CVE-2025-1121: Google ChromeOS Privilege Escalation Flaw

CVE-2025-1121 Overview

CVE-2025-1121 is a privilege escalation vulnerability in the Installer and Recovery image handling of Google ChromeOS version 15786.48.2. An attacker with physical access to a target device can supply a specially crafted recovery image to gain root code execution. The flaw also enables unenrollment of enterprise-managed devices, breaking organizational device policy enforcement. The vulnerability is tracked under CWE-269: Improper Privilege Management and affects ChromeOS devices through the recovery workflow.

Critical Impact
Physical attackers can obtain root execution and unenroll enterprise-managed ChromeOS devices, bypassing centrally enforced management controls.

Affected Products

Google ChromeOS version 15786.48.0
Google ChromeOS version 15786.48.2 (on-device)
Enterprise-enrolled ChromeOS devices subject to recovery image handling

Discovery Timeline

2025-03-07 - CVE-2025-1121 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-1121

Vulnerability Analysis

The vulnerability resides in how ChromeOS validates and processes recovery images during the installer and recovery workflow. An attacker with physical access can present a crafted recovery image that the system handles with elevated trust. Successful exploitation yields root code execution on the device.

Beyond local root, the flaw can be used to unenroll devices from enterprise management. This removes managed policies, extensions, and restrictions applied by administrators through the Google Admin console. Attack complexity is low, but the attack vector requires physical presence at the device.

Root Cause

The underlying weakness falls under CWE-269: Improper Privilege Management. The recovery image handling path does not sufficiently constrain the privileges granted to content loaded from recovery media. A crafted image can therefore influence components that execute with root-level trust during installation or recovery.

Attack Vector

Exploitation requires physical access to the ChromeOS device. The attacker prepares external recovery media containing a specially crafted recovery image. Booting the device into recovery mode and supplying the crafted image triggers the privilege escalation. No user authentication or interaction with a signed-in profile is required to achieve root execution or to unenroll the device.

No verified public proof-of-concept code is available. For technical specifics, refer to the vendor tracking entries at Chromium Issue #336153054 and Google Issue Tracker #336153054.

Detection Methods for CVE-2025-1121

Indicators of Compromise

Unexpected transitions of managed ChromeOS devices to an unenrolled state in the Google Admin console.
Devices reporting a ChromeOS version or firmware state inconsistent with the enterprise-managed baseline.
Physical evidence of recovery-mode boots, such as USB or SD card insertion events logged by physical security systems.

Detection Strategies

Monitor the Google Admin console for device enrollment state changes and correlate with asset inventory and user activity.
Alert on sudden drops in policy compliance reports for ChromeOS fleets, particularly around recovery-mode or firmware anomalies.
Track ChromeOS version and channel reporting to identify devices deviating from managed update baselines.

Monitoring Recommendations

Centralize ChromeOS device telemetry and enrollment events into a SIEM or data lake for continuous review.
Review physical security footage and badge logs for unauthorized access to ChromeOS endpoints, especially shared or kiosk devices.
Audit returned, lost, or recovered devices for signs of recovery media use before reissuing them to users.

How to Mitigate CVE-2025-1121

Immediate Actions Required

Update affected ChromeOS devices to a version later than 15786.48.2 using managed auto-update policies.
Restrict physical access to enterprise ChromeOS devices, especially those deployed in public or unattended environments.
Re-validate enrollment state across the fleet and re-enroll any device found in an unexpected unmanaged state.

Patch Information

Google addresses the issue through standard ChromeOS auto-updates. Administrators should confirm devices receive updates beyond ChromeOS 15786.48.2 and consult Chromium Issue #336153054 and Google Issue Tracker #336153054 for vendor references.

Workarounds

Enable Forced Re-enrollment (FRE) or Zero-Touch Enrollment to make unauthorized unenrollment operationally difficult to retain.
Disable developer mode and enforce verified boot through enterprise policy where supported.
Apply physical tamper controls such as port blockers, locked enclosures, and asset tracking for high-value ChromeOS devices.

bash

# Configuration example
# Verify ChromeOS version on-device via crosh
> version
> get_version
# Administrators: confirm managed devices are above 15786.48.2 in the Google Admin console
# Devices > Chrome > Devices > filter by OS version <= 15786.48.2