PT-2025-38298 · Google+3 · Google Chrome+3

Published 2025-01-01 · Updated 2026-06-06 · CVE-2025-10585

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 140.0.7339.185

Description A type confusion issue exists in the V8 JavaScript and WebAssembly engine. This flaw allows a remote attacker to potentially exploit heap corruption via a crafted HTML page, which can lead to memory reading/writing outside of intended boundaries and the execution of arbitrary code. This issue has been actively exploited in the wild, with specific reports indicating it has been used to target cryptocurrency wallet extensions to steal private keys and drain funds. Type confusion is a software error where a program accesses a resource using a type that is different from the type it was originally allocated.

Recommendations Update to version 140.0.7339.185 or higher.

Exploit

Fix

RCE

DoS

Type Confusion

Weakness Enumeration

CWE-843

Related Identifiers

ALT-PU-2025-13054

AZL-76335

BDU:2025-11457

CVE-2025-10585

DSA-6004-1

OPENSUSE-SU-2025:15578-1

Affected Products

Alt Linux

Google Chrome

Debian

Red Os

References · 235

• 🔥 https://github.com/AdityaBhatt3010/CVE-2025-10585-The-Chrome-V8-Zero-Day · Exploit
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2025-1216SE138 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-6004-1 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se18-bulletin-2025-1113SE18 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-10585 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-11457 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-10585 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-10585 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2025:15578-1 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se16-bulletin-20251225SE16 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-76335 · Vendor Advisory
• http://repo.red-soft.ru/redos/7.3c/x86_64/updates · Vendor Advisory
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-10585 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-10585 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2025-1202SE17 · Vendor Advisory