CVE-2025-10585 is the sixth actively exploited Chrome zero-day patched by Google in 2025

CVE-2025-10585 is the sixth actively exploited Chrome zero-day vulnerability patched by Google in 2025, with Google addressing four Chrome vulnerabilities in its latest updates, including this one. The zero-day is a type confusion issue in the V8 JavaScript and WebAssembly engine, which can allow memory corruption or remote code execution under certain conditions.

Google’s Threat Analysis Group (TAG) discovered CVE-2025-10585 on 16 September 2025, and Google did not disclose technical details about the attacks exploiting the flaw. According to Google, an exploit for CVE-2025-10585 exists in the wild, and users should update Chrome to version 140.0.7339.185/186 on Windows and macOS, and 140.0.7339.185 on Linux to stay protected.

The article notes that CVE-2025-10585 joins a list of previously exploited Chrome flaws addressed this year, underscoring the ongoing risk of zero-days in widely used software.