Google Chrome 0-Day Under Active Attack – Update Immediately

Google has released an urgent security update for Chrome browser users worldwide, addressing four critical vulnerabilities, including one zero-day flaw that is currently being actively exploited in the wild. The most concerning vulnerability is CVE-2025-10585, a high-severity type confusion flaw in Chrome’s V8 JavaScript engine, discovered and reported by Google’s Threat Analysis Group on 16 September 2025, with attackers already exploiting it in real-world attacks, according to the article.

The other patched flaws include CVE-2025-10500 (high, use after free in Dawn), CVE-2025-10501 (high, use after free in WebRTC), and CVE-2025-10502 (high, heap buffer overflow in ANGLE). Chrome version 140.0.7339.185/.186 for Windows and Mac, and 140.0.7339.185 for Linux, is rolling out globally, with users advised to update by going to About Google Chrome to trigger an automatic check.

The rollout is gradual, and administrators are urged to prioritise updates across networks while considering additional protections until patches reach all systems.