Google has issued an urgent update for Chrome to address a critical zero-day vulnerability, marking the sixth such incident in 2025, as hackers exploit security flaws in the browser.
Google has released an urgent update for its Chrome browser to address a newly discovered zero-day security flaw that is currently being exploited by hackers. This incident marks the sixth zero-day vulnerability that Chrome has faced in 2025, underscoring the rapid pace at which attackers are able to exploit hidden weaknesses in software.
The vulnerability, identified as CVE-2025-10585, originates from a type confusion issue within Chrome’s V8 JavaScript engine. The flaw was discovered by Google’s Threat Analysis Group (TAG), which reported the issue on Tuesday. The company promptly rolled out a fix the following day, as reported by Bleeping Computer.
Google confirmed that this flaw is actively being exploited in the wild, although it has not disclosed specific technical details or identified the groups responsible for the attacks. TAG has a history of uncovering zero-day vulnerabilities linked to government-sponsored spyware campaigns, often targeting high-risk individuals such as journalists, opposition leaders, and dissidents.
The patch has been delivered through Chrome version 140.0.7339.185/.186 for Windows and macOS, and version 140.0.7339.185 for Linux. These updates will gradually reach all users in the Stable Desktop channel over the coming weeks.
While Chrome typically updates automatically, users can manually apply the patch by navigating to the ‘About Google Chrome’ section. Google has chosen to withhold full technical details until a majority of users have installed the update, a precaution aimed at preventing further exploitation of unpatched systems.
This latest vulnerability is part of a concerning trend, as it is the sixth zero-day flaw that Google has patched in Chrome this year. Earlier this year, in March, Google addressed CVE-2025-2783, a sandbox escape bug that was exploited in espionage attacks against Russian organizations. In May, the company released emergency updates for CVE-2025-4664, which allowed attackers to hijack user accounts. In June, another flaw in the V8 engine, CVE-2025-5419, was patched after being identified by TAG. July saw the release of a fix for CVE-2025-6558, which enabled attackers to bypass Chrome’s sandbox protection.
As Google continues to address these vulnerabilities, it is clear that the company is racing to secure its browser against rapidly emerging threats. Updating Chrome is a quick process, whether on Mac or Windows, and users are encouraged to take action immediately.
In addition to updating Chrome, users can take further steps to protect themselves from potential attacks. Many zero-day exploits are delivered through malicious websites or email attachments, so it is crucial to avoid clicking on unknown links or downloading files from unverified sources. Using strong antivirus software can provide an additional layer of defense, helping to detect malicious code that may attempt to run through compromised browsers.
Even if attackers manage to steal login credentials through a browser exploit, enabling two-factor authentication (2FA) can significantly hinder their ability to access accounts. Users are advised to utilize an authenticator app instead of SMS for stronger protection. Additionally, employing a password manager can help keep credentials secure and generate unique, complex passwords, preventing a domino effect if one account is targeted.
It is also advisable for users to check if their email addresses have been exposed in previous data breaches. Many password managers include built-in breach scanners that can alert users if their information has appeared in known leaks. If a match is found, it is essential to change any reused passwords and secure those accounts with new, unique credentials.
While Chrome updates are critical, it is important to remember that attackers can also exploit vulnerabilities in operating systems such as Windows, macOS, Android, or iOS. Regular updates to these systems can patch vulnerabilities across the board, reducing the likelihood of a browser exploit spreading further.
The frequency of zero-day attacks on Chrome this year highlights the relentless nature of cyber threats and the serious gaps that can exist in even the most widely used software. These vulnerabilities represent not just bugs, but opportunities for hackers to exploit millions of users before fixes can be deployed. The growing sophistication of threat actors, including state-sponsored groups targeting high-risk individuals, further complicates the landscape of online security.
As the battle to secure popular software continues, users are encouraged to stay vigilant and proactive in protecting their personal information. Do you think Google is responding quickly enough to safeguard your data? Share your thoughts with us.
Source: Original article