Loading story…
CISA has added CVE-2025-10585, a type confusion vulnerability in Google Chromium's V8 engine, to its Known Exploited Vulnerabilities (KEV) Catalog following evidence of active exploitation. Google released a security update for Chrome addressing this zero-day, which is the sixth such exploited vulnerability in 2025. Federal agencies are required to remediate this vulnerability by October 14, 2025, and all organizations are strongly urged to prioritize patching.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
On 2025-09-23, CISA added one Google Chromium vulnerability to its Known Exploited Vulnerabilities catalog, indicating evidence of active exploitation. The two references describe the same catalog update and do not provide additional distinct events such as a patch release or victim disclosure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
CISA has added the Google Chromium vulnerability CVE-2025-14174 to its Known Exploited Vulnerabilities (KEV) catalog after confirming active exploitation in the wild. This high-severity flaw, found in the ANGLE graphics abstraction layer used by Chromium-based browsers, allows out-of-bounds memory access due to improper buffer sizing in the Metal renderer. The vulnerability affects Google Chrome on macOS prior to version 143.0.7499.110, with related fixes also applied to Windows and Linux builds. Exploitation of this vulnerability can lead to memory corruption, browser crashes, or potentially arbitrary code execution within the browser context. Under Binding Operational Directive (BOD) 22-01, Federal Civilian Executive Branch agencies are required to remediate this vulnerability by the specified deadline, while CISA strongly encourages all organizations to prioritize patching. The addition of CVE-2025-14174 to the KEV catalog highlights its active exploitation and the significant risk it poses to federal and other enterprise environments. Organizations are urged to update affected systems promptly to mitigate the threat posed by this vulnerability.
Jun 29, 2026
**CISA** added two **Google Chrome** vulnerabilities to its **Known Exploited Vulnerabilities (KEV)** catalog after Google disclosed active exploitation in the wild. The flaws are **CVE-2026-3909**, an out-of-bounds write in **Skia**, and **CVE-2026-3910**, a **Chromium V8** memory-safety issue that can allow arbitrary code execution inside the browser sandbox via a crafted HTML page. Google rated both issues as high severity with **CVSS 8.8** and released fixes in Chrome **146.0.7680.75/76** for Windows and Mac and **146.0.7680.75** for Linux. CISA's KEV entry states that **CVE-2026-3910** may affect multiple Chromium-based browsers, including **Google Chrome, Microsoft Edge, and Opera**, while **CVE-2026-3909** impacts the shared **Skia** component and may affect **Chrome, ChromeOS, Android, Flutter, and other products** depending on vendor implementation. Federal agencies were directed to apply vendor mitigations or discontinue use if fixes are unavailable, with a remediation due date of **2026-03-27**. Neither source attributes the exploitation to a specific threat actor, but both confirm the vulnerabilities are being exploited and require prompt patching.
Jun 29, 2026
Google released security updates for Chrome for Desktop to address several high-severity vulnerabilities, including flaws in the V8 JavaScript engine. One of the vulnerabilities, CVE-2025-10585, was added to CISA's Known Exploited Vulnerabilities (KEV) catalog after a public exploit became available. Security advisories from both Google and government agencies urged users and administrators to update Chrome to the latest versions to mitigate the risk of exploitation. The patched vulnerabilities affect Chrome versions prior to 140.0.7339.207/.208 on Windows and Mac, and 140.0.7339.207 on Linux.
Jun 29, 2026