What is the CVSS score of CVE-2025-6177?

CVE-2025-6177 has a CVSS 3.1 base score of 7.4 (High). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Chrome are affected by CVE-2025-6177?

This vulnerability allows local attackers with physical access to ChromeOS devices to bypass security controls and gain root-level access, even on managed enterprise devices with developer mode…

How to fix or mitigate CVE-2025-6177?

Within 24 hours: Inventory all ChromeOS devices running version 16063.45.2 and confirm MDM enrollment status; issue security alert to device users prohibiting physical access by unauthorized parties. Within 7 days: Implement physical access controls (device lockers, monitored workspaces) for high-risk departments; escalate patch availability status with Google. Within 30 days: Deploy network-level monitoring for unexpected root process execution on ChromeOS devices; conduct security awareness training on physical security risks; evaluate device encryption status to limit data exposure if compromise occurs.

Chrome CVE-2025-6177

EUVD-2025-18418 HIGH

Improper Privilege Management (CWE-269)

2025-06-16 7f6e188d-c52a-4a19-8674-3c3fa7d1fc7f

Privilege Escalation RCE Chrome Google Chrome Os

7.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.4 HIGH

AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 14, 2026 - 21:59 euvd

EUVD-2025-18418

Analysis Generated

Mar 14, 2026 - 21:59 vuln.today

CVE Published

Jun 16, 2025 - 17:15 nvd

HIGH 7.4

DescriptionCVE.org

Privilege Escalation in MiniOS in Google ChromeOS (16063.45.2 and potentially others) on enrolled devices allows a local attacker to gain root code execution via exploiting a debug shell (VT3 console) accessible through specific key combinations during developer mode entry and MiniOS access, even when developer mode is blocked by device policy or Firmware Write Protect (FWMP).

AnalysisAI

Local privilege escalation vulnerability in Google ChromeOS MiniOS that allows unauthenticated attackers to achieve root code execution by exploiting an accessible debug shell (VT3 console) through specific key combinations during developer mode entry, circumventing device policy restrictions and Firmware Write Protect mechanisms. This vulnerability affects ChromeOS version 16063.45.2 and potentially other versions on enrolled devices, with a CVSS score of 7.4 indicating high severity. The attack requires local access and specific technical knowledge of key sequences, but no user interaction is needed once device access is obtained.

Technical ContextAI

The vulnerability resides in Google ChromeOS MiniOS, a minimal operating system environment used during the boot sequence and recovery operations on ChromeOS devices. The root cause is classified under CWE-269 (Improper Access Control / Uncontrolled Resource Consumption), indicating inadequate privilege validation and access restrictions on the VT3 debug console. The VT3 console is a debugging interface that should be restricted but remains accessible through specific key combinations even when developer mode is disabled by device policy or Firmware Write Protect (FWMP). Affected CPE would be: cpe:2.3:o:google:chrome_os:16063.45.2:*:*:*:*:*:*:* and potentially cpe:2.3:o:google:chrome_os:*:*:*:*:*:*:*:* for broader version ranges. The vulnerability exploits improper access control to a privileged debug interface, allowing escalation from local unprivileged context to root.

RemediationAI

Patch and Mitigation Strategies: (1) Primary Remediation: Update to ChromeOS version beyond 16063.45.2 (specific patched version not provided in source data - check Google ChromeOS release notes and security advisories for the patched version); (2) Interim Mitigations for unpatched systems: Enforce strict physical security controls to prevent unauthorized local access to devices; (3) Ensure Firmware Write Protect (FWMP) and developer mode restrictions remain enabled (note: these do not block the vulnerability but are part of defense-in-depth); (4) Monitor ChromeOS devices for unauthorized MiniOS or boot sequence access attempts; (5) Review device enrollment and MDM policies to restrict local access to enrolled devices; (6) Deploy Google ChromeOS security updates through your MDM solution as they become available. Administrators should check Google's official ChromeOS security page and their device management console for patch availability and deployment status.