Flash Notice: Google Releases Patch for Actively Exploited Chrome Zero-Day

introduction

Google has urgently released a security update to address a critical zero-day vulnerability (CVE-2025-10585) in its Chrome web browser, marking the sixth such incident actively exploited in 2025. The flaw, rooted in Chrome’s V8 JavaScript engine, was already being leveraged in real-world attacks when Google’s Threat Analysis Group (TAG) discovered it. This report expands on the initial coverage by providing technical context, incident progression, and recommendations for users and organizations.

incident overview and timeline

• September 16, 2025: Google’s Threat Analysis Group identifies and reports a type confusion vulnerability (CVE-2025-10585) in Chrome’s V8 engine.
• September 17, 2025: Google releases version 140.0.7339.185/.186 for Windows and Mac and 140.0.7339.185 for Linux, containing the patch and mitigating the zero-day for all supported desktop platforms.
• The vulnerability was disclosed and patched one day after being reported, following confirmation of in-the-wild exploitation targeting Chrome users.

technical breakdown

The core issue, CVE-2025-10585, is a type confusion vulnerability in the V8 JavaScript engine. Type confusion bugs occur when the browser misidentifies the type of an object at runtime, potentially causing memory corruption. Attackers can exploit this flaw to manipulate internal memory structures, which may result in:

• Arbitrary code execution within the context of the browser
• Potential sandbox escape, especially if chained with other vulnerabilities
• Full system compromise in extreme scenarios

Access to detailed technical information remains restricted, minimizing risk of further abuse before widespread patch adoption.

systems and entities affected

The flaw impacts Chrome users on Windows, macOS, and Linux. There is no documented evidence of exploitation against mobile or Chromium-based browsers outside the listed desktop environments at this time.

Notably, Google TAG has previously observed these types of flaws leveraged in targeted espionage and surveillance campaigns, particularly those attributed to government-backed actors aiming at journalists, political activists, and dissidents.

mitigation, user guidance, and google's response

Google responded with immediate deployment of fixed versions. Users should upgrade Chrome to version 140.0.7339.185/.186 or later. For those who have not received the automatic update, navigating to Chrome’s menu > Help > About Google Chrome and triggering a restart will apply the patch.

Chrome’s automatic update mechanism is typically effective, but those requiring urgent mitigation should verify their browser version manually.

Google continues restricting full technical details and public exploit samples until the majority of users are protected and third-party dependencies are patched, following its coordinated vulnerability disclosure policies.

recurring threat: context and previous incidents

CVE-2025-10585 is the sixth zero-day vulnerability actively exploited against Chrome in 2025, highlighting the persistent targeting of Chrome users by threat actors:

• CVE-2025-6558 (July 2025): Allowed sandbox escape.
• CVE-2025-4664 (May 2025): Let attackers hijack browser accounts.
• CVE-2025-5419 (June 2025): Out-of-bounds read/write in V8 discovered by Google TAG.
• CVE-2025-2783 (March 2025): Sandbox escape used in espionage against Russian organizations.
• Ten zero-days were patched in 2024, some stemming from public exploits or demonstrated at hacking competitions.

This continued pattern emphasizes the attractiveness of browser exploitation as an avenue for both cybercrime and nation-state operations.

background information

The V8 JavaScript engine is central to Chrome’s performance and security, processing all client-side scripting on websites. Its complexity, efficiency, and integration with other browser components make it a high-value target for attackers. Type confusion vulnerabilities are historically responsible for many serious browser security incidents due to the challenge in preventing incorrect type assignments and associated memory errors.

Google’s Threat Analysis Group has played a lead role in both discovering these threats and attributing them to advanced persistent threat actors, often with links to surveillanceware distribution and government operations.

SUPPORTING DOCUMENTATION

• Google Fixes Sixth Actively Exploited Chrome Zero-Day of 2025
• Google patches sixth Chrome zero-day exploited in attacks this year
• Google Chrome 0-Day Vulnerability Actively Exploited in the Wild
• National Vulnerability Database – CVE-2025-6558
• National Vulnerability Database – CVE-2025-6554