Chrome 140 Update Patches Sixth Zero-Day of 2025

Chrome 140 has been released to patch the sixth zero-day vulnerability addressed in 2025, tracked as CVE-2025-10585, which Google Threat Analysis Group reported as exploited in attacks. According to Google Threat Analysis Group, the flaw is a type confusion in the V8 JavaScript and WebAssembly engine, with threat actors able to perform arbitrary read/write operations remotely using crafted HTML pages.

The update also fixes two use-after-free flaws in Dawn (CVE-2025-10500) and WebRTC (CVE-2025-10501), for which rewards of $15,000 and $10,000 were awarded, respectively, and a heap buffer overflow in the ANGLE graphics engine (CVE-2025-10502) discovered by the Big Sleep AI agent, for which no reward will be paid as it was found internally. Chrome’s latest iteration is rolling out as versions 140.0.7339.185/.186 for Windows and macOS, and 140.0.7339.185 for Linux. The advisory notes that Google has not released further details on the vulnerability or its exploitation.