CVE-2025-14765 and CVE-2025-14766 are remote code execution vulnerabilities in Microsoft Edge that allow attackers to execute arbitrary code through crafted web content. Both flaws affect Edge versions prior to 143.0.3650.96 and can be triggered without user authentication.
CVE IDs
CVE-2025-14765
CVE-2025-14766
Affected Product
Microsoft Edge browser on Windows, macOS, and Linux platforms prior to version 143.0.3650.96.
CVSS Score
CVE-2025-14765: 8.3 (High)
CVE-2025-14766: 8.6 (High)
Technical Details of CVE-2025-14765 & CVE-2025-14766
The vulnerabilities originate from memory corruption issues within Edge’s Chromium rendering engine. Improper handling of object lifecycles and bounds validation enables attackers to craft malicious HTML and JavaScript that corrupt memory, leading to arbitrary code execution within the browser process.
Exploitation Methodology
Attackers exploit these vulnerabilities by luring victims to malicious websites or delivering weaponized ads. Successful exploitation allows execution of attacker-controlled code, often followed by sandbox escape chains or payload delivery via secondary exploits.
Threat Actors Exploiting CVE-2025-14765 and CVE-2025-14766
At the time of disclosure, Microsoft reported no confirmed active exploitation in the wild. However, similar Edge and Chromium RCE vulnerabilities have historically been leveraged by espionage-focused groups and commercial exploit vendors shortly after patch release, making rapid weaponization likely.
Impact
Exploitation enables full compromise of the browser session, leading to credential theft, malware delivery, lateral movement, and potential system compromise when chained with privilege escalation vulnerabilities.
Mitigation and Remediation
Microsoft urges immediate upgrading to Edge version 143.0.3650.96 or later. Enterprises should enforce automatic browser updates, disable unsupported extensions, and deploy endpoint detection capable of monitoring browser exploitation behavior.
MITRE ATT&CK Mapping
| Tactic | Technique ID | Technique Name |
|---|---|---|
| Initial Access | T1189 | Drive-by Compromise |
| Execution | T1059 | Command and Scripting Interpreter |
| Defense Evasion | T1218 | Signed Binary Proxy Execution |
| Credential Access | T1555 | Credentials from Web Browsers |
