The zero-day vulnerability in question is CVE-2025-10585 , which has been described as a type confusion issue in the V8 JavaScript and WebAssembly engine ... their fraud payload using steganography ...