8.8 High Exploited

CVE-2025-10585 Google Chromium V8 Type Confusion Vulnerability

Active exploitation observed

· CISA KEV catalogue

Required action Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Ransomware campaigns Not observed so far

Weakness CWE-843

Description

Type confusion in V8 in Google Chrome prior to 140.0.7339.185 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

Affected products and versions

Product	Affected versions	Fixed in
Chrome 140.0	earliest → < 140.0.7339.185	140.0.7339.185
CADRA	Versions not published

References

chromereleases.googleblog.com chromereleases.googleblog.com
issues.chromium.org issues.chromium.org

Timeline

Published September 24, 2025
Added to the KEV catalogue September 23, 2025
Last modified July 14, 2026

The 6072 CVEs of Chrome →

CVE-2026-120930 Incorrect authorization in Blink in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web… 5.4 Medium CVE-2026-120931 Out of bounds write in WebGL in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to… 9.6 Critical CVE-2026-121195 Incorrect authorization in TrustedTypes in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass… 8.8 High CVE-2026-121141 Improper input validation in Editing in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social… 5.4 Medium

Track this CVE