Out-of-Bounds Read Vulnerability in ChromeOS by Google

CVE-2025-2509

What is CVE-2025-2509?

An out-of-bounds read vulnerability in Virglrenderer within ChromeOS versions allows a malicious guest virtual machine (VM) to gain unauthorized access to arbitrary memory addresses in the crosvm sandboxed process. This could potentially enable an attacker to escape the VM environment by manipulating crafted vertex elements data, which triggers the unsafe read within the util_format_description function.

References