PT-2025-28251 · Google · Chrome Os

Published 2025-07-07 · Updated 2025-10-03 · CVE-2025-6044

Positive Technologies (AI Summary)

CVSS v2.0

6.6

Medium

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:N

Name of the Vulnerable Software and Affected Versions: Google ChromeOS version 16238.64.0

Description: An Improper Access Control issue in the Stylus Tools component of Google ChromeOS on Lenovo devices allows a physical attacker to bypass the lock screen and access user files. This can be achieved by removing the stylus while the device is closed and using the screen capture feature.

Recommendations: For Google ChromeOS version 16238.64.0, consider disabling the screen capture feature or restricting access to the Stylus Tools component as a temporary workaround until a patch is available.

Fix

Improper Access Control

Improper Authentication

Weakness Enumeration

CWE-284

CWE-287

Related Identifiers

BDU:2025-09937

CVE-2025-6044

Affected Products

Chrome Os

References · 12

• https://osv.dev/vulnerability/CVE-2025-6044 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-09937 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-6044 · Security Note
• https://twitter.com/AGI2JPN/status/1942360415113019476 · Twitter Post
• https://twitter.com/AGI2JPN/status/1942316333636501608 · Twitter Post
• https://t.me/cveNotify/137325 · Telegram Post
• https://chromereleases.googleblog.com/2025/07/stable-chanel-update-for-chromeos.html · Note
• https://issuetracker.google.com/issues/421184743 · Note
• https://twitter.com/narenv456/status/1947917880017682895 · Twitter Post
• https://issues.chromium.org/issues/b/421184743 · Note
• https://twitter.com/VulmonFeeds/status/1942440160483737633 · Twitter Post
• https://twitter.com/CVEnew/status/1942301332532256977 · Twitter Post