Google Races to Patch Chrome’s Sixth Zero-Day CVE-2025-10585

Google Chrome Zero-Day CVE-2025-10585: Critical V8 Type Confusion Vulnerability

Summary

Google has released critical security updates addressing its sixth zero-day vulnerability of 2025, tracked as CVE-2025-10585. This type confusion flaw affects the V8 JavaScript and WebAssembly engine in Google Chrome and all Chromium-based browsers. Actively exploited in the wild, this vulnerability could allow attackers to crash systems or execute arbitrary code on Windows, macOS, and Linux. Immediate patching is strongly advised to mitigate risk.

Vulnerability Details

CVE-2025-10585 is a type confusion vulnerability in Chrome’s V8 JavaScript engine. Successful exploitation allows attackers to cause unexpected software behavior, memory corruption, system crashes, and remote code execution.

This is Chrome’s sixth actively exploited zero-day in 2025, following CVE-2025-2783, CVE-2025-4664, CVE-2025-5419, CVE-2025-6554, and CVE-2025-6558. The fix is included in Chrome version 140.0.7339.185/.186 for Windows and macOS, and 140.0.7339.185 for Linux. The same patch also resolves three additional high-severity vulnerabilities, including use-after-free flaws in Dawn and WebRTC and a heap buffer overflow in ANGLE.

Recommendations

• Immediate Update: Upgrade to Chrome version 140.0.7339.185/.186 (Windows/macOS) or 140.0.7339.185 (Linux) through Settings > About Google Chrome. Relaunch Chrome to activate the patch.
• Enable Site Isolation: Turn on Strict Site Isolation (chrome://flags/#enable-site-per-process) to reduce memory sharing between sites, mitigating the impact of memory corruption attacks.
• Enforce Automatic Updates: Use Group Policy (Windows) or configuration profiles (macOS/Linux) to enforce enterprise-wide Chrome updates. Monitor browser versions with endpoint management tools.
• Strengthen Vulnerability Management: Maintain a software inventory, regularly review vendor patch advisories, and patch third-party applications promptly to minimize exposure windows.

MITRE ATT&CK TTPs

• TA0001 – Initial Access: T1189 (Drive-by Compromise)
• TA0002 – Execution: T1203 (Exploitation for Client Execution), T1204 (User Execution), T1059 (Command and Scripting Interpreter)
• TA0003 – Persistence: Maintain foothold through browser exploitation
• TA0004 – Privilege Escalation: T1068 (Exploitation for Privilege Escalation)
• TA0008 – Lateral Movement: T1210 (Exploitation of Remote Services)
• TA0042 – Resource Development: T1588 (Obtain Capabilities), T1588.006 (Vulnerabilities)

References

• Chrome Releases – Stable Channel Update for Desktop
• Hive Pro – Chrome Zero-Day Exploited in Operation ForumTroll
• Hive Pro – Google Rushes to Fix Chrome Zero-Day Vulnerability

• MITRE ATT&CK – Relevant Techniques