CVE-2025-10585

Type confusion in V8 in Google Chrome prior to 140.0.7339.185 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

Affected

Google · Chrome

CVSS v3.1 NVD

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v3.1 CNA

8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS

5.39% chance of exploitation in the next 30 days, 93rd percentile

CISA KEV

added 2025-09-23

Published

2025-09-24

Updated

2026-07-14

Proof-of-concept exploits (1)

• AdityaBhatt3010/CVE-2025-10585-The-Chrome-V8-Zero-Day13★ · 2025-09-19

Security advisories

• https://chromereleases.googleblog.com/2025/09/stable-channel-update-for-desktop_17.html
• https://cert-portal.siemens.com/productcert/html/ssa-470355.html
• https://issues.chromium.org/issues/445380761

References

• CVE Record
• NVD entry

Related

• CVE-2025-32462
• CVE-2025-32463
• CVE-2025-49706
• CVE-2025-53770
• CVE-2025-54253
• CVE-2025-54794