The Cybersecurity and Infrastructure Security Agency (CISA) has issued a critical alert concerning a zero-day vulnerability in Google Chrome that is currently being exploited. Identified as CVE-2025-10585, this flaw affects the V8 JavaScript and WebAssembly engine in Google Chromium, posing significant security risks globally.
This vulnerability is a type confusion flaw within Chrome’s V8 engine, which can lead to improper data handling, allowing attackers to manipulate memory and execute harmful code. Classified under CWE-843, CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on September 23, 2025, indicating active exploitation by threat actors.
Federal agencies are required to address this issue by October 14, 2025, either by applying necessary patches or discontinuing the use of affected Chrome versions. Users and organizations are urged to update their Chrome browsers immediately to avoid potential exploitation. Google has released patches, and while automatic updates should cover most users, it’s advisable to manually check for updates to ensure prompt security patch application.
Organizations using cloud services should adhere to CISA’s BOD 22-01 guidelines, and those unable to implement mitigations should consider halting the use of vulnerable Chrome versions until patches are applied. Although currently cataloged as actively exploited, it’s unclear if CVE-2025-10585 is involved in ransomware campaigns, a common tactic for initial system access.
The critical function of the V8 engine in processing JavaScript makes this vulnerability especially perilous, as it could allow malicious websites to compromise systems simply by visiting an infected page. System administrators should prioritize Chrome updates and monitor for suspicious activity indicating exploitation attempts.
