CVE-2025-10585

CRITICAL
2025-09-24 [email protected]
9.8
CVSS 3.1
Share

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

4
Patch Released
Apr 04, 2026 - 20:30 nvd
Patch available
Analysis Generated
Mar 28, 2026 - 19:14 vuln.today
Added to CISA KEV
Oct 30, 2025 - 15:55 cisa
CISA KEV
CVE Published
Sep 24, 2025 - 17:15 nvd
CRITICAL 9.8

Tags

Memory Corruption Google Information Disclosure Chrome Suse

Description

Type confusion in V8 in Google Chrome prior to 140.0.7339.185 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

Analysis

Google Chrome V8 JavaScript engine contains a type confusion vulnerability enabling heap corruption through crafted HTML pages, exploited in the wild in June 2025.

Technical Context

The CWE-843 type confusion in V8 causes the engine to misinterpret JavaScript object types, leading to heap corruption that can be leveraged for arbitrary read/write and code execution.

Affected Products

['Google Chrome prior to 140.0.7339.185']

Remediation

Update Chrome immediately. Enable Chrome auto-updates via enterprise policy.

Priority Score

100
Low Medium High Critical
KEV: +50
EPSS: +0.7
CVSS: +49
POC: 0

Vendor Status

Share

CVE-2025-10585 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy