CISA Issues Alert on Actively Exploited Google Chrome 0-Day Vulnerability

According to CISA, the Cybersecurity and Infrastructure Security Agency, an urgent security alert has been issued regarding an actively exploited zero-day vulnerability in Google Chrome, designated CVE-2025-10585. The flaw is in Chrome’s V8 JavaScript and WebAssembly engine and is described as a type confusion weakness, classified under CWE-843.

CISA has added CVE-2025-10585 to its Known Exploited Vulnerabilities catalog as of 23 September 2025, indicating that threat actors are actively using it in real‑world attacks. The agency has set a mandatory deadline of 14 October 2025 for federal agencies to apply patches or discontinue using affected Chrome installations under binding operational directive BOD 22-01.

Google has released patches addressing this vulnerability, and automatic updates should reach most installations, though users are advised to manually check for updates in Chrome’s settings to ensure timely protection. Administrators should prioritise Chrome updates across environments and monitor for any browser‑related activity indicative of exploitation attempts targeting this flaw.