by Kastro
Paper/Archive/CVE-2025-6179

CVE-2025-6179

Google ChromeOS — ChromeOS Extension Disablement and Developer Mode Bypass via ExtHang3r and ExtPrint3r Exploits

EPSS 0.2%CVSS 9.8
critical.is priorityof 100
32
CVSS 9.8 (ADP)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 12.5.125 × 202.5No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Permissions Bypass in Extension Management in Google ChromeOS 16181.27.0 on managed Chrome devices allows a local attacker to disable extensions and access Developer Mode, including loading additional extensions via exploiting vulnerabilities using the ExtHang3r and ExtPrint3r tools.

Affected

ProductAffectedFixed inSource
ChromeOS16181.27.0–CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refissuetracker.google.com/issues/399652193refissues.chromium.org/issues/b/399652193