CVE-2025-1121
📋 TL;DR
This vulnerability allows an attacker with physical access to a ChromeOS device to escalate privileges to root and potentially unenroll enterprise-managed devices by using a specially crafted recovery image. It affects Google ChromeOS version 15786.48.2 on devices. The risk is highest for organizations with physically accessible ChromeOS devices.
💻 Affected Systems
- Google ChromeOS
📦 What is this software?
Chrome Os by Google
⚠️ Risk & Real-World Impact
Worst Case
Attacker gains persistent root access, unenrolls enterprise-managed devices, bypasses security controls, and potentially installs persistent malware or exfiltrates sensitive data.
Likely Case
Attacker gains temporary root access to compromise the device, potentially accessing local data or modifying system settings before detection.
If Mitigated
With proper physical security controls and device management, impact is limited to isolated incidents with minimal data exposure.
🎯 Exploit Status
Exploitation requires physical access and creation/sourcing of a specially crafted recovery image, but no authentication or user interaction is needed once physical access is obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Later versions than 15786.48.2 (check ChromeOS updates)
Vendor Advisory: https://issues.chromium.org/issues/b/336153054
Restart Required: Yes
Instructions:
1. Ensure ChromeOS device is connected to internet. 2. Go to Settings > About ChromeOS > Check for updates. 3. Install any available updates. 4. Restart the device when prompted.
🔧 Temporary Workarounds
Disable physical recovery boot
allPrevents booting from recovery media via physical controls
Not applicable - requires enterprise policy configuration
Enable verified boot enforcement
allEnsures only signed recovery images can be used
Not applicable - requires enterprise policy configuration
🧯 If You Can't Patch
- Implement strict physical security controls for ChromeOS devices
- Enable enterprise device management with remote wipe capabilities
🔍 How to Verify
Check if Vulnerable:
Check ChromeOS version: Go to Settings > About ChromeOS and verify version is 15786.48.2Check Version:
Not applicable - use ChromeOS Settings GUIVerify Fix Applied:
After update, verify ChromeOS version is higher than 15786.48.2📡 Detection & Monitoring
Log Indicators:
- Unexpected recovery mode entries
- Device unenrollment events
- Root privilege escalation attempts
Network Indicators:
- Device checking for updates after unexpected reboot
- Unusual device management server communications
SIEM Query:
source="chromeos" AND (event="recovery_mode" OR event="device_unenroll" OR event="privilege_escalation")