CVE-2025-6177
BaseFortify
Publication date: 2025-06-16
Last updated on: 2025-07-02
Assigner: ChromeOS
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| chrome_os | 16063.45.2 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-269 | The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a privilege escalation issue in MiniOS on Google ChromeOS devices. It allows a local attacker to gain root code execution by exploiting a debug shell (VT3 console) that can be accessed through specific key combinations during developer mode entry and MiniOS access. This can happen even if developer mode is blocked by device policy or Firmware Write Protect (FWMP).
How can this vulnerability impact me? :
An attacker who exploits this vulnerability can gain root-level access on the affected ChromeOS device. This means they can execute code with the highest privileges, potentially compromising the entire system, accessing sensitive data, installing malicious software, or bypassing security controls.