U.S. CISA adds Google Chromium and Sierra Wireless AirLink ALEOS flaws to its Known Exploited Vulnerabilities catalog

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added Google Chromium Out-of-Bounds Memory Access Vulnerability (CVE-2025-14174) and Sierra Wireless AirLink ALEOS Unrestricted Upload of File with Dangerous Type Vulnerability (CVE-2018-4063) to its Known Exploited Vulnerabilities catalog. The Chromium flaw is described as an out-of-bounds memory access issue in ANGLE’s Metal renderer on Chrome for Mac, which has been exploited in the wild, and Google released security updates to address it.

The Sierra Wireless AirLink ALEOS flaw affects the upload.cgi component and could allow an authenticated attacker to upload and execute malicious code on the device’s web server. According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies must address these defects by the due date to protect networks against exploitation, with CISA ordering federal agencies to fix them by 2 January 2026. Private organisations are advised to review the KEV catalog and remediate the vulnerabilities across their infrastructure.