CVE-2025-1121

CVSS 6.8 MEDIUMEPSS 0.1%CWE-269

Vexday Risk Score

13Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 6.8EPSS 0.1%KEV nãoPoC —Nuclei —Metasploit —Patch —

Lifecycle

06 Mar 2025Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

Privilege escalation in Installer and Recovery image handling in Google ChromeOS version 15786.48.2 on device allows an attacker with physical access to gain root code execution and potentially unenroll enterprise-managed devices via a specially crafted recovery image.

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Google · ChromeOS

References

https://issues.chromium.org/issues/b/336153054 https://issuetracker.google.com/issues/336153054