Google Chrome 0-Day Vulnerability Actively Exploited in the Wild – Patch Now

Google has released an emergency security update for its Chrome web browser to address a high-severity zero-day vulnerability that is being actively exploited in the wild.

Users are strongly urged to update their browsers immediately to protect against potential attacks. The vulnerability, tracked as CVE-2025-10585, is the latest in a series of zero-days discovered and patched in Chrome this year.

The new stable channel version has been updated to 140.0.7339.185/.186 for Windows and Mac, and 140.0.7339.185 for Linux.

Google has stated that the update will be rolling out to all users over the coming days and weeks. To mitigate the immediate threat, users should manually trigger the update process to ensure they are protected.

Zero-Day Vulnerability Exploited

The actively exploited vulnerability, CVE-2025-10585, is a Type Confusion flaw in the V8 JavaScript and WebAssembly engine.

Type confusion bugs occur when a program allocates a resource or object using one type but later accesses it with a different, incompatible type. This can lead to logical errors, memory corruption, and ultimately, arbitrary code execution.

A successful exploit could allow a remote attacker to escape the browser’s security sandbox by tricking a user into visiting a specially crafted, malicious webpage.

The vulnerability was reported on September 16, 2025, by Google’s own Threat Analysis Group (TAG), which typically finds zero-days being used in targeted attacks by sophisticated threat actors.

Other Vulnerabilities

In addition to the zero-day, this security update addresses three other high-severity vulnerabilities discovered by external security researchers.

The first, CVE-2025-10500, is a use-after-free vulnerability in Dawn, a graphics abstraction layer. The second, CVE-2025-10501, is also a use-after-free flaw, found in the WebRTC component, which enables real-time communication.

The third vulnerability, CVE-2025-10502, is a heap buffer overflow in ANGLE, a graphics engine translation layer. Use-after-free and heap overflow vulnerabilities can also lead to memory corruption and arbitrary code execution.

Google has awarded bug bounty payments of $15,000 and $10,000 for the discovery of two of these flaws.

Given the confirmation of active exploitation, the risk to unpatched systems is significant. All Google Chrome users on Windows, macOS, and Linux are advised to update their browsers to the latest version without delay.

To check your Chrome version and apply the update, navigate to the “Help” menu and select “About Google Chrome.” The browser will automatically check for and download the latest update, after which a restart will be required to apply the patch.

Google is currently restricting access to the bug details and links related to CVE-2025-10585 to prevent further abuse while the patch is being rolled out to the majority of its user base.

In 2025, Google patched several actively exploited zero-day vulnerabilities in its Chrome web browser, requiring users to update their software promptly to stay protected.

Chrome zero-day vulnerabilities that have been publicly disclosed and patched in 2025:

CVE ID	Vulnerability Type	Description	Exploited in the Wild
CVE-2025-10585	Type Confusion	A type confusion flaw in the V8 JavaScript engine that could be exploited via a malicious webpage.	Yes
CVE-2025-6558	Improper Input Validation	Insufficient validation of untrusted input in the ANGLE and GPU components, allowing a remote attacker to perform a sandbox escape.	Yes
CVE-2025-6554	Type Confusion	A type confusion vulnerability in the V8 JavaScript and WebAssembly engine, which could allow an attacker to perform arbitrary read/write operations.	Yes
CVE-2025-5419	Out-of-Bounds Access	An out-of-bounds read and write vulnerability in the V8 engine that could allow memory corruption by visiting a crafted webpage.	Yes
CVE-2025-2783	Sandbox Bypass	A critical vulnerability that allows for bypassing Chrome’s sandbox protection.	Yes
CVE-2025-4664	Insufficient policy enforcement	This vulnerability was addressed by Google as a zero-day, but it is unclear if it was actively exploited in malicious attacks.	Yes

Find this Story Interesting! Follow us on Google News, LinkedIn, and X to Get More Instant Updates.

The post Google Chrome 0-Day Vulnerability Actively Exploited in the Wild – Patch Now appeared first on Cyber Security News.