{“lastseen”:”2025-09-18T12:07:16″,”description”:”Google has released an update for its Chrome browser to patch four security vulnerabilities, including one zero-day. A zero-day vulnerability refers to a bug that has been found and exploited by cybercriminals before the vendor even knew about it (they have \\”zero days\\” to fix it).\\n\\nThis update is crucial since it addresses one vulnerability which is already being actively exploited and, reportedly, can be abused when the user visits a malicious website. It probably doesn\u2019t require any further user interaction, which means the user doesn\u2019t need to click on anything in order for their system to be compromised.\\n\\nThe Chrome update brings the version number to 140.0.7339.185\/.186 for Windows, Mac and 140.0.7339.185 for Linux.\\n\\nThe easiest way to update Chrome is to allow it to update automatically, but you can end up lagging behind if you never close your browser or if something goes wrong\u2014such as an extension stopping you from updating the browser.\\n\\nTo manually get the update, click the more menu (three stacked dots), then choose **Settings** \\u003e **About Chrome**. If there is an update available, Chrome will notify you and start downloading it. Then all you have to do is reload Chrome in order for the update to complete, and for you to be safe from the vulnerabilities.\\n\\n\\n\\nYou can find more elaborate update instructions and how to read the version number in our article on how to update Chrome on every operating system.\\n\\n## Technical details on the zero-day vulnerability\\n\\nGoogle describes the zero-day vulnerability tracked as CVE-2025-10585 as a type confusion in V8. Reported by Google Threat Analysis Group on 2025-09-16.\\n\\nDespite the short statement\u2014Google never reveals a lot of details until everyone has had a chance to update\u2014there are a few conclusions we can draw.\\n\\nIt helps to know that V8 is Google\u2019s open-source Javascript engine.\\n\\nA \\”type confusion\\” vulnerability happens when code doesn\u2019t verify the object type passed to it and then uses the object without type-checking. So, a program mistakenly treats one type of data as if it were another, like confusing a list for a single value or interpreting a number as text. This mix-up can cause the software to behave unpredictably, creating opportunities for attackers to break in, steal data, crash programs, or even run malicious code.\\n\\nGoogle\u2019s Threat Analysis Group (TAG) focuses on spyware and nation-state attackers who abuse zero days for espionage purposes.\\n\\nSo, it stands to reason that an attacker used Javascript to create a malicious site that exploited this vulnerability and lured targeted victims to that website. \\n\\nTAG reported the bug on September 16, and Google issued the patch one day later. That implies that the bug was urgent, or very easy to fix, and probably that both of those statements are true to some extent.\\n\\nUsually, as more details become known or a patch gets reverse engineered, cybercriminals will start using the vulnerability in less targeted attacks.\\n\\nUsers of other Chromium-based browsers, such as Microsoft Edge, Brave, Opera, and Vivaldi, are also advised to keep an eye out for updates and install them when they become available.\\n\\n* * *\\n\\n**We don\u2019t just report on threats\u2014we remove them**\\n\\nCybersecurity risks should never spread beyond a headline. Keep threats off your devices by downloading Malwarebytes today.”,”published”:”2025-09-18T10:15:54″,”modified”:”2025-09-18T10:15:54″,”type”:”malwarebytes”,”title”:”Update your Chrome today: Google patches 4 vulnerabilities including one zero-day”,”source”:””,”references”:””,”id”:”MALWAREBYTES:B0E1BC3ABF885ABFF1C53D59F7AF2AA0″,”bulletinFamily”:”blog”,”cwe”:null,”cvelist”:[“CVE-2025-10585″],”sourceData”:””,”sourceHref”:””,”cvss”:{“score”:0,”severity”:”NONE”,”vector”:”NONE”,”version”:”NONE”},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/www.malwarebytes.com\/blog\/news\/2025\/09\/update-your-chrome-today-google-patches-4-vulnerabilities-including-one-zero-day”,”category_name”:”News”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2025-09-18T12:07:16″,”description”:”Google has released an update for its Chrome browser to patch four security vulnerabilities, including one zero-day. A zero-day vulnerability refers to a bug that…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4],"tags":[6,8,12,115,13,33,7,11,5],"class_list":["post-17969","post","type-post","status-publish","format-standard","hentry","category-category_news","tag-cve","tag-cvss","tag-exploit","tag-malwarebytes","tag-news","tag-none","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n