Google issues emergency Chrome patch for zero-day CVE-2025-10585

Google on Tuesday pushed an emergency security update for its Chrome web browser to patch a zero day vulnerability that the company says is being actively exploited, urging users to install the fix and restart their browsers immediately. The flaw, tracked as CVE-2025-10585, is a type confusion issue in Chrome's V8 JavaScript and WebAssembly engine that can allow attackers to corrupt memory, crash the browser or execute code, Google said.

In an advisory, Google said its Threat Analysis Group reported the vulnerability on September 16, 2025, and that the company is aware an exploit for CVE-2025-10585 exists in the wild. Google released the fix in Chrome versions 140.0.7339.185.186 for Windows and macOS and 140.0.7339.185 for Linux. The update is expected to download automatically for most users; Google said a browser restart is required to complete installation and that regular tabs will reopen but private incognito tabs will not.

The patch addresses four high severity flaws in total. Alongside CVE-2025-10585, Google fixed a use-after-free bug in the Dawn component reported by Giunash Gyujeong Jin, a use-after-free issue in WebRTC reported by researcher sherkito, and a heap buffer...