CVE-2025-6177

CWE-269 — Improper Privilege Management3 documents3 sources
Severity
7.4HIGH
EPSS
0.0%
top 95.20%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Google ChromeosGoogle Chrome OS
Timeline
PublishedJun 16

Description

Privilege Escalation in MiniOS in Google ChromeOS (16063.45.2 and potentially others) on enrolled devices allows a local attacker to gain root code execution via exploiting a debug shell (VT3 console) accessible through specific key combinations during developer mode entry and MiniOS access, even when developer mode is blocked by device policy or Firmware Write Protect (FWMP).

CVSS vector

CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 1.4 | Impact: 5.9

Affected Packages2 packages

▶CVEListV5google/chromeos16063.45.2
▶NVDgoogle/chrome_os16063.45.2

🔴Vulnerability Details

2
CVEList
ChromeOS MiniOS Root Code Execution Bypass While Dev Mode Blocked↗2025-06-16
▶
GHSA
GHSA-v9hm-xvm9-qqfr: Privilege Escalation in MiniOS in Google ChromeOS (16063↗2025-06-16
▶
CVE-2025-6177 (HIGH CVSS 7.4) | Privilege Escalation in MiniOS in G | cvebase.io