Product:
Chrome
Summary
Type confusion in V8 in Google Chrome prior to 140.0.7339.185 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability has been classified with a high severity rating due to its potential impact on confidentiality, integrity, and availability.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 8.8 | CVE-2025-10585 |
Exploitation
An attacker can exploit this vulnerability by crafting a malicious HTML page that, when opened by a user, triggers the type confusion in the V8 engine. This can lead to heap corruption, allowing the attacker to execute arbitrary code in the context of the user running the browser. User interaction is required, as the user must visit the malicious page for the exploit to be successful.
Affected Products
- Google Chrome: All versions prior to 140.0.7339.185 are affected by this vulnerability, which can lead to severe security risks if exploited.
Mitigation
To mitigate this vulnerability, users should apply the latest updates provided by Google. If updates are not available, it is recommended to follow the applicable BOD 22-01 guidance for cloud services or discontinue use of the product until a fix is implemented.