CVE-2025-10585: high-severity vulnerability in Google Chrome
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Prioritize patching. It under exploitation confirmed by CISA and has a public proof of concept.
Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
A flaw in Chrome's V8 engine allows attackers to confuse data types in memory, potentially causing heap corruption through a malicious webpage. This could lead to crashes or unauthorized code execution on your computer.
Type confusion vulnerability in V8 engine permits remote code execution via crafted HTML pages exploiting improper type checking in memory management. Successful exploitation requires user interaction (visiting malicious site) and results in heap corruption with potential arbitrary code execution in browser context.
The full analysis of this CVE is available in Portuguese →
In the same product, most dangerous first.