Loading story…
Google released security updates for Chrome for Desktop to address several high-severity vulnerabilities, including flaws in the V8 JavaScript engine. One of the vulnerabilities, CVE-2025-10585, was added to CISA's Known Exploited Vulnerabilities (KEV) catalog after a public exploit became available. Security advisories from both Google and government agencies urged users and administrators to update Chrome to the latest versions to mitigate the risk of exploitation. The patched vulnerabilities affect Chrome versions prior to 140.0.7339.207/.208 on Windows and Mac, and 140.0.7339.207 on Linux.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
The Canadian Centre for Cyber Security published advisory AV25-615 covering the Google Chrome vulnerabilities and associated security updates. The advisory reinforced patching guidance for affected users and organizations.
CISA added Chrome zero-day CVE-2025-10585 to its KEV catalog after reports of a public exploit. This designation signaled active exploitation risk and urged organizations to prioritize remediation.
A public exploit for Chrome zero-day CVE-2025-10585 became available, elevating the urgency of the vulnerability and prompting government attention. The exact publication date is not specified in the references, but it was known by September 24, 2025.
Google issued Chrome security updates addressing three high-severity vulnerabilities in the V8 JavaScript engine, including CVE-2025-10585. The fixes were published as part of Chrome's September 24, 2025 security update cycle.
3 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourcesecurityonline.info
Open sourcecyber.gc.ca
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Google released a security advisory addressing a vulnerability in Chrome for Desktop, affecting versions prior to 141.0.7390.122/.123 on Windows and Mac, and 141.0.7390.122 on Linux. The flaw, identified as a high-severity issue in the V8 JavaScript engine (CVE-2025-12036), could allow attackers to exploit affected systems if not promptly patched. Security authorities have urged users and administrators to review the advisory and apply the necessary updates to mitigate potential risks. The vulnerability in the V8 engine requires immediate attention due to its potential impact on system security. Organizations are advised to ensure all Chrome installations are updated to the latest stable versions to prevent exploitation. No evidence of active exploitation has been reported, but the critical nature of the flaw underscores the importance of timely patching to maintain secure environments.
Jun 29, 2026Google has released emergency security updates for Chrome to address CVE-2025-10585, a high-severity zero-day vulnerability actively exploited in the wild. The flaw, a type confusion issue in the V8 JavaScript engine, allows remote code execution and affects all Chrome versions prior to 140.0.7339.185/.186. Users and organizations are urged to update Chrome and other Chromium-based browsers immediately to mitigate risk.
Jun 29, 2026
Google released Chrome desktop updates to fix multiple security vulnerabilities, including **actively exploited zero-days** affecting versions older than `125.0.6422.60/.61` on Windows and macOS and older than `125.0.6422.60` on Linux. The most serious issue, `CVE-2024-4947`, is a high-severity **type confusion** flaw in the V8 JavaScript engine that can lead to out-of-bounds memory access and potentially remote code execution; Google said an exploit for the bug exists in the wild. The updates also addressed other flaws, including `CVE-2024-4761`, an out-of-bounds write in V8 and WebAssembly, `CVE-2024-4671`, a use-after-free issue in Visuals, `CVE-2024-4948`, a use-after-free in Dawn, `CVE-2024-4949`, a use-after-free in V8, and `CVE-2024-4950`, an implementation issue in Downloads. Google and national CSIRT reporting warned that successful exploitation could enable code execution, crashes, or exposure of sensitive data, and urged users to update Chrome immediately while some technical details remain temporarily restricted until broad patch adoption.
Aug 15, 2026