PT-2025-25577 · Google · Chrome Os

Published 2025-02-27 · Updated 2025-06-16 · CVE-2025-6179

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Google ChromeOS version 16181.27.0

Description The issue allows a local attacker to bypass permissions in Extension Management, enabling them to disable extensions and access Developer Mode. This can lead to the loading of additional extensions, potentially exploiting vulnerabilities using tools like ExtHang3r and ExtPrint3r.

Recommendations For Google ChromeOS version 16181.27.0, consider restricting access to Developer Mode and limiting the ability to disable extensions as a temporary mitigation measure. Additionally, avoid using the ExtHang3r and ExtPrint3r tools until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Privilege Management

Incorrect Default Permissions

Weakness Enumeration

CWE-269

CWE-276

Related Identifiers

BDU:2025-09936

CVE-2025-6179

Affected Products

Chrome Os

References · 8

• 🔥 https://issuetracker.google.com/issues/399652193 · Exploit
• https://osv.dev/vulnerability/CVE-2025-6179 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-6179 · Security Note
• https://bdu.fstec.ru/vul/2025-09936 · Security Note
• https://twitter.com/CVEnew/status/1934660997442318771 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1934674319612772429 · Twitter Post
• https://issues.chromium.org/issues/b/399652193 · Note
• https://t.me/cvetracker/26337 · Telegram Post