to achieve root access since 2023
-
Millions of developers could be impacted by flaws in Visual Studio Code extensions – here's what you need to know and how to protect yourselfNews The VS Code vulnerabilities highlight broader IDE security risks, said OX Security
-
CVEs are set to top 50,000 this year, marking a record high – here’s how CISOs and security teams can prepare for a looming onslaughtNews While the CVE figures might be daunting, they won't all be relevant to your organization
-
Microsoft patches six zero-days targeting Windows, Word, and more – here’s what you need to knowNews Patch Tuesday update targets large number of vulnerabilities already being used by attackers
-
Former Google engineer convicted of economic espionage after stealing thousands of secret AI, supercomputing documentsNews Linwei Ding told Chinese investors he could build a world-class supercomputer
-
Experts welcome EU-led alternative to MITRE's vulnerability tracking schemeNews The EU-led framework will reduce reliance on US-based MITRE vulnerability reporting database
-
Veeam patches Backup & Replication vulnerabilities, urges users to updateNews The vulnerabilities affect Veeam Backup & Replication 13.0.1.180 and all earlier version 13 builds – but not previous versions.
