CVE-2025-6179

ChromeOS Extension Disablement and Developer Mode Bypass via ExtHang3r and ExtPrint3r Exploits

State: Published
Severity: 9.8 Critical
Published: Jun 16, 2025
Updated: Jun 17, 2025
Reserved: Jun 16, 2025

Description

Permissions Bypass in Extension Management in Google ChromeOS 16181.27.0 on managed Chrome devices allows a local attacker to disable extensions and access Developer Mode, including loading additional extensions via exploiting vulnerabilities using the ExtHang3r and ExtPrint3r tools.

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	CISA-ADP

Weaknesses

CWE-276 Incorrect Default Permissions

Affected Products

Product	Versions
ChromeOSGoogle	16181.27.0Affected

References

https://issuetracker.google.com/issues/399652193
https://issues.chromium.org/issues/b/399652193

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.