PatchTheCVEchrome os vulnerabilities and fixes
Recent CVEs affecting chrome os, with upgrade or downgrade steps. 10 tracked.
Also searched as: chromeos.
chrome os has 10 tracked vulnerabilities, 1 critical. A fixed release or vendor patch exists for 0. Most recent: 2025-07-07. Highest priority: CVE-2025-6179 (score 47/100).
- CVE-2025-6179 CRITICAL 9.8 MITIGATE Permissions Bypass in Extension Management in Google ChromeOS 16181.27.0 on managed Chrome devices all
- CVE-2025-6177 HIGH 7.4 MITIGATE Privilege Escalation in MiniOS in Google ChromeOS (16063.45.2 and potentially others) on enrolled devices allo
- CVE-2025-6044 MEDIUM 6.1 MITIGATE An Improper Access Control vulnerability in the Stylus Tools component of Google ChromeOS version 16238.64.0 o
- CVE-2025-2509 HIGH 7.8 MITIGATE Out-of-Bounds Read in Virglrenderer in ChromeOS 16093.57.0 allows a malicious guest VM to achieve arbitrary a
- CVE-2025-2073 HIGH 8.8 MITIGATE Out-of-Bounds Read in netfilter/ipset in Linux Kernel ChromeOS [6.1, 5.15, 5.10, 5.4, 4.19] allows a local att
- CVE-2025-1704 MEDIUM 6.5 MITIGATE ComponentInstaller Modification in ComponentInstaller in Google ChromeOS 15823.23.0 on Chromebooks allows enro
- CVE-2025-1568 HIGH 8.8 MITIGATE Access Control Vulnerability in Gerrit chromiumos project configuration in Google ChromeOS 16063.87.0 allows a
- CVE-2025-1566 HIGH 7.5 MITIGATE DNS Leak in Native System VPN in Google ChromeOS Dev Channel on ChromeOS 16002.23.0 allows network observers t
- CVE-2025-1290 HIGH 8.1 MITIGATE A race condition Use-After-Free vulnerability exists in the virtio_transport_space_update function within the
- CVE-2025-1121 MEDIUM 6.8 MITIGATE Privilege escalation in Installer and Recovery image handling in Google ChromeOS version 15786.48.2 on device
FAQ
How do I fix chrome os vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is chrome os being exploited right now?
None of the tracked chrome os CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which chrome os CVE should I patch first?
CVE-2025-6179 currently ranks highest (47/100): Permissions Bypass in Extension Management in Google ChromeOS 16181.27.0 on managed Chrome devices all.