Google Patches Chrome Zero-Day CVE-2025-10585 as Active V8 Exploit Threatens Millions
Summary: Google released Chrome security updates on Wednesday for four vulnerabilities, including CVE-2025-10585, a type confusion flaw in the V8 JavaScript and WebAssembly engine that Google says has been exploited in the wild. Google's Threat Analysis Group is credited with discovering and reporting the flaw on September 16, 2025, and it is the sixth Chrome zero-day since the start of the year that has been actively exploited or demonstrated as a proof-of-concept, alongside CVE-2025-2783, CVE-2025-4664, CVE-2025-5419, CVE-2025-6554, and CVE-2025-6558.
Why it matters: Google disclosed no details on who is exploiting CVE-2025-10585 or at what scale, so the sixth Chrome zero-day of the year arrives with the attack picture still blank. The fix is in versions 140.0.7339.185/.186 for Windows and macOS and 140.0.7339.185 for Linux, and users of Edge, Brave, Opera, and Vivaldi are told to apply fixes only as and when they become available.