Chrome Emergency Update: Zero-Day (CVE-2025-10585) in V8 Exploited in the Wild

Google has released a Stable Channel update to version 140.0.7339.185/.186 for Windows and Mac, and 140.0.7339.185 for Linux, addressing four high-severity flaws, with CVE-2025-10585 in V8 highlighted as the zero-day already exploited in the wild. The bulletin identifies CVE-2025-10585 as a type confusion bug in Chrome’s V8 engine, and it notes that attackers can achieve arbitrary code execution by luring users to malicious pages, according to Google Threat Analysis Group (TAG).

The article also covers CVE-2025-10500 in Dawn, CVE-2025-10501 in WebRTC, and CVE-2025-10502 in ANGLE, describing their use-after-free or heap‑buffer vulnerabilities and potential impacts. Google confirmed that an exploit for CVE-2025-10585 exists in the wild, underscoring the urgency of applying the patch, and the piece lists the publication date as 18 September 2025. The report also mentions rewards for the researchers and provides brief context on the other CVEs and their potential consequences.