Apple Patches Two Zero-Days Tied to Mysterious Exploited Chrome Flaw

Apple has released macOS and iOS updates to patch two WebKit zero-days that Apple says were exploited in an extremely sophisticated targeted attack. The flaws are CVE-2025-14174, described as a memory corruption issue, and CVE-2025-43529, a use-after-free bug, both exploitable through maliciously crafted web content to execute arbitrary code.

Apple patched these with updates including iOS and iPadOS 26.2, iOS and iPadOS 18.7.3, macOS Tahoe 26.2, Safari 26.2, and corresponding versions for tvOS, watchOS and visionOS. According to Google’s advisory, CVE-2025-14174 is a Chrome zero-day tied to an out-of-bounds memory access in the Angle graphics library, with the issue impacting both Chrome’s Blink engine and WebKit; Microsoft Edge and Vivaldi have also been updated.

The advisories indicate the vulnerabilities were discovered by Apple’s security team and Google’s Threat Analysis Group, and security researchers suggest the zero-days have likely been weaponised by commercial spyware vendors targeting multiple platforms. CISA has added CVE-2025-14174 to its Known Exploited Vulnerabilities catalog, underscoring the ongoing risk to users of Chromium-based products.