PT-2025-25573 · Google · Chrome Os

Published 2024-12-06 · Updated 2025-06-16 · CVE-2025-6177

Positive Technologies (AI Summary)

CVSS v3.1

7.4

High

Base vector

AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Google ChromeOS versions 16063.45.2 and potentially others

Description The issue allows a local attacker to gain root code execution via exploiting a debug shell accessible through specific key combinations during developer mode entry and MiniOS access. This can occur even when developer mode is blocked by device policy or Firmware Write Protect.

Recommendations For version 16063.45.2 and potentially others, as a temporary workaround, consider disabling access to the debug shell until a patch is available. Restrict access to the MiniOS to minimize the risk of exploitation. Avoid using the specific key combinations that allow access to the debug shell during developer mode entry.

Fix

LPE

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

BDU:2025-09935

CVE-2025-6177

Affected Products

Chrome Os

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2025-6177 · Security Note
• https://osv.dev/vulnerability/CVE-2025-6177 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-09935 · Security Note
• https://issues.chromium.org/issues/b/382540412 · Note
• https://issuetracker.google.com/issues/382540412?pli=1 · Note
• https://twitter.com/CVEnew/status/1934654691628982568 · Twitter Post
• https://issuetracker.google.com/issues/382540412 · Note
• https://t.me/cvenotify/125832 · Telegram Post
• https://t.me/cvetracker/26336 · Telegram Post
• https://t.me/latest_high_impact_cve/2678 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1934681999198880030 · Twitter Post