Loading story…
Google released a Chrome Stable security update addressing four high-severity vulnerabilities, including CVE-2025-10585, a V8 type confusion flaw for which Google confirmed an exploit exists in the wild. Google Threat Analysis Group reported the vulnerability. The patched releases are 140.0.7339.185/.186 for Windows and Mac and 140.0.7339.185 for Linux, with a phased rollout announced on September 17, 2025.
The update also fixes two use-after-free vulnerabilities and a heap buffer overflow across Dawn, WebRTC, and ANGLE. Related Chromium tickets identify use-after-free issues in WebRTC’s MediaStreamDescriptor and Dawn’s WebGPU D3D12 resource allocator, but the available tracker content provides no further exploitation details. Google said vulnerability details may remain restricted until sufficient patch adoption. Organizations should ensure managed Chrome installations run these patched versions or newer supported releases, prioritizing remediation because of the confirmed in-the-wild V8 exploit.
See which actors are running it and whether you're in range.
5 events from the most recent confirmed update back to the earliest known activity.
Google Threat Analysis Group reported CVE-2025-10585, a high-severity type confusion vulnerability in Chrome's V8 engine, tracked as Chromium issue 445380761.
Sherkito reported CVE-2025-10501, a high-severity use-after-free vulnerability in Chrome's WebRTC component. Google listed a $10,000 reward for the report.
Google Big Sleep reported CVE-2025-10502, a high-severity heap buffer overflow vulnerability in Chrome's ANGLE component.
Giunash (Gyujeong Jin) reported CVE-2025-10500, a high-severity use-after-free vulnerability in Chrome's Dawn component. Google listed a $15,000 reward for the report.
Google updated Chrome Stable to 140.0.7339.185/.186 for Windows and Mac and 140.0.7339.185 for Linux, fixing four high-severity vulnerabilities in V8, Dawn, WebRTC, and ANGLE. In the release notice, Google confirmed that an exploit for CVE-2025-10585 exists in the wild.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
4 references tracked. Mallory keeps watching after this page renders.
chromereleases.googleblog.com
Open sourceissues.chromium.org
Open sourceissues.chromium.org
Open sourceissues.chromium.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Google released Chrome desktop updates to fix multiple security vulnerabilities, including **actively exploited zero-days** affecting versions older than `125.0.6422.60/.61` on Windows and macOS and older than `125.0.6422.60` on Linux. The most serious issue, `CVE-2024-4947`, is a high-severity **type confusion** flaw in the V8 JavaScript engine that can lead to out-of-bounds memory access and potentially remote code execution; Google said an exploit for the bug exists in the wild. The updates also addressed other flaws, including `CVE-2024-4761`, an out-of-bounds write in V8 and WebAssembly, `CVE-2024-4671`, a use-after-free issue in Visuals, `CVE-2024-4948`, a use-after-free in Dawn, `CVE-2024-4949`, a use-after-free in V8, and `CVE-2024-4950`, an implementation issue in Downloads. Google and national CSIRT reporting warned that successful exploitation could enable code execution, crashes, or exposure of sensitive data, and urged users to update Chrome immediately while some technical details remain temporarily restricted until broad patch adoption.
Aug 15, 2026
Google released Chrome Stable 152.0.7977.82 for Linux and 152.0.7977.82/.83 for Windows and macOS to fix **CVE-2026-85046**, a high-severity type-confusion zero-day in the V8 JavaScript and WebAssembly engine that is being exploited in the wild. A malicious website can trigger unsafe memory handling and potentially execute attacker-controlled code within Chrome's browser sandbox; an additional vulnerability could be chained to escape that boundary. The release contains 12 security fixes—10 rated high severity and two medium severity—affecting V8, WebGL, Compositing, Network, DevTools, Skia, and other components. Google has withheld exploit and targeting details while patch adoption increases. Organizations should force an update and relaunch Chrome across managed endpoints, verify deployed versions, and prioritize corresponding updates for Chromium-based browsers such as Edge, Brave, Opera, and Vivaldi when available.
Sep 10, 2026
Google released Chrome stable-channel updates to address multiple security vulnerabilities, including **CVE-2024-5274**, a high-severity **type confusion** flaw in the **V8 JavaScript engine** that Google said was being exploited in the wild. The company shipped patched desktop versions `125.0.6422.112/.113` for Windows and Mac and `125.0.6422.112` for Linux, while limiting technical details until more users had updated. The bug was reported by Clément Lecigne of Google’s Threat Analysis Group and Brendon Tiszka of Chrome Security. Subsequent Chrome advisories and release notes show Google continuing to issue stable-channel fixes for broader sets of browser and platform weaknesses, including advisories describing **seven vulnerabilities with three critical flaws** and ChromeOS updates carrying additional browser and third-party security patches. The later fixes covered high-, medium-, and low-severity issues such as **use-after-free**, **type confusion**, **race conditions**, **bad cast**, and implementation errors across components including **V8**, **WebRTC**, **DevTools**, **Downloads**, **Password Manager**, and **WebGPU**, underscoring the ongoing need for rapid Chrome and ChromeOS patch deployment.
Aug 24, 2026