CVE-2025-10585
Google Chromium V8 Type Confusion Vulnerability
Description
CVE-2025-10585 is a critical type confusion vulnerability in the V8 JavaScript engine of Google Chrome prior to version 140.0.7339.185. The vulnerability allows a remote attacker to potentially exploit heap corruption via a crafted HTML page, which could lead to arbitrary code execution in the context of the browser process. With a CVSS v3.1 base score of 9.8 and no authentication or user interaction required, this Chrome V8 vulnerability poses a severe risk to billions of browser users. CISA has added CVE-2025-10585 to the Known Exploited Vulnerabilities catalog with a remediation deadline of October 14, 2025, and while the EPSS score of 0.64% at the 70th percentile appears modest, the confirmed active exploitation and the massive Chrome user base make this a high-priority security issue.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| chrome | < 140.0.7339.185 | |
| siemens | cadra | - |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- https://chromereleases.googleblog.com/2025/09/stable-channel-update-for-desktop_17.html(Release Notes, Vendor Advisory)
- https://issues.chromium.org/issues/445380761(Issue Tracking, Permissions Required)
- https://cert-portal.siemens.com/productcert/html/ssa-470355.html(Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-10585(US Government Resource)
Weakness Type
CWE-843: Access of Resource Using Incompatible Type ('Type Confusion')
CVE-2025-10585 is classified under CWE-843 (Type Confusion), a weakness where the software accesses a resource using a type that is incompatible with the actual type of that resource. In Google Chrome's V8 JavaScript engine, a type confusion condition allows an attacker to supply crafted JavaScript that causes the engine to misinterpret the type of an object in memory, leading to heap corruption and potentially arbitrary code execution.
Learn more: CWE-843 — Access of Resource Using Incompatible Type ('Type Confusion')
Impact Analysis
CVE-2025-10585 carries a CVSS v3.1 base score of 9.8 (Critical severity), reflecting the maximum exploitability characteristics. The vulnerability is remotely exploitable over the network (AV:N) with low attack complexity (AC:L), requiring no authentication (PR:N) and no user interaction (UI:N) — meaning a user simply visiting a malicious or compromised web page could trigger the exploit. Confidentiality, integrity, and availability all face high impact because heap corruption in the V8 engine can be leveraged to achieve arbitrary code execution within the Chrome renderer process, potentially allowing an attacker to read sensitive browser data including cookies, passwords, and session tokens, modify web page content and user interactions, and crash the browser or underlying system. Although the EPSS score of 0.64% at the 70th percentile is relatively moderate, CISA's inclusion in the KEV catalog confirms that targeted exploitation is occurring. The enormous deployment of Chromium-based browsers including Google Chrome, Microsoft Edge, and Brave means even targeted exploitation can affect a massive number of users.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2025-10585 by adding it to the Known Exploited Vulnerabilities catalog, indicating that threat actors have weaponized this V8 type confusion vulnerability in real-world attacks. The EPSS score of 0.64% at the 70th percentile suggests exploitation is currently more targeted than widespread, which is consistent with the pattern of Chrome zero-day exploitation where sophisticated actors use these vulnerabilities in spear-phishing campaigns or watering hole attacks before mass exploitation tools emerge. The Chromium issue tracker entry is access-restricted, as is standard for security-sensitive Chrome bugs until sufficient time has passed for users to update. The ransomware association is currently classified as unknown. Google addressed this vulnerability in the stable channel update for desktop released on September 17, 2025.
Remediation
-
Update Google Chrome to version 140.0.7339.185 or later immediately. Chrome typically auto-updates, but administrators should verify that all managed browsers have received the update. Navigate to chrome://settings/help to check the current version and trigger an update.
-
Update all Chromium-based browsers including Microsoft Edge, Brave, Opera, and Vivaldi, which share the V8 JavaScript engine and may be affected by the same underlying vulnerability. Check each browser vendor's security advisories for their corresponding fixed versions.
-
Enforce browser update policies across the organization using group policy, MDM, or browser management tools. Configure Chrome Enterprise policies to force automatic updates and prevent users from running outdated versions.
-
Implement content security controls as a defense-in-depth measure. Web proxy solutions, DNS filtering, and browser isolation technologies can reduce the risk of users encountering malicious web pages that deliver the exploit payload.
-
Monitor endpoint detection and response (EDR) systems for indicators of browser exploitation, including unusual child processes spawned by the Chrome renderer, unexpected memory access patterns, or sandbox escape attempts following browser compromise.
Technical Details
CVE-2025-10585 is a type confusion vulnerability (CWE-843) in the V8 JavaScript engine used by Google Chrome and all Chromium-based browsers. The CVSS v3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H reflects maximum exploitability with full impact across all three CIA dimensions. The vulnerability arises when V8's just-in-time (JIT) compiler or interpreter misidentifies the type of a JavaScript object during execution. When the engine subsequently accesses the object using the incorrect type assumption, it reads or writes memory at offsets that are valid for the assumed type but not for the actual type, resulting in heap corruption. A skilled attacker can craft a JavaScript payload embedded in an HTML page that triggers this type confusion, carefully controlling the heap layout to convert the corruption into a reliable read/write primitive. This primitive can then be used to achieve arbitrary code execution within the Chrome renderer sandbox. Depending on the attacker's capabilities, additional sandbox escape exploits may be chained to achieve full system compromise. The vulnerability affects all Chrome versions prior to 140.0.7339.185 and was classified as high severity by the Chromium security team.
Frequently Asked Questions
Is CVE-2025-10585 being actively exploited?
Yes. CISA has confirmed active exploitation of this Google Chrome V8 type confusion vulnerability by adding it to the KEV catalog. While the EPSS score of 0.64% suggests currently targeted rather than mass exploitation, the confirmed KEV status means immediate patching is essential.
What products are affected by CVE-2025-10585?
Google Chrome prior to version 140.0.7339.185 is directly affected. All Chromium-based browsers including Microsoft Edge, Brave, Opera, and Vivaldi that use the V8 JavaScript engine may also be vulnerable and should be updated to their respective patched versions.
How do I fix CVE-2025-10585?
Update Google Chrome to version 140.0.7339.185 or later. Chrome auto-updates by default, but verify the update has been applied by checking chrome://settings/help. Also update all other Chromium-based browsers in your environment.
How severe is CVE-2025-10585?
CVE-2025-10585 is rated Critical with a CVSS v3.1 base score of 9.8. The type confusion in V8 can lead to heap corruption and arbitrary code execution. No authentication or user interaction is required — simply visiting a malicious web page can trigger the exploit.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.