Privilege Escalation in Google ChromeOS Installer and Recovery Image Handling
CVE-2025-1121
6.8MEDIUM
Summary
A security vulnerability in Google ChromeOS allows an attacker with physical access to exploit installer and recovery image handling, enabling them to gain root code execution. This flaw can lead to unauthorized control over enterprise-managed devices by utilizing a specially crafted recovery image, thus posing significant risks to organizations that rely on this platform for device management.
Affected Version(s)
ChromeOS 123.0.6312.112
References
CVSS V3.1
Score:
6.8
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Physical
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved