CVE Program partner

ChromeOS

ChromeOS Project

API
CVEs, 365 days013 all time, 1 rejected
Quality-median 99%
CVSS by the CNA-share of records
CWE-share of records
Affected versions-not n/a or unspecified
CVSS added by CISA-lower is better
OrganisationChromeOS Project
RoleCNA
TypeVendor, Bug Bounty Provider
Reports toGoogle → mitre
ScopeVulnerabilities that are (1) reported to ChromeOS Security, (2) affect ChromeOS device software and hardware, including our open source dependencies, and (3) are not covered by another CNA’s scope.
Advisorieshttps://chromereleases.googleblog.com/

Latest CVEs · RSS

  • CVE-2025-6044 2025-07-07
    An Improper Access Control vulnerability in the Stylus Tools component of Google ChromeOS version 16238.64.0 on the garaged stylus devices allows a physical att
  • CVE-2025-6179 2025-06-16
    Permissions Bypass in Extension Management in Google ChromeOS 16181.27.0 on managed Chrome devices allows a local attacker to disable extensions and acc
  • CVE-2025-6177 2025-06-16
    Privilege Escalation in MiniOS in Google ChromeOS (16063.45.2 and potentially others) on enrolled devices allows a local attacker to gain root code execution vi
  • CVE-2025-2509 2025-05-06
    Out-of-Bounds Read in Virglrenderer in ChromeOS 16093.57.0 allows a malicious guest VM to achieve arbitrary address access within the crosvm sandboxed process,
  • CVE-2025-1290 2025-04-17
    A race condition Use-After-Free vulnerability exists in the virtio_transport_space_update function within the Kernel 5.4 on ChromeOS. Concurrent allocation and
  • CVE-2025-1568 2025-04-16
    Access Control Vulnerability in Gerrit chromiumos project configuration in Google ChromeOS 16063.87.0 allows an attacker with a registered Gerrit account to inj
  • CVE-2025-2073 2025-04-16
    Out-of-Bounds Read in netfilter/ipset in Linux Kernel ChromeOS [6.1, 5.15, 5.10, 5.4, 4.19] allows a local attacker with low privileges to trigger an out-of-bou
  • CVE-2025-1704 2025-04-16
    ComponentInstaller Modification in ComponentInstaller in Google ChromeOS 15823.23.0 on Chromebooks allows enrolled users with local access to unenroll devices
  • CVE-2025-1566 2025-04-16
    DNS Leak in Native System VPN in Google ChromeOS Dev Channel on ChromeOS 16002.23.0 allows network observers to expose plaintext DNS queries via failure to prop
  • CVE-2025-1122 2025-04-15
    Out-Of-Bounds Write in TPM2 Reference Library in Google ChromeOS 15753.50.0 stable on Cr50 Boards allows an attacker with root access to gain persistence and
  • CVE-2025-1292 2025-04-15
    Out-Of-Bounds Write in TPM2 Reference Library in Google ChromeOS 122.0.6261.132 stable on Cr50 Boards allows an attacker with root access to gain persistence a
  • CVE-2025-1121 2025-03-06
    Privilege escalation in Installer and Recovery image handling in Google ChromeOS version 15786.48.2 on device allows an attacker with physical access to gain ro

All CVE Program partners