CVE-2025-10585

criticalpriority · act · 90OT risk · criticalKEV · exploitedEPSS 0.090 · 95 %ileexploit · PoCDEEUFRNLRUUS

grimoire priorityP0 · Act now

Exploitable?

Yes · in the wild

CISA KEV · 1 exploit · PoC

Likely / severe?

8.97% (95th) EPSS

CVSS 9.8 · critical

Is it mine?

191 products

Check your exposure

Who says so?

8 sources

cnnvd · enisa_euvd · fstec_bdu · cert_bund

added 2025-09-23remediate by 2025-10-14

required action Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

EPSS · scored 2026-10-27

Google Chromium V8 Type Confusion Vulnerability

Type confusion in V8 in Google Chrome prior to 140.0.7339.185 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

No vendor fix yet; a mitigation is available.

MitigationCADRAsiemens_psirt
Block access to untrusted or external web content from sensitive systems
MitigationCADRAcisa_csaf_ot
Block access to untrusted or external web content from sensitive systems
No fix availableCADRAsiemens_psirt
Currently no fix is available
No fix availableCADRAcisa_csaf_ot
Currently no fix is available

cvss

Technical severity, 0–10. One row per scoring source.

9.8

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–critical · 6.3–9.8

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hprimary · NVD / NIST USexploitability 3.9 · impact 5.9

v3.18.8highCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:Hsecondary · CISA US

v3.16.3mediumAV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:Lsecondary · FSTEC (BDU) RU

v3.18.8highCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:Hsecondary · ENISA EU

v3.18.8highCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:Hsecondaryexploitability 2.8 · impact 5.9

v3.18.8highCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:Hsecondary · Siemens ProductCERT DE

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:Hsecondary · CVSS-BT (t0sche)

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · NCSC-NL NL

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: active · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-843USCWE-843USCWE-843USCWE-843USCWE-843US

exploits (1)

Public proof-of-concept and weaponised exploit code.

AdityaBhatt3010/CVE-2025-10585-The-Chrome-V8-Zero-DayGoogle patched CVE-2025-10585, a Chrome V8 zero-day under active exploitation — here’s what it is, why it matters, and how to stay safe.PoC · poc_in_github

affected products (191)

Products and version ranges known to be affected.

Debian Linuxall versionscert_bundDEcpe:/o:debian:debian_linux:-
Fedora Linuxall versionscert_bundDEcpe:/o:fedoraproject:fedora:-
Gentoo Linuxall versionscert_bundDEcpe:/o:gentoo:linux:-
Google Chrome <140.0.7339.185all versionscert_bundDE
Google Chrome <140.0.7339.186all versionscert_bundDE
Microsoft Edge <140.0.3485.81all versionscert_bundDE
SUSE openSUSEall versionscert_bundDEcpe:/o:suse:opensuse:-
Google Chrome< 140.0.7339.185cert_bundDE
Google Chrome< 140.0.7339.186cert_bundDE
Microsoft Edge< 140.0.3485.81cert_bundDE
CADRAall versionscisa_csaf_otUS
Siemens CADRA≤ vers:all/*cisa_csaf_otUS
Google Chrome140.0.7339.185 → 140.0.7339.185enisa_euvdEU
Google Inc Chrome OS≤ 132.0.6834.244fstec_bduRU
Google Inc Google Chrome≤ 140.0.7339.185fstec_bduRU
Google Inc Google Chrome≤ 140.0.7339.186fstec_bduRU
Microsoft Corp Microsoft Edge≤ 140.0.3485.81fstec_bduRU
АО «НППКТ» ОСОН ОСнова Оnyx≤ 2.14fstec_bduRU
АО «НППКТ» ОСОН ОСнова Оnyx≤ 3.1fstec_bduRU
АО «НТЦ ИТ РОСА» РОСА ХРОМ≤ 12.4fstec_bduRU

showing 20 of 191

advisories (5)

Vendor and ecosystem advisories describing this.

NCSC-2026-0229Kwetsbaarheden verholpen in Siemens productenNL2026-07-14csaf · ncsc_nlNL
Siemens heeft kwetsbaarheden verholpen in diverse producten als CADRA, IAM, Mendix, OpCenter, RUGGEDCOM, SIDIS en SIMATIC.
SSA-470355SSA-470355: Zlib and Foxit Vulnerabilities in CADRA2026-07-14csaf · siemens_psirtDE
CADRA is affected by multiple zlib and Foxit vulnerabilities. Siemens has released a new version for CADRA and recommends to update to the latest version. Siemens is preparing further fix versions and recommends specific countermeasures for products where fixes are not, or not yet available.
WID-SEC-W-2025-2080Google Chrome / Microsoft Edge: Mehrere Schwachstellen ermöglichen CodeausführungDeutsch2025-09-17csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Google Chrome / Microsoft Edge ausnutzen, um beliebigen Programmcode auszuführen.
ICSA-26-202-06Siemens CADRA2026-07-14icsa · cisa_csaf_otUS
CADRA is affected by multiple zlib and Foxit vulnerabilities. Siemens has released a new version for CADRA and recommends to update to the latest version. Siemens is preparing further fix versions and recommends specific countermeasures for products where fixes are not, or not yet available.
CERTFR-2026-AVI-1385Multiples vulnérabilités dans les produits VMwareFrançais2026-10-26vendor · certfrFR

also known as (4)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu cert_bund cisa_csaf_ot ncsc_nl siemens_psirt certfr NVD CVE.org MITRE

published 2025-09-24modified 2026-07-14

references (9)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan