Google Patches Chrome Zero-Day CVE-2025-10585 as Active V8 Exploit Threatens Millions

Google has released security updates for Chrome to address four vulnerabilities, including a zero-day CVE-2025-10585 that it says has been exploited in the wild and is a type confusion in the V8 engine. According to Google, an exploit for CVE-2025-10585 exists in the wild, and this marks the sixth Chrome zero-day either exploited or demonstrated as PoC since the start of the year.

The Chrome update affects Windows, macOS, and Linux, with versions 140.0.7339.185/.186 for Windows and Apple macOS, and 140.0.7339.185 for Linux advised for users to install. Google credited the Threat Analysis Group (TAG) with discovering and reporting the flaw on 16 September 2025. Users of other Chromium-based browsers are also urged to apply the fixes as they become available. The advisory emphasises updating promptly to mitigate potential threats and protect against arbitrary code execution or crashes.