Google pushes emergency patch for Chrome 0-day – check your browser version now
Sixth such Chrome flaw this year spotted by the Chocolate Factory, already in play
Google pushed an emergency patch for a high-severity Chrome flaw, already under active exploitation. So it's time to make sure you're running the most recent version of the web browser.
The vuln, tracked as CVE-2025-10585, is a type confusion flaw in the V8 JavaScript and WebAssembly engine. This kind of vulnerability exists when the engine misinterprets a block of memory as one type of object when it's actually something else, and can lead to system crashes, arbitrary code execution, and when chained with other bugs, potentially a full system compromise via a malicious HTML page.
"Google is aware that an exploit for CVE-2025-10585 exists in the wild," the Chocolate Factory warned.
REG AD
While you're patching…
WatchGuard released an update to fix a critical remote code execution bug tracked as CVE-2025-9242 in its Firebox firewalls.
It's due to an out-of-bounds write flaw and "affects both the mobile user VPN with IKEv2 and the branch office VPN using IKEv2 when configured with a dynamic gateway peer," the vendor warned in a Wednesday advisory.
CVE-2025-9242 affects Fireware OS 11.10.2 up to and including 11.12.4_Update1, 12.0 up to and including 12.11.3 and 2025.1. It's fixed in versions 12.3.1_Update3 (B722811), 12.5.13, 12.11.4, and 2025.1.1.
Google Threat Analysis Group (TAG) discovered and reported the vulnerability, and, as usual with Google security holes, there's no additional information about who is abusing this vulnerability and what they are doing with the illicit access.
REG AD
However, considering the criminal crews that TAG tracks – these include nation-state spies and commercial spyware vendors – it's likely that this CVE was abused as a zero-day to steal sensitive information and snoop on high-value targets.
To protect against this vulnerability, plus three other high-severity Chrome issues disclosed and fixed on Wednesday, update your browser to versions 140.0.7339.185/.186 for Windows and Apple macOS, and 140.0.7339.185 for Linux.
Chrome browsers update automatically, but may not do it right away and will require an app restart when they do. To force an immediate update, type chrome://settings/help into your omnibox and, if you are not already on the latest version, your browser will download it and then tell you to relaunch.
This is the sixth Chrome bug exploited as a zero-day this year – all have since been patched.
The other five include CVE-2025-2783, a sandbox-breaking bug seemingly used by snoops to target certain folks in Russia, and CVE-2025-4664, which could be exploited by a remote attacker to bypass security policies in Chrome's Loader, allowing unauthorized code execution or sandbox escape.
There was also CVE-2025-5419, an out-of-bounds read and write vulnerability in the V8 JavaScript engine that could allow a remote attacker to corrupt memory and potentially hijack execution. Attackers could use the exploit to expose sensitive data and/or execute arbitrary code and crash the user's machine.
Another V8 vulnerability, CVE-2025-6554, also allowed a remote attacker to perform an arbitrary read/write via a specially crafted HTML page.
And finally, CVE-2025-6558, due to insufficient validation of untrusted input in ANGLE and GPU, could allow a remote attacker to escape the sandbox using an HTML page. ®