CVE-2025-1704 Security feature bypass in ChromeOS
Local users can bypass device management by loading components from the unencrypted stateful partition, allowing unenrollment and request interception.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-1704?
CVE-2025-1704 is a medium-severity vulnerability in Google Chrome Os, published on 16 Apr 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
ComponentInstaller Modification in ComponentInstaller in Google ChromeOS 15823.23.0 on Chromebooks allows enrolled users with local access to unenroll devices and intercept device management requests via loading components from the unencrypted stateful partition.
Weakness: CWE-416
Which versions are affected by CVE-2025-1704?
It affects 1 product.
Products include Google Chrome Os.
How do I fix CVE-2025-1704?
No fix has been published for CVE-2025-1704 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-1704 being exploited?
There is no known exploitation of CVE-2025-1704 in the wild and no public exploit code.
Other vulnerabilities in Google Chrome Os
Sources
Also known as GHSA-mhjg-qmr3-w2xc.