Google Chrome 's V8 JavaScript engine is affected by a critical zero-day "type confusion" vulnerability , codenamed CVE-2025-10585 . This is the sixth actively exploited zero-day vulnerability in Chrome this year.
This serious flaw, with an estimated CVSS 3.1 score of 8.8/10, allows remote code execution via advanced memory corruption techniques, which bypass Chrome's sandbox protections.
The vulnerability exploits Chrome's V8 JavaScript engine through a type confusion attack, which manipulates the optimization assumptions of the TurboFan just-in-time compiler.
Security researchers have confirmed active exploit campaigns targeting cryptocurrency wallets and conducting operations espionage, with threat actors leveraging the flaw to execute arbitrary shellcode and escape Chrome's renderer process sandbox.
See also: Fortra patches critical GoAnywhere MFT vulnerability
V8 Type Confusion Mechanism
Type confusion vulnerabilities in V8 represent one of the most advanced attack vectors against modern browsers.
The CVE-2025-10585 flaw exploits Chrome's performance optimization systems, affecting the inline cache (IC) mechanism during JavaScript object property access.
The vulnerability manifests itself when malicious JavaScript creates specially crafted Proxy objects that deceive V8's type inference system.
During TurboFan compilation, the engine makes critical assumptions about object types based on runtime feedback. Attackers can undermine these assumptions by implementing custom getter functions that return unexpected data types. As a result, the compiler generates incorrect memory access patterns.
Chrome vulnerability: Exploit chain
The exploit chain starts by creating a JavaScript object that contains a Symbol.toPrimitive handler, which returns an array when V8 expects a primitive number.
See also: Microsoft fixes critical flaw in Entra ID
When the ToNumber() conversion is called repeatedly, the V8 Maglev and TurboFan compilers optimize the code path based on incorrect type assumptions.
This code shows how attackers can manipulate V8's type system to achieve memory corruption.
The vulnerability allows the construction of “addrof” and “fakeobj” primitives, key building blocks for advanced exploitation techniques, including the construction of return-oriented programming (ROP) chains.
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
Exploitation effects
The attack chain usually begins with social engineering techniques, directing victims to malicious websites containing the exploit code.
According to reports, attackers are combining this vulnerability with privilege escalation exploits to install malware, steal cryptocurrency private keys, and conduct targeted surveillance operations.
All it takes is for users to visit a compromised website.
Google's Threat Analysis Team has attributed some exploitation activity to commercial spyware vendors and government agencies, highlighting the strategic value of the vulnerability for intelligence operations.
The security vulnerability allows attackers to bypass Chrome's multi-process architecture and site isolation capabilities, which are traditionally considered strong defense mechanisms.
See also: Popular Zero-Day vulnerabilities actively exploited in 2025
Crypto theft
Cryptocurrency security firms have reported wallet theft attacks specifically targeting Chrome users, with stolen funds being traced to addresses associated with known cybercriminal organizations.
These attacks show the real economic impact of this particular Chrome vulnerability, beyond traditional spying applications.
The vulnerability affects all versions of Chrome prior to 140.0.7339.185 on Windows, macOS, and Linux. Other Chromium-based browsers are also affected, including Microsoft Edge, Brave, and Opera.
Google has released emergency updates addressing the flaw, with automatic updates already deployed to most Chrome installations worldwide. Organizations should monitor network traffic for possible suspicious activity.
