CVE-2025-10585
Google Chromium V8 Type Confusion Vulnerability - [Actively Exploited]
Description
Type confusion in V8 in Google Chrome prior to 140.0.7339.185 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
INFO
Published Date :
Sept. 24, 2025, 5:15 p.m.
Last Modified :
Sept. 30, 2025, 1:46 p.m.
Remotely Exploit :
Yes !
Source :
[email protected]
CISA KEV (Known Exploited Vulnerabilities)
For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild.
Google Chromium contains a type confusion vulnerability in the V8 JavaScript and WebAssembly engine.
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
https://chromereleases.googleblog.com/2025/09/stable-channel-update-for-desktop_17.html ; https://nvd.nist.gov/vuln/detail/CVE-2025-10585
Affected Products
The following products are affected by CVE-2025-10585
vulnerability.
Even if cvefeed.io is aware of the exact versions of the
products
that
are
affected, the information is not represented in the table below.
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | HIGH | [email protected] | ||||
| CVSS 3.1 | CRITICAL | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | ||||
| CVSS 3.1 | CRITICAL | [email protected] |
Solution
- Update Google Chrome to version 140.0.7339.185 or later.
- Avoid visiting untrusted websites.
Public PoC/Exploit Available at Github
CVE-2025-10585 has a 4 public
PoC/Exploit available at Github.
Go to the Public Exploits tab to see the list.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2025-10585.
| URL | Resource |
|---|---|
| https://chromereleases.googleblog.com/2025/09/stable-channel-update-for-desktop_17.html | Release Notes Vendor Advisory |
| https://issues.chromium.org/issues/445380761 | Issue Tracking Permissions Required |
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2025-10585 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2025-10585
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
⚠️ Patch CVE-2025-10585 now to fix a critical type-confusion vulnerability in Chrome’s V8 engine, preventing active exploitation in the wild.
brave browser chrome cve cybersecurity edge exploit opera vivaldi
None
Python project to scape data from Google News search to a markdown table
pandas python selenium matplotlib
Python
📡 PoC auto collect from GitHub. ⚠️ Be careful Malware.
security cve exploit poc vulnerability
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2025-10585 vulnerability anywhere in the article.
-
Help Net Security
October 2025 Patch Tuesday forecast: The end of a decade with Microsoft
A lot of classic software is reaching end-of-life (EOL) this month. Windows 10, Office 2016 and Exchange Server 2016 have survived after nearly a decade of service. Not far behind, after six years in ... Read more
-
The Hacker News
Urgent: China-Linked Hackers Exploit New VMware Zero-Day Since October 2024
Sep 30, 2025Ravie LakshmananZero-Day / Vulnerability A newly patched security flaw impacting Broadcom VMware Tools and VMware Aria Operations has been exploited in the wild as a zero-day since mid-O ... Read more
-
The Hacker News
CISA Sounds Alarm on Critical Sudo Flaw Actively Exploited in Linux and Unix Systems
Sep 30, 2025Ravie LakshmananVulnerability / Linux The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added a critical security flaw impacting the Sudo command-line utility fo ... Read more
-
Daily CyberSecurity
Microsoft May Finally Let Windows Search Results Open in Your Default Browser
At present, in Windows 11, online search results from the search panel are forcibly opened in Microsoft Edge, regardless of whether users have set Google Chrome or Mozilla Firefox as their default bro ... Read more
-
Daily CyberSecurity
TamperedChef Malware Rises: Deceptive Apps Use Signed Binaries and SEO Poisoning to Hijack Browsers
Field Effect’s Threat Intelligence team has uncovered a new wave of the TamperedChef malware campaign, leveraging digitally signed binaries, deceptive packaging, and browser hijackers to deliver malwa ... Read more
-
Daily CyberSecurity
Akira Ransomware Exploits SonicWall VPN Accounts With Lightning-Fast Intrusions
Akira ransomware Leaksite Arctic Wolf has observed a major uptick in Akira ransomware activity since late July 2025, with attackers aggressively targeting SonicWall SSL VPN accounts. The campaign rema ... Read more
-
Daily CyberSecurity
RedNovember: Chinese APT Expands Global Espionage to U.S. Defense, Aerospace, and Tech Firms
A new report from Recorded Future’s Insikt Group reveals that the Chinese state-sponsored threat group RedNovember has significantly broadened its operations, striking across government, defense, aero ... Read more
-
Daily CyberSecurity
Morte Botnet Unveiled: A Rapidly Growing Loader-as-a-Service Campaign Exploiting Routers and Enterprise Apps
Researchers at CloudSEK Threat Intelligence (TRIAD) have exposed a sophisticated botnet operation that systematically compromises SOHO routers, IoT devices, and enterprise applications through web-bas ... Read more
-
Daily CyberSecurity
DLL Hijacking Flaw (CVE-2025-56383) Found in Notepad++, Allowing Arbitrary Code Execution, PoC Available
A newly disclosed vulnerability in Notepad++ v8.8.3 has been assigned CVE-2025-56383. The flaw, rated CVSS 6.5, allows attackers to hijack Notepad++’s DLL loading process, potentially enabling the exe ... Read more
-
CybersecurityNews
Cybersecurity Newsletter Weekly – Chrome 0-Day, 22.2 Tbps DDOS Attack, Kali Linux Release, Cisco IOS 0-Day and More
This week in cybersecurity was marked by a relentless pace of critical disclosures and unprecedented attack volumes, underscoring the escalating challenges facing defenders. At the forefront was Googl ... Read more
-
Daily CyberSecurity
CVE-2025-59934: Critical Flaw in Formbricks Allows Unauthorized Password Resets via Forged JWT Tokens
The Formbricks project, an open-source platform for building in-app and website surveys, has released an urgent patch addressing a critical authentication vulnerability. Tracked as CVE-2025-59934 with ... Read more
-
Daily CyberSecurity
ChatGPT Pulse Arrives: The Proactive AI Assistant That Reshapes Your Morning Routine
OpenAI has introduced a new feature within ChatGPT called “ChatGPT Pulse”, a service designed to deliver personalized daily summaries, allowing users to quickly grasp essential information at the very ... Read more
-
The Hacker News
Fortra GoAnywhere CVSS 10 Flaw Exploited as 0-Day a Week Before Public Disclosure
Sep 26, 2025Ravie LakshmananVulnerability / Threat Intelligence Cybersecurity company watchTowr Labs has disclosed that it has "credible evidence" of active exploitation of the recently disclosed se ... Read more
-
Daily CyberSecurity
Rack Security Update: High-Severity Flaw Bypasses Parameter Limit, Exposing Apps to DoS Attacks
The Rack project, a key Ruby library providing a minimal and modular interface for web application development, has released a security update addressing a flaw in its query parameter parsing logic. T ... Read more
-
The Hacker News
Cisco ASA Firewall Zero-Day Exploits Deploy RayInitiator and LINE VIPER Malware
The U.K. National Cyber Security Centre (NCSC) has revealed that threat actors have exploited the recently disclosed security flaws impacting Cisco firewalls as part of zero-day attacks to deliver pre ... Read more
-
Daily CyberSecurity
CRITICAL Cisco Zero-Day (CVE-2025-20333, CVSS 9.9) Under Active Attack: VPN Flaw Allows Root RCE
Cisco has disclosed a zero-day vulnerability affecting its Secure Firewall Adaptive Security Appliance (ASA) Software and Secure Firewall Threat Defense (FTD) Software. Tracked as CVE-2025-20333 with ... Read more
-
Daily CyberSecurity
Cisco Warns of Critical RCE Flaw (CVE-2025-20363) Affecting Firewall and Router Software
Cisco has disclosed a critical vulnerability affecting multiple product lines, including Secure Firewall ASA, Secure Firewall Threat Defense (FTD), IOS, IOS XE, and IOS XR Software. Tracked as CVE-202 ... Read more
-
Daily CyberSecurity
Supply Chain Attack: Malicious Rust Crates Steal Solana and Ethereum Private Keys
Image: Socket’s Threat Research Team Socket’s Threat Research Team has uncovered a supply chain attack involving two malicious Rust crates—faster_log and async_println—that impersonated the legitimate ... Read more
-
Daily CyberSecurity
NVIDIA Patches High-Severity Code Injection Flaws in Megatron-LM AI Framework
Nvidia has issued an important security update addressing multiple high-severity vulnerabilities in its open-source Megatron-LM project, a large language model (LLM) framework widely used in AI resear ... Read more
-
Daily CyberSecurity
LNK Stomping: Attackers Bypass Windows Security by Stripping the ‘Mark of the Web’
Executing the lnk file using the LNK Stomping attack technique Windows shortcut files (.LNK) were designed to simplify user navigation, but for years, they’ve been a favorite tool in the attacker’s ar ... Read more
The following table lists the changes that have been made to the
CVE-2025-10585 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
Modified Analysis by [email protected]
Sep. 30, 2025
Action Type Old Value New Value Added CVSS V3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Removed CVSS V3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Sep. 29, 2025
Action Type Old Value New Value Added CVSS V3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Added CWE CWE-843 -
CVE CISA KEV Update by 9119a7d8-5eab-497f-8521-727c672e3725
Sep. 25, 2025
Action Type Old Value New Value Added Date Added 2025-09-23 Added Due Date 2025-10-14 Added Required Action Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Added Vulnerability Name Google Chromium V8 Type Confusion Vulnerability -
Initial Analysis by [email protected]
Sep. 24, 2025
Action Type Old Value New Value Added CVSS V3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Added CPE Configuration AND OR *cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* versions up to (excluding) 140.0.7339.185 OR cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:* cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:* Added Reference Type Chrome: https://chromereleases.googleblog.com/2025/09/stable-channel-update-for-desktop_17.html Types: Release Notes, Vendor Advisory Added Reference Type Chrome: https://issues.chromium.org/issues/445380761 Types: Issue Tracking, Permissions Required -
New CVE Received by [email protected]
Sep. 24, 2025
Action Type Old Value New Value Added Description Type confusion in V8 in Google Chrome prior to 140.0.7339.185 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Added CWE CWE-843 Added Reference https://chromereleases.googleblog.com/2025/09/stable-channel-update-for-desktop_17.html Added Reference https://issues.chromium.org/issues/445380761