U.S. CISA adds Google Chromium flaw to its Known Exploited Vulnerabilities catalog

U.S. Cybersecurity and Infrastructure Security Agency (CISA) added Google Chromium flaw CVE-2025-10585 to its Known Exploited Vulnerabilities (KEV) catalog. In mid-September Google released security updates addressing four Chrome vulnerabilities, including CVE-2025-10585, which has reportedly been exploited in the wild. Google’s Threat Analysis Group (TAG) discovered the vulnerability on September 16, 2025, and Google did not share technical details about the attacks exploiting this flaw.

According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog; CISA orders federal agencies to fix the vulnerabilities by October 2, 2025, with private organisations advised to review the Catalog and address the vulnerabilities in their infrastructure.

CVE-2025-10585 is described as a type confusion issue in the V8 JavaScript and WebAssembly engine, which can lead to memory corruption, crashes, or remote code execution.