CVE-2025-10585

What it actually does

CVE-2025-10585 is a high-severity V8 JavaScript engine type-confusion vulnerability in Google Chrome before 140.0.7339.185. A malicious web page can cause V8 to treat an object as the wrong internal type, corrupting heap memory and potentially allowing attacker-controlled code execution inside the Chrome renderer process. In practical exploitation, this is most dangerous when paired with a sandbox escape or another local privilege-escalation flaw, because the initial code execution is typically constrained by Chrome’s renderer sandbox.

Why it matters to the business

Successful exploitation can let attackers compromise users through ordinary web browsing, phishing links, malicious advertisements, or compromised websites. The most likely organizational impacts are theft of browser-stored data and session tokens, unauthorized access to SaaS applications, malware deployment, and follow-on lateral movement from the affected endpoint. Because this vulnerability is listed in CISA KEV, has active in-the-wild exploitation, and had a remediation deadline of 2025-10-14, unpatched systems should be treated as high-priority exposure even though the EPSS score is moderate.

How an attack unfolds

An attacker hosts or injects crafted HTML and JavaScript content that exercises the vulnerable V8 behavior. When a user visits the page in an affected Chrome version, the script triggers type confusion in V8, leading to heap corruption. The exploit then attempts to shape memory so that corruption becomes reliable code execution in the browser renderer process. From there, the attacker may read accessible browser context, steal session material, deliver malware, or chain a second vulnerability to escape the sandbox and gain broader control of the endpoint. Active exploitation has been reported, so organizations should assume weaponized exploit content exists even if public proof-of-concept details are limited.

How to fix it

Upgrade Google Chrome to version 140.0.7339.185 or later immediately. Apply corresponding security updates for Chromium-based browsers and embedded Chromium runtimes where vendor patches are available. Enforce automatic browser updates through enterprise management, and restart browsers after patch deployment because Chrome updates are not fully effective until the browser process is relaunched. Where immediate patching is not possible, reduce exposure by restricting access to untrusted websites, disabling unnecessary browser extensions, using site isolation and exploit-protection controls, and increasing monitoring for browser child-process execution. KEV-listed systems should be remediated as an emergency item; the CISA due date of 2025-10-14 has passed.

How to confirm the fix worked

Confirm that all managed Chrome installations report version 140.0.7339.185 or later. Validate through endpoint inventory, browser management consoles, EDR software inventory, package-management records, and direct checks such as chrome://version or platform-specific browser version commands. Confirm that users have restarted Chrome after the update. Review Chromium-based browsers separately because version numbers and patch availability may differ by vendor. For exposure validation, identify endpoints that executed Chrome versions prior to 140.0.7339.185 after the publication date and prioritize those with internet browsing activity or suspicious browser crashes.

Typical attack path

1. Attacker prepares a malicious or compromised web page containing crafted HTML/JavaScript targeting V8.
2. Victim is lured to the page through phishing, malicious advertising, watering-hole compromise, redirects, or embedded third-party content.
3. The vulnerable Chrome version parses and executes the crafted script.
4. The script triggers V8 type confusion and heap corruption.
5. Exploit code attempts to obtain code execution in the Chrome renderer process.
6. Attacker steals browser-accessible data or chains an additional sandbox escape or privilege-escalation technique.
7. Attacker establishes persistence, deploys additional malware, or uses stolen sessions for follow-on access.

How to detect it

There are no reliable public exploit-specific indicators provided for this vulnerability, so detection should focus on behavioral evidence of browser exploitation. Review EDR telemetry for Chrome renderer processes spawning command shells, script interpreters, downloaders, archivers, or persistence tools. Examine browser and operating-system crash telemetry for repeated Chrome or V8-related crashes shortly before suspicious process activity. Review proxy, DNS, secure web gateway, and browser history telemetry for visits to unfamiliar, newly registered, blocked, or redirected domains from endpoints that were running Chrome before 140.0.7339.185. On Windows, inspect Windows Error Reporting, crash dumps, Prefetch, Amcache, ShimCache, and browser cache artifacts. On macOS and Linux, review crash reports, shell history, quarantine events, downloads, and browser profile artifacts. Correlate any suspicious browsing session with subsequent authentication anomalies, new OAuth sessions, unusual SaaS access, credential dumping alerts, malware detections, or persistence creation. Because active exploitation has been reported, absence of a known IOC should not be treated as evidence of no compromise.

• chrome.exe -> powershell.exe
• chrome.exe -> cmd.exe
• chrome.exe -> wscript.exe
• chrome.exe -> cscript.exe
• chrome.exe -> mshta.exe
• chrome.exe -> rundll32.exe
• chrome.exe -> regsvr32.exe
• chrome.exe -> certutil.exe
• chrome.exe -> bitsadmin.exe
• chrome.exe -> curl.exe
• chrome.exe -> wget.exe
• Google Chrome Helper -> /bin/sh
• Google Chrome Helper -> /bin/bash
• Google Chrome Helper -> osascript
• /Library/Logs/DiagnosticReports/Google Chrome Helper_
• /Library/Logs/DiagnosticReports/Google Chrome_
• ~/Library/Logs/DiagnosticReports/Google Chrome Helper_
• %LOCALAPPDATA%\Google\Chrome\User Data\Crashpad\reports\
• %LOCALAPPDATA%\CrashDumps\chrome.exe.
• %LOCALAPPDATA%\Google\Chrome\User Data\Default\Cache\
• %LOCALAPPDATA%\Google\Chrome\User Data\Default\Code Cache\js\
• /home/*/.config/google-chrome/Crash Reports/
• /home/*/.config/google-chrome/Default/Cache/
• /home/*/.config/google-chrome/Default/Code Cache/js/

What your security team should do

• Patch or upgrade Chrome to 140.0.7339.185 or later across all endpoints immediately; treat remaining vulnerable systems as KEV-overdue exceptions.
• Force browser restarts after update deployment and verify update compliance with endpoint inventory rather than relying only on patch job success.
• Hunt for recent Chrome renderer crashes, unusual browser-spawned child processes, suspicious downloads, and post-browser-exploitation activity on systems that were unpatched after publication.
• Prioritize investigation of endpoints that browsed unknown, newly registered, or previously unseen domains while running vulnerable Chrome versions.
• Apply equivalent updates to Chromium-based browsers and applications embedding Chromium or V8 where vendor fixes are available.
• Limit damage from browser compromise by enforcing least privilege, endpoint detection controls, credential theft protections, and conditional access for web applications.
• Review proxy, DNS, EDR, and identity logs for suspicious activity following browser sessions on vulnerable endpoints.