An ordinary webpage, an invisible flaw
A user clicks on a harmless-looking link. The site appears legitimate, but hidden inside is malicious code targeting the browser’s core. Chrome’s JavaScript and WebAssembly engine, known as V8, mishandles memory during execution. Within milliseconds, the attacker gains arbitrary read and write access. No alert, no pop-up — just silent remote control.
This is the scenario behind CVE-2025-10585, a zero-day already exploited in the wild, patched urgently by Google in the Chrome 140 update. It is the sixth Chrome zero-day discovered in 2025, a rhythm that shows browsers are increasingly under siege.
What we know about the flaw
Reported on September 16 by Google’s Threat Analysis Group (TAG), CVE-2025-10585 is a type confusion vulnerability in the V8 engine. Such errors break memory safety, leading to crashes, memory corruption, or remote code execution (RCE).
Attackers can trigger the bug simply by luring a user to open a specially crafted HTML page. That’s enough to manipulate the renderer’s memory space and prepare a chain leading to code execution outside the browser sandbox.
A patch that closes several doors
Google has not yet released an official CVSS score, but there is little doubt it will be severe — likely in the criticalrange (>9). The company confirmed only: “Google is aware that an exploit for CVE-2025-10585 exists in the wild.”
The same update also fixed other vulnerabilities that could have been used in exploit chains: two use-after-free flaws in Dawn and WebRTC, and a heap buffer overflow in ANGLE, Chrome’s graphics engine. These components are frequent targets, as they provide potential sandbox escape paths once an initial renderer exploit has succeeded.
Why this zero-day is alarming
Six zero-days in nine months is a stark reminder that Chrome is one of the most targeted applications worldwide. V8’s complexity — optimized for speed through Just-In-Time (JIT) compilation and WebAssembly — makes it fertile ground for attackers and researchers alike.
The fact that this flaw was uncovered by Google TAG strongly suggests it was exploited in sophisticated campaigns, possibly by commercial spyware vendors or state-backed actors. High-value targets such as executives, journalists, and diplomats are particularly at risk.
What organizations must do now
The first priority is simple: patch immediately. Deploy Chrome 140 (versions 140.0.7339.185/.186) across Windows, macOS, and Linux within 72 hours at most. Remember: the patch only takes effect once the browser has been restarted.
Organizations should also shrink their exposure window by:
- prioritizing patch deployment for executives and critical teams within 24 hours, then expanding to all users;
- enforcing stricter browser policies, such as site isolation, extension whitelisting, and blocking unapproved executable downloads;
- enabling memory protection rules in EDR/antivirus solutions, which can intercept behaviors typical of exploitation.
For SOC teams, vigilance is crucial. Watch for weak signals like repeated crashes of renderer or gpu-process, child processes (cmd, mshta, PowerShell) spawned from Chrome, or unusual outbound connections right after browsing sessions.
Treat the browser as a critical asset
CVE-2025-10585 highlights a simple reality: the browser is no longer a commodity tool. It is a critical asset that must be managed with the same rigor as servers, VPNs, or identity systems.
