PT-2025-16921 · Google · Chrome Os

Published 2024-08-14 · Updated 2025-04-17 · CVE-2025-1704

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Google ChromeOS version 124.0.6367.34

Description The issue allows enrolled users with local access to unenroll devices and intercept device management requests by loading components from the unencrypted stateful partition. This is due to a modification in the ComponentInstaller.

Recommendations For Google ChromeOS version 124.0.6367.34, consider restricting local access to enrolled users to minimize the risk of exploitation. As a temporary workaround, restrict the ability to load components from the unencrypted stateful partition until a patch is available.

Exploit

Fix

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

BDU:2025-05277

CVE-2025-1704

Affected Products

Chrome Os

References · 12

• 🔥 https://issuetracker.google.com/issues/359915523 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-1704 · Security Note
• https://bdu.fstec.ru/vul/2025-05277 · Security Note
• https://osv.dev/vulnerability/CVE-2025-1704 · Vendor Advisory
• https://twitter.com/CVEnew/status/1912722254430872033 · Twitter Post
• https://chromium-review.googlesource.com/c/chromium/src/+/5805540 · Note
• https://t.me/cvetracker/21820 · Telegram Post
• https://twitter.com/cybercronai/status/1912831094337986742 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1912784824412098907 · Twitter Post
• https://t.me/cvedetector/23198 · Telegram Post
• https://issues.chromium.org/issues/b/359915523 · Note
• https://support.google.com/chromebook/thread/268862398/chrome-os-crashes?hl=en · Note