Google patches Chrome zero‑day CVE‑2025‑10585 — active V8 exploit; update now

Summary (TL;DR)

Google shipped emergency Chrome updates to fix CVE‑2025‑10585, a type‑confusion bug in the V8 JavaScript/WebAssembly engine. The Stable channel now reads 140.0.7339.185/.186 for Windows/Mac and 140.0.7339.185 for Linux; Google states an exploit exists in the wild.

Affected products / versions

Actionable guidance for Windows / AD administrators

1. Patch & relaunch: Users → ⋮ → Help → About Google Chrome to fetch the update and relaunch.
2. Enterprise rollout: Push the latest MSI via SCCM/Intune; ensure auto‑update policies (AutoUpdateCheckPeriodMinutes, UpdatePolicy) are enabled.
3. Hygiene: Enable Chrome Site Isolation; remove local admin from users; segment high‑value networks.
4. Monitoring: Hunt for unusual child processes from chrome.exe (rundll32, powershell.exe, cmd.exe) and suspicious outbound traffic following page visits.

Verification: quick PowerShell inventory

Run from an admin workstation with PSRemoting permissions. Provide a computers.txt list of hostnames.

# Get Chrome version from remote Windows machines via registry
$computers = Get-Content -Path .\computers.txt   # list of hostnames
$results = foreach ($c in $computers) {
    try {
        $chrome = Invoke-Command -ComputerName $c -ScriptBlock {
            $paths = @(
                'HKLM:\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall',
                'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall'
            )
            foreach ($p in $paths) {
                Get-ChildItem -Path $p -ErrorAction SilentlyContinue |
                ForEach-Object {
                    $props = Get-ItemProperty -Path $_.PSPath -ErrorAction SilentlyContinue
                    if ($props.DisplayName -like "Google Chrome*") {
                        [PSCustomObject]@{
                            Computer       = $env:COMPUTERNAME
                            DisplayName    = $props.DisplayName
                            DisplayVersion = $props.DisplayVersion
                        }
                    }
                }
            }
        } -ErrorAction Stop
        $chrome
    } catch {
        [PSCustomObject]@{ Computer = $c; Error = $_.Exception.Message }
    }
}
$results | Format-Table -AutoSize

Tip: target machines reporting versions < 140.0.7339.185 (Linux/Windows) or < 140.0.7339.186 (some Windows/macOS builds) for immediate remediation.

SOC hints: what to look for

• Renderer crashes followed by unusual child processes from chrome.exe.
• Spikes in browser‑originating connections to unfamiliar domains right after page visits.
• New persistence or code‑injection telemetry on user workstations.

References (primary sources)

• Chrome Releases — Stable Channel Update for Desktop (Sept 17, 2025)
• BleepingComputer — Sixth Chrome zero‑day exploited in attacks this year
• SecurityWeek — Chrome 140 update patches sixth zero‑day of 2025
• NHS Cyber Alert — Google Releases Security Update for Chrome
• The Hacker News — Google Patches Chrome Zero‑Day CVE‑2025‑10585