CVE-2025-10585KEV · OVERDUECWE-843

Google Chromium V8 Type Confusion Vulnerability

High · published September 24, 2025

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 8.8. It is confirmed in active exploitation. It sits in the 92.6th percentile for exploit probability.

375
days past CISA
deadline
CVSS v3.1
8.8
EPSS
5%
Percentile
92.6
In the wild
Confirmed
What it is

🚨 Type confusion in V8 is giving attackers the keys to your browser! An instance of this vulnerability exists in Google Chrome versions prior to 140.0.7339.185, allowing remote attackers to wreak havoc through crafted HTML pages. 🔥 Think of V8 like a library where the staff misplaces a few books — when a rogue patron sneaks in, they can check out whatever they want, even if they aren't on the list. This type confusion lets an attacker access and corrupt memory locations, leading to chaos. This vulnerability could lead to devastating effects: an attacker could exploit heap corruption to execute arbitrary code, potentially taking control of your browser and accessing sensitive data. Your online security could be compromised, leading to unauthorized access or even complete system takeover. We definitely don't want that!

Put simply

Think of V8 like a library where the staff misplaces a few books — when a rogue patron sneaks in, they can check out whatever they want, even if they aren't on the list. This type confusion lets an attacker access and corrupt memory locations, leading to chaos. The type confusion in V8 allows attackers to misinterpret memory types within the engine, ultimately leading to heap corruption via specially crafted HTML input.

What to do

This vulnerability could lead to devastating effects: an attacker could exploit heap corruption to execute arbitrary code, potentially taking control of your browser and accessing sensitive data. Your online security could be compromised, leading to unauthorized access or even complete system takeover. We definitely don't want that! Immediately update Google Chrome to version 140.0.7339.185 or later. If you're managing systems with automated browsers, ensure they are all patched to prevent exploitation. Staying updated is your best defense! You've got this! By following these steps, you're one step closer to securing your browsing experience! 🛡️

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.05391 · 92.6th percentile
Weakness
CWE-843 · Access of Resource Using Incompatible Type ('Type Confusion')
Published
2025-09-24T16:17Z
KEV added
2025-09-23 · due 2025-10-14
EPSS history
Timeline
  • 24 SEP 16:17Z
    Type confusion in V8 in Google Chrome prior to 140.0.7339.185 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page
    cvelistv5
  • 23 SEP 00:00Z
    Added to CISA KEV — remediate by Oct 14
    kev