CVE-2025-6044: Chrome OS Lock Screen Bypass Vulnerability

CVE-2025-6044 Overview

CVE-2025-6044 is an improper access control vulnerability [CWE-287] in the Stylus Tools component of Google ChromeOS version 16238.64.0 on garaged stylus devices. An attacker with physical access can bypass the lock screen by removing the stylus while the device is closed and invoking the screen capture feature. The bypass exposes user files without requiring authentication.

Critical Impact
A physical attacker can bypass the ChromeOS lock screen on garaged stylus devices and access user files through the screen capture feature, breaking the primary authentication boundary.

Affected Products

Google ChromeOS version 16238.64.0
ChromeOS devices with garaged (built-in) stylus hardware
Stylus Tools component within ChromeOS

Discovery Timeline

2025-07-07 - CVE-2025-6044 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-6044

Vulnerability Analysis

The flaw resides in the Stylus Tools component, which surfaces quick-access tools when a garaged stylus is removed from the device. On ChromeOS 16238.64.0, the tool surface fails to enforce the lock-screen authentication state when the lid is closed. Removing the stylus while the device is closed triggers a tool overlay that includes the screen capture feature. The screen capture function operates against the underlying user session rather than the locked shell, so captured output reveals content from files and applications that should be inaccessible.

The issue is a design-level authorization gap. The system trusts a hardware event (stylus removal on a closed device) as a valid entry point to session-level tooling. Confidentiality and integrity of user data are affected because captured screen data can reveal files and, depending on subsequent capture interactions, the operator can influence stored content.

Root Cause

The root cause is an authentication state check that is not evaluated on the stylus-removal code path when the device lid is closed. The Stylus Tools handler exposes privileged UI, including screen capture, without confirming that the lock screen has been satisfied. This is a classic improper access control condition mapped to [CWE-287] (Improper Authentication).

Attack Vector

Exploitation requires physical possession of a vulnerable ChromeOS device with a garaged stylus. The attacker closes the lid, removes the stylus, and interacts with the exposed screen capture tool. No credentials, prior authorization, or user interaction from the legitimate user are required. Remote exploitation is not possible. Public references are tracked in the Chromium Issue #421184743 and the Google Issue Tracker #421184743.

No verified proof-of-concept code is available. The vulnerability is described in prose in the vendor references.

Detection Methods for CVE-2025-6044

Indicators of Compromise

Screen capture artifacts, such as PNG files, appearing in the Downloads directory of a user account outside of expected working hours.
ChromeOS device logs showing stylus removal events while the lid state is reported as closed.
User reports of unexpected files, altered session state, or capture notifications after the device was left unattended.

Detection Strategies

Inventory ChromeOS fleet build numbers and flag any device running version 16238.64.0 with garaged stylus hardware.
Correlate device power state, lid state, and stylus eject events from ChromeOS device telemetry to identify anomalous unlock-adjacent activity.
Review Google Admin console audit logs for screen capture invocations that occur without a preceding successful authentication event.

Monitoring Recommendations

Enable and forward ChromeOS device event logs to a central analytics platform for correlation with physical access indicators.
Alert on new image files created in user Download directories on managed ChromeOS devices during periods when the user is not signed in.
Track firmware and OS version drift across the ChromeOS fleet so unpatched builds are surfaced quickly.

How to Mitigate CVE-2025-6044

Immediate Actions Required

Update affected ChromeOS devices past version 16238.64.0 to the latest stable channel release that includes the Stylus Tools fix.
Enforce a policy that prevents users from deferring ChromeOS updates on managed devices with garaged stylus hardware.
Instruct users to store the stylus in the garage and keep affected devices in a secured location when unattended.

Patch Information

Google tracks the fix through internal bug ID 421184743. Refer to the Chromium Issue #421184743 and the Google Issue Tracker #421184743 for status and the fixed ChromeOS milestone. Apply the update through the standard ChromeOS auto-update channel or push it via the Google Admin console for managed fleets.

Workarounds

Disable the Stylus Tools quick-access surface using Google Admin console device policy where operational needs allow.
Physically retain the stylus separately from the device when leaving vulnerable hardware unattended in shared spaces.
Restrict use of vulnerable ChromeOS builds to environments where physical access is controlled until the patched build is deployed.

bash

# Verify ChromeOS version on a managed device
# Navigate to chrome://version or run from crosh:
version

# Force an update check from crosh
update_engine_client --check_for_update
update_engine_client --status