CVE-2025-1292

6.7 mediumEPSS 0.2%

Medium (6.7) in google chrome. EPSS 0.2% chance of exploitation in the next 30 days.

Out-Of-Bounds Write in TPM2 Reference Library in Google ChromeOS 122.0.6261.132 stable on Cr50 Boards allows an attacker with root access to gain persistence and bypass operating system verification via exploiting the NV_Read functionality during the Challenge-Response process.

Severity

CVSS 3.1

6.7 medium

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.2% chance of exploitation in the next 30 days; higher than 8% of CVEs (scores of 2026-10-31)
CWE: CWE-787
Published: 2025-04-15
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

google:chrome

References

https://issues.chromium.org/issues/b/324336238
https://issuetracker.google.com/issues/324336238

Check your stack JSON