Improper Access Control in Stylus Tools for Google ChromeOS on Lenovo Devices
CVE-2025-6044

6.1MEDIUM

Key Information:

Vendor

Google
Status
Chromeos
Vendor
CVE Published:
7 July 2025

What is CVE-2025-6044?

An Improper Access Control vulnerability in the Stylus Tools component of Google ChromeOS on Lenovo devices enables a physical attacker to bypass the device's lock screen. By removing the stylus while the device is closed and utilizing the screen capture feature, unauthorized access to user files can be achieved, potentially exposing sensitive information.

Affected Version(s)

ChromeOS 16238.64.0

References

https://issuetracker.google.com/issues/421184743
https://issues.chromium.org/issues/b/421184743

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Physical
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2025-6044 : Improper Access Control in Stylus Tools for Google ChromeOS on Lenovo Devices