CVE-2025-1568: Google Chrome OS RCE Vulnerability

CVE-2025-1568 Overview

CVE-2025-1568 is an access control vulnerability affecting the Gerrit chromiumos project configuration in Google ChromeOS 16063.87.0. Insufficient access controls and misconfigurations in Gerrit's project.config allow an attacker with a registered Gerrit account to inject malicious code into ChromeOS projects. Successful exploitation can lead to Remote Code Execution (RCE) and Denial of Service (DoS) by editing trusted pipelines. The flaw is classified under CWE-284 (Improper Access Control) and impacts the integrity of the ChromeOS build and review infrastructure.

Critical Impact
Any authenticated Gerrit user can modify trusted ChromeOS pipelines, enabling arbitrary code execution against build infrastructure and disruption of the ChromeOS release process.

Affected Products

Google ChromeOS 16063.87.0
Gerrit chromiumos project configuration
ChromeOS build pipelines dependent on the affected project.config

Discovery Timeline

2025-04-16 - CVE-2025-1568 published to NVD
2025-07-08 - Last updated in NVD database

Technical Details for CVE-2025-1568

Vulnerability Analysis

The vulnerability resides in how the Gerrit chromiumos project enforces permissions defined in project.config. Gerrit uses project.config to declare access rights, submit rules, and label permissions for branches and references. The ChromeOS deployment of Gerrit applied insufficiently restrictive Access Control Lists (ACLs), exposing trusted references to any holder of a registered Gerrit account.

Because trusted pipelines in ChromeOS rely on the integrity of branches and refs controlled by project.config, an attacker who edits these resources can inject code that is later executed by downstream automation. The impact extends beyond a single repository because ChromeOS build infrastructure consumes artifacts and pipeline definitions from the affected project.

The weakness aligns with CWE-284, where missing or incorrect authorization checks allow unauthorized actors to perform privileged operations. The EPSS probability for in-the-wild exploitation is 0.637%.

Root Cause

The root cause is misconfigured access rules in Gerrit's project.config for the chromiumos project. Permissions granting modification rights to broad user groups, rather than to a constrained set of trusted maintainers, allowed any registered Gerrit user to alter sensitive configuration and pipeline references.

Attack Vector

The attack vector is network-based and requires a low-privilege, authenticated Gerrit account. No user interaction is required. An attacker authenticates to the ChromeOS Gerrit instance, identifies a writable trusted reference governed by the misconfigured project.config, and pushes changes that modify pipeline logic. Once the modified pipeline runs, attacker-controlled code executes within the ChromeOS build environment, achieving RCE or causing DoS by corrupting build state.

For technical context, refer to the Chromium Issue Tracker Entry and the Google Issue Tracker Entry.

Detection Methods for CVE-2025-1568

Indicators of Compromise

Unexpected commits to refs/meta/config or trusted branches in the ChromeOS Gerrit chromiumos project from non-maintainer accounts.
Modifications to project.config that grant push, submit, or forge permissions to broad groups such as Registered Users.
Pipeline definition changes that introduce new external network calls, credential exfiltration, or shell invocations.
Anomalous build job behavior, including unexpected outbound connections from CI runners.

Detection Strategies

Audit Gerrit access logs for push operations against refs/meta/config and trusted branches by accounts outside the maintainer set.
Compare current project.config ACLs against a known-good baseline to identify permission drift.
Correlate Gerrit change events with downstream CI execution to detect pipeline modifications followed by abnormal job activity.

Monitoring Recommendations

Enable Gerrit audit logging and forward events to a centralized logging or SIEM platform for retention and analysis.
Alert on any change to project.config files across the ChromeOS Gerrit instance.
Monitor CI runner egress for connections to unknown hosts during pipeline execution.
Track creation of new Gerrit accounts and review their activity against trusted projects.

How to Mitigate CVE-2025-1568

Immediate Actions Required

Review and restrict project.config permissions in the ChromeOS Gerrit chromiumos project so that only vetted maintainer groups can modify trusted refs.
Revoke write access to refs/meta/config and trusted pipeline branches for the Registered Users group and any other broad group.
Rotate credentials and tokens accessible to CI runners that executed jobs from the affected project during the exposure window.
Audit recent commits to trusted refs and revert any unauthorized modifications.

Patch Information

Google addressed the misconfiguration in the Gerrit chromiumos project after the issue was tracked under Chromium Issue 374279912. Administrators of self-hosted Gerrit deployments should review their own project.config ACLs, because the fix for the ChromeOS instance does not propagate to third-party Gerrit installations.

Workarounds

Enforce least-privilege ACLs in Gerrit by restricting Push, Submit, Create Reference, and Forge Author/Committer permissions to explicit maintainer groups.
Require code review approvals from designated owners before merges to trusted branches, using Gerrit's submit-requirements and label.Code-Review settings.
Isolate CI runners that consume ChromeOS pipelines so that compromised builds cannot reach production signing keys or release infrastructure.
Enable two-factor authentication for all Gerrit accounts with write access to trusted projects.

bash

# Example Gerrit project.config hardening: restrict refs/meta/config to maintainers only
[access "refs/meta/config"]
  read = group Maintainers
  push = group Maintainers
  submit = group Maintainers
  exclusiveGroupPermissions = read push submit

[access "refs/heads/*"]
  push = group Maintainers
  forgeAuthor = group Maintainers
  forgeCommitter = group Maintainers