Google Patches Sixth Exploited Chrome Zero-Day of 2025

Google has just released a critical security update for Chrome following the discovery of a serious vulnerability that is already being exploited in real-world attacks. The flaw, identified as CVE-2025-10585, directly affects the V8 engine, the component responsible for executing JavaScript and WebAssembly—in other words, the core that powers much of the browser’s functionality.

At TecnetOne, we understand how important it is to act quickly in the face of these kinds of threats. That’s why, if you use Google Chrome or any Chromium-based browser (such as Microsoft Edge, Brave, or Opera), this is an update you can’t afford to ignore.

What is CVE-2025-10585?

It’s a zero-day vulnerability—meaning it’s a flaw that attackers discovered and began exploiting before a patch was available. In this case, it stems from a type confusion issue in the V8 engine, which could allow an attacker to:

1. Crash your browser, or worse…

2. Execute malicious code on your device without you knowing.

Google has marked this vulnerability as high severity and confirmed that it is already being actively exploited online.

The flaw was reported by Google’s Threat Analysis Group (TAG) on September 16, just one day before the security update was released. For now, the company has chosen not to disclose technical details to prevent widespread exploitation—at least until more users have updated their browsers.

Not the only one: Other vulnerabilities fixed in the same update

In addition to CVE-2025-10585, Google used the same stable channel update for Chrome (September 17) to fix three other vulnerabilities also classified as high severity:

1. CVE-2025-10500: A use-after-free bug in the Dawn component

2. CVE-2025-10501: Another use-after-free, this time in WebRTC, which is essential for browser-based video calls

3. CVE-2025-10502: A stack buffer overflow in ANGLE, affecting graphics performance

Although there’s no confirmation that these three vulnerabilities are being actively exploited, their severity level means they should also be taken seriously.

Read more: Microsoft and Cloudflare Shut Down RaccoonO365 Phishing Hub

Why Are These Types of Flaws So Dangerous?

Vulnerabilities in V8 are especially critical because they directly impact the browser’s code execution engine. In the wrong hands, a flaw like this can be used to:

1. Install malware without the user knowing

2. Steal passwords, cookies, or personal data

3. Hijack web sessions (such as your email or social media)

4. Take control of the system, especially if it’s not well protected

And since this is a zero-day vulnerability, attackers usually move fast before users update their systems.

What Should You Do Now? Update Chrome As Soon As Possible

If you want to stay protected against the latest threats, the first thing you should do is make sure your browser is up to date. Keeping Chrome (or any Chromium-based browser like Edge, Brave, or Opera) current is essential, as updates include critical security patches like this one.

The versions that already include the fix are:

1. 140.0.7339.185 / .186 for Windows and macOS

2. 140.0.7339.185 for Linux

Additional Security Tips

While updating your browser is the most urgent step, there are other best practices that will help keep you protected against threats like CVE-2025-10585:

1. Don’t click on suspicious links or open emails from unknown senders.

2. Keep your operating system and all other software up to date.

3. Use a reliable antivirus with real-time protection.

4. Review your browser extensions and remove any you don’t use or recognize.

5. Consider enabling Chrome’s Site Isolation feature for an extra layer of security.

And if you manage multiple devices or work in a business environment, implementing a patch management solution like TecnetProtect Backup can make a big difference.

This tool not only lets you automate and monitor the deployment of security updates across all devices (preventing critical vulnerabilities like CVE-2025-10585 from going unpatched), but it also includes advanced automated backup functionality.

Thanks to this, you can quickly restore key systems or files in case of an attack, human error, or data loss—adding another layer of protection to your digital environment.

In short, TecnetProtect Backup combines device management, patching, and backup in a single solution, helping you keep your infrastructure always up to date, secure, and resilient against threats.