Google Chrome Zero-Day Actively Exploited via ANGLE Graphics Component

Google has released a Stable Channel update for Chrome on 10 December 2025, with new versions for Windows, macOS, and Linux that fixes three security vulnerabilities, one of which has been confirmed as actively exploited in the wild. According to Google, the most serious issue is tracked as 466192044 and is rated high severity; Google has not yet assigned a public CVE identifier or shared full technical details, saying the vulnerability details are “under coordination”.

The flaw is linked to ANGLE, the Almost Native Graphics Layer Engine, with the issue appearing to affect ANGLE’s Metal renderer and potentially enabling memory corruption or arbitrary code execution. In this Chrome release Google addressed eight Chrome zero-day vulnerabilities in 2025 that were either actively exploited or demonstrated via proof-of-concept attacks.

Also fixed in the update were two medium-severity CVEs, CVE-2025-14372 and CVE-2025-14373, affecting the Password Manager and the Chrome Toolbar respectively. The post notes that other Chromium-based browsers could be at risk until patches are shipped, and it recommends updating to the specified versions across devices.