CVE

CVE-2025-14174

View on NVD ↗

Out of bounds memory access in ANGLE in Google Chrome on Mac prior to 143.0.7499.110 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)

Exploitation IoCs 3

Domain a[.]plerdy[.]com
Domain ad-track[.]live
Domain ad[.]starx-net[.]com

MITRE ATT&CK TTPs 5

T1059.004
Unix Shell
Execution
 T1071.001
Web Protocols
Command And Control
 T1189
Drive-by Compromise
Initial Access
 T1190
Exploit Public-Facing Application
Initial Access
 T1204.001
Malicious Link
Execution

Source Articles

APT29-Linked Hackers Hijack Web Analytics Script to Deliver iOS and Android Exploits
APT29, a Russia-linked threat actor, is conducting a large-scale watering hole campaign dubbed Poisoned Source, targeting iOS and Android users through compromised websites, fake domains, and a supply chain attack on the Ukrainian web analytics service Plerdy SEO Tracker. The attack delivers platform-specific exploit chains: DarkSword for iOS and AndroSnitch for Android, exploiting multiple N-day vulnerabilities to steal sensitive data including browser cookies, Wi-Fi passwords, iMessages, SMS, and device data. The campaign leverages malicious JavaScript injected into legitimate sites and lookalike domains, with exploitation triggered simply by visiting a page, requiring no user interaction.
hacker-news Nov 4, 2026