Chrome V8 CVE-2025-10585: Exploited Type Confusion

What to do

1. Open chrome://settings/help or edge://settings/help, relaunch if an update is pending, and confirm a current version.
2. In managed fleets, flag any Chrome below 153.0.8010.36, which also covers the later exploited V8 bugs.
3. Remove policies that pin browsers or defer updates indefinitely, and set a relaunch deadline.
4. Check Opera, Brave, Vivaldi and Chromium-based desktop apps for releases built on a September 2025 or newer engine.
5. If you run Siemens CADRA, follow Siemens' advice to block access to untrusted or external web content from those systems, and ask other vendors that embed V8 for their fix status.

How to check if you are affected or compromised

• Query endpoint inventory for chrome.exe, msedge.exe or opera.exe builds older than the fixed versions in September 2025, and list the users of those machines.
• Google has published no indicators; for high-risk users who ran old builds, review EDR for browser processes spawning unexpected executables or new persistence around that time.

What happened#

On September 17, 2025, Google shipped Chrome 140.0.7339.185/.186 for Windows and Mac and 140.0.7339.185 for Linux. The update fixed four high-severity bugs. One of them, CVE-2025-10585, is a type confusion in V8, Chrome's JavaScript and WebAssembly engine. Google's Threat Analysis Group reported it on September 16, and Google said it was "aware that an exploit for CVE-2025-10585 exists in the wild." The fix shipped one day after the report.

The CVE record says a remote attacker could "potentially exploit heap corruption via a crafted HTML page." That usually means a victim only has to visit a malicious or compromised page. Little else is public. The bug report was still closed to the public when we checked on October 23, 2026. Google has not described the exploit, the attackers or the targets. Its review of 2025 zero-days, published in March 2026, does not discuss this CVE. CISA added it to the KEV catalog on September 23, 2025, with an October 14 deadline.

Who is affected#

Chrome before 140.0.7339.185. Chrome for Android 140.0.7339.155 carried the same fixes on September 17. ChromeOS 16371.49.0 (browser 140.0.7339.201) followed on September 18. Microsoft fixed Edge in 140.0.3485.81 on September 19. Opera fixed it in Opera One 122.0.5643.51 and Opera GX 122.0.5643.52.

V8 also ships inside other software. Siemens advisory SSA-470355, published July 14, 2026, lists all versions of its CADRA product as affected by this CVE and by CVE-2025-13223, another exploited V8 bug, through its Foxit component. Siemens said no fix was available. It recommends blocking access to untrusted or external web content from sensitive systems.

Do you really need to act?#

For browsers, almost certainly not. The fix is thirteen months old and was delivered by automatic updates. CISA's ADP scores the bug CVSS 3.1 8.8. NVD gives 9.8. Its SSVC notes mark exploitation active but not automatable. The people still exposed run browsers that do not update, or software that embeds an old V8 engine.

Being fixed for this bug alone is not enough. KEV lists later exploited V8 bugs, including CVE-2025-13223 (November 2025), CVE-2026-3910 (March 2026), CVE-2026-11645 (June 2026), and CVE-2026-85046 and CVE-2026-87491 (September 2026). The last was fixed in Chrome 153.0.8010.36 on September 8, 2026.

What to do now#

1. Open chrome://settings/help or edge://settings/help and relaunch if prompted.
2. In managed fleets, report browser versions and chase any Chrome below 153.0.8010.36.
3. Remove policies that pin versions or defer updates indefinitely, and enforce a relaunch deadline.
4. Check Opera, Brave, Vivaldi and Chromium-based desktop apps for current releases.
5. If you run CADRA, apply Siemens' mitigation. Ask other vendors that bundle V8 or Chromium whether they have shipped this fix.

How to tell if you were hit#

Google has published no indicators. Check inventory for any endpoint that ran a Chrome, Edge or Opera build older than the fixes during September 2025. For high-risk users on those machines, review EDR data for browser processes launching unexpected executables or creating new services, scheduled tasks or launch agents around that time.

Timeline#

• Sep 16, 2025 — Google's Threat Analysis Group reports the bug.
• Sep 17, 2025 — Chrome 140.0.7339.185 and Chrome for Android 140.0.7339.155 ship the fix.
• Sep 18, 2025 — ChromeOS and Opera ship fixes.
• Sep 19, 2025 — Microsoft ships Edge 140.0.3485.81.
• Sep 23, 2025 — CISA adds CVE-2025-10585 to KEV.
• Jul 14, 2026 — Siemens lists CADRA as affected, with no fix available.

Vulnerability records

• CVE-2025-10585 · KEV 2025-09-23 · Type confusion in V8 in Google Chrome prior to 140.0.7339.185 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. Google Chrome Releases — Stable Channel Update for Desktop (Sep 17, 2025) chromereleases.googleblog.com
2. Google Chrome Releases — Chrome for Android Update (Sep 17, 2025) chromereleases.googleblog.com
3. Google Chrome Releases — Stable Channel Update for ChromeOS (Sep 18, 2025) chromereleases.googleblog.com
4. CVE record — CVE-2025-10585 cve.org
5. NVD — CVE-2025-10585 nvd.nist.gov
6. CISA — Known Exploited Vulnerabilities: CVE-2025-10585 cisa.gov
7. Chromium issue 445380761 (access restricted) issues.chromium.org
8. Microsoft — Release notes for Microsoft Edge Security Updates learn.microsoft.com
9. Opera — Update your browser: Security fix for Chrome zero-day CVE-2025-10585 blogs.opera.com
10. Siemens ProductCERT — SSA-470355: Zlib and Foxit Vulnerabilities in CADRA cert-portal.siemens.com
11. Google Threat Intelligence Group — 2025 Zero-Day Review cloud.google.com
12. Google Chrome Releases — Stable Channel Update for Desktop (Sep 8, 2026) chromereleases.googleblog.com