CVE-2025-1568: Gerrit Access Control Vulnerability Allows Malicious Code Injection in ChromeOS

Published Apr 16, 2025

Updated

Access Control Vulnerability in Gerrit chromiumos project configuration in Google ChromeOS 16063.87.0 allows an attacker with a registered Gerrit account to inject malicious code into ChromeOS projects and potentially achieve Remote Code Execution and Denial of Service via editing trusted pipelines by insufficient access controls and misconfigurations in Gerrit's project.config.

Affected Software

2 affected components

Google ChromeOS

Google Chrome OS=16063.87.0

Event History

Apr 16, 2025

CVE Published

via MITRE·11:06 PM

Data Sourced

via MITRE·11:06 PM

DescriptionWeakness

Data Sourced

via NVD·11:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2025-1568?

CVE-2025-1568 is classified with a high severity due to its potential to allow remote code execution and denial of service.

How do I fix CVE-2025-1568?

To fix CVE-2025-1568, ensure that your Google ChromeOS is updated to the latest version released by Google.

Who is affected by CVE-2025-1568?

CVE-2025-1568 affects users of Google ChromeOS, specifically those using version 131.0.6778.268.

What type of vulnerability is CVE-2025-1568?

CVE-2025-1568 is an access control vulnerability that allows an attacker to exploit the Gerrit project configuration.

Can CVE-2025-1568 lead to remote code execution?

Yes, CVE-2025-1568 can potentially allow an attacker to perform remote code execution on affected systems.