CVE-2025-1566 Information disclosure in ChromeOS

What is CVE-2025-1566?

CVE-2025-1566 is a high-severity vulnerability in Google Chrome Os, published on 16 Apr 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

DNS Leak in Native System VPN in Google ChromeOS Dev Channel on ChromeOS 16002.23.0 allows network observers to expose plaintext DNS queries via failure to properly tunnel DNS traffic during VPN state transitions.

Weakness: CWE-1319

Which versions are affected by CVE-2025-1566?

It affects 1 product.

Products include Google Chrome Os.

How do I fix CVE-2025-1566?

No fix has been published for CVE-2025-1566 yet. Limit exposure of the affected software until one is available.

Is CVE-2025-1566 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-1566 exists.

Other vulnerabilities in Google Chrome Os

• CVE-2014-1708 Code injection in n/a Critical 10.0
• CVE-2013-2833 Use after free in n/a Critical 10.0
• CVE-2013-0915 Integer overflow in n/a Critical 10.0
• CVE-2012-2864 Memory corruption in n/a Critical 10.0
• CVE-2012-4050 Other in n/a Critical 10.0

All Google Chrome Os vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-gm22-hqvw-7j52.