Chrome EUVD-2025-18418

Risk Assessment Summary: While the CVSS score of 7.4 is elevated, real-world risk must be contextualized with attack vector and complexity. CVSS Vector Analysis: AV:L (Local) - requires physical or local system access; AC:H (High Complexity) - requires specific technical knowledge of key sequences and timing; PR:N (No Privileges) - can be exploited by any local user; UI:N (No User Interaction); S:U (Unchanged Scope); C:H/I:H/A:H (Full impact on confidentiality, integrity, availability). The AC:H rating significantly reduces practical exploitability despite the high impact rating. Real-world exploitation requires: (1) physical or local access to a ChromeOS enrolled device, (2) knowledge of specific key combinations, (3) understanding of MiniOS boot sequences, and (4) circumvention of device policies. No KEV status, EPSS probability, or confirmed public POC data were provided, suggesting limited public exploitation despite disclosure. This is likely a medium-to-high priority for organizations operating enrolled ChromeOS fleets in environments where physical security cannot be guaranteed, but lower priority in physically secured environments. The enrolled device restriction indicates enterprise/managed deployment focus.

Attack Scenario: An attacker with physical access to an enrolled ChromeOS device (e.g., in a shared workspace, classroom, or through brief physical access) performs a specific key sequence during device startup or recovery mode to access the VT3 debug console. Despite the device policy disabling developer mode and FWMP protections being active, the debug shell remains accessible. The attacker uses the debug console to execute commands with root privileges, potentially exfiltrating sensitive data, installing persistence mechanisms, modifying device firmware, or compromising the device for lateral network attacks. The AC:H rating suggests this requires detailed knowledge (e.g., documented key sequences like Ctrl+Alt+→ or similar MiniOS-specific combinations), making it a moderate-to-advanced attack. No confirmed public POC availability was indicated, but the specificity of the vulnerability description suggests internal or limited disclosure. In enterprise ChromeOS environments, this could enable attacker persistence across device updates if root access is achieved before MiniOS completes its security checks.