CVE-2025-10585 is a type confusion vulnerability in the V8 JavaScript and WebAssembly engine of Google Chrome, actively exploited in 2025. The flaw allows attackers to misinterpret memory types, enabling memory corruption that can lead to arbitrary code execution or crashes. Discovered by Google's Threat Analysis Group on September 16, 2025, this zero-day is the sixth actively exploited Chrome zero-day patched by Google in 2025. Google has released security updates in Chrome version 140.0.7339.185/.186 for Windows, macOS, and Linux to fix this and other vulnerabilities. The vulnerability has been exploited by threat actors likely including nation-state or commercial spyware groups. No detailed technical exploit information has been publicly disclosed. Users are urged to update Chrome immediately to the patched versions to prevent exploitation.

The vulnerability enables attackers to perform unauthorized actions such as memory corruption that can lead to arbitrary code execution, unauthorized access, data breaches, and service disruptions. It has been actively exploited in the wild, increasing the urgency and risk. The flaw affects the core JavaScript engine used by Chrome, impacting all users running vulnerable versions prior to the patch. The active exploitation by sophisticated threat actors suggests a high likelihood of targeted attacks and potential widespread impact if unpatched.

Google has released official security updates in Chrome version 140.0.7339.185/.186 for Windows, macOS, and Linux that address CVE-2025-10585. Users and organizations should immediately update their Chrome browsers to these versions or later to mitigate the vulnerability. No additional vendor-recommended mitigations or workarounds are indicated. Since this is not a cloud service, remediation depends on user-side patching. Monitoring for suspicious browser activity may help detect exploitation attempts but patching is the primary defense.