CISA adds Chrome zero-day CVE-2025-10585 to KEV after public exploit appears

CISA this week added CVE-2025-10585, a high-severity type-confusion flaw in Google’s V8 JavaScript engine, to its Known Exploited Vulnerabilities catalog after evidence of active exploitation was observed. Google disclosed the issue in an emergency advisory and shipped an out-of-cycle Stable update (Chrome 140.0.7339.185/.186 for desktop) to mitigate the flaw.

As Google warned, “Google is aware that an exploit for CVE-2025-10585 exists in the wild.” CVE-2025-10585 concerns a type-confusion vulnerability that can allow memory reads or writes to be manipulated, with exploitation typically enabling arbitrary code execution in the renderer process in the browser context. All desktop Chrome users on Windows, Mac and Linux on older versions are exposed until patches are applied, and the emergency update will roll out to Stable over the coming days. FCEB agencies were given a remediation deadline of 14 October 2025. according to Google