PT-2025-16919 · Google · Google Chrome

Published 2025-04-16 · Updated 2025-05-06 · CVE-2025-1566

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Google ChromeOS version 129.0.6668.36

Description The issue allows network observers to expose plaintext DNS queries due to a failure to properly tunnel DNS traffic during VPN state transitions. This occurs in the Native System VPN in Google ChromeOS Dev Channel.

Recommendations For Google ChromeOS version 129.0.6668.36, consider disabling the Native System VPN until a patch is available to prevent exposure of plaintext DNS queries. Restrict access to sensitive information and networks to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-1319

CWE-350

Related Identifiers

CVE-2025-1566

Affected Products

Google Chrome

References · 10

• https://osv.dev/vulnerability/CVE-2025-1566 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-1566 · Security Note
• https://t.me/cvetracker/21818 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1912789943966900644 · Twitter Post
• https://twitter.com/cybercronai/status/1912831094337986742 · Twitter Post
• https://issues.chromium.org/issues/b/342802975 · Note
• https://issuetracker.google.com/issues/342802975 · Note
• https://t.me/cvedetector/23196 · Telegram Post
• https://twitter.com/CVEnew/status/1912722255299203435 · Twitter Post
• https://t.me/cvenotify/120914 · Telegram Post