CVE-2025-10585: Google Chrome V8 type confusion enables heap corruption

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityCVSS 9.8 with confirmed in-the-wild exploitation per CISA KEV and a near-term federal remediation deadline make this an urgent patch.

What it is

Chrome's V8 JavaScript engine contains a type confusion flaw (CWE-843) that can lead to heap corruption when processing a crafted HTML page. It affects Chrome before 140.0.7339.185 and is listed in CISA's Known Exploited Vulnerabilities catalog, so it warrants urgent remediation.

Impact

A remote attacker can corrupt heap memory in the renderer, which in practice can lead to code execution or a sandbox escape depending on the exploit chain. The CVSS 3.1 base score is 9.8 (critical), reflecting full confidentiality, integrity and availability impact.

Attack surface

Reached over the network with no authentication and no user interaction per the CVSS vector (AV:N/AC:L/PR:N/UI:N), typically by getting a victim to load a crafted HTML page in Chrome. Siemens also lists an affected product (CADRA), indicating the Chromium engine is embedded beyond the browser.

Exploitation

CVE-2025-10585 is in CISA KEV (added 2025-09-23, remediation due 2025-10-14), confirming exploitation in the wild. EPSS 30-day probability is 0.05391 (92.3rd percentile), and no ransomware campaign use is documented.

What to do

• Upgrade Google Chrome to 140.0.7339.185 or later, and apply the corresponding Siemens CADRA fix per Siemens advisory SSA-470355.
• Track the CISA KEV due date of 2025-10-14 and confirm all Chromium-based browsers and embedded Chromium components are updated.
• If immediate patching is not possible, apply vendor mitigations or discontinue use of the affected product as directed by CISA.
• Enforce browser auto-update and verify version compliance across endpoints, including third-party software that embeds Chromium.

Detection

• Monitor for Chrome processes spawning unexpected child processes or making anomalous network connections after rendering untrusted web content.
• Hunt for crashes or memory-corruption indicators in Chrome renderer processes correlated with visits to untrusted or newly registered domains.
• Audit endpoint inventories for Chrome versions below 140.0.7339.185 and for Siemens CADRA installations needing the vendor fix.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.