Code Analysis Published for Chrome Type Confusion 0-Day Vulnerability

According to Google’s Threat Analysis Group, a critical zero-day flaw in the TurboFan compiler of Chrome’s V8 JavaScript engine was discovered on 16 September 2025 and is tracked as CVE-2025-10585. The vulnerability allows attackers to trigger a type confusion condition, corrupt memory in the browser process, and execute arbitrary code, with exploits reportedly in the wild used by state-sponsored actors and commercial spyware operators to steal cryptocurrency and sensitive data.

The CVSS v3.1 score is 8.8, and affected products include Google Chrome versions before 140.0.7339.185 on Windows, Linux and macOS, as well as other Chromium-based browsers such as Edge and Brave. A simple visit to a malicious webpage can trigger the flaw, prompting an urgent need to update to Chrome 140.0.7339.185 or later, which patches the issue.

The article describes a type confusion in V8’s inline cache mechanism and notes that attackers craft a JavaScript Proxy object whose property traps return a floating-point array instead of a primitive number, enabling arbitrary read/write via memory pointer misdirection.