Vulnerability · Published Jun 16, 2025 · Assigned by ChromeOS
CVE-2025-6177ChromeOS MiniOS Root Code Execution Bypass While Dev Mode Blocked
High 7.4
In plain English
A high-severity privilege mismanagement in ChromeOS from Google. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 0% of all known vulnerabilities).
Severity (CVSS 3.1)7.4High
Exploit odds (30 days)<0.1%top 99.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Privilege Escalation in MiniOS in Google ChromeOS (16063.45.2 and potentially others) on enrolled devices allows a local attacker to gain root code execution via exploiting a debug shell (VT3 console) accessible through specific key combinations during developer mode entry and MiniOS access, even when developer mode is blocked by device policy or Firmware Write Protect (FWMP).
Affected products (as reported)
Weakness: CWE-269 · Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H