{"id":"CVE-2025-1566","state":"PUBLISHED","title":"DNS Leak in Native System VPN in Google ChromeOS Dev Channel on ChromeOS 16002.23.0 allows network observers to expose plaintext DNS queries via failure to properly tunnel DNS traf","description":"DNS Leak in Native System VPN in Google ChromeOS Dev Channel on ChromeOS 16002.23.0 allows network observers to expose plaintext DNS queries via failure to properly tunnel DNS traffic during VPN state transitions.","publishedAt":"2025-04-16T23:06:27.847Z","updatedAt":"2025-05-08T19:15:06.169Z","severity":{"score":7.5,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","source":"CISA-ADP"},"assigner":"ChromeOS","products":["Google ChromeOS"],"affected":[{"vendor":"Google","product":"ChromeOS","versions":[{"version":"16002.23.0","status":"affected","lessThan":"16002.23.0","versionType":"custom"}]}],"references":["https://issuetracker.google.com/issues/342802975","https://issues.chromium.org/issues/b/342802975"],"weaknesses":["CWE-1319"],"ingestedAt":"2026-10-29T20:08:39.238Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/1xxx/CVE-2025-1566.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2025-1566","state":"PUBLISHED","datePublished":"2025-04-16T23:06:27.847Z","dateUpdated":"2025-05-08T19:15:06.169Z","assignerShortName":"ChromeOS","assignerOrgId":"7f6e188d-c52a-4a19-8674-3c3fa7d1fc7f","dateReserved":"2025-02-21T21:30:53.937Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"DNS Leak in Native System VPN in Google ChromeOS Dev Channel on ChromeOS 16002.23.0 allows network observers to expose plaintext DNS queries via failure to properly tunnel DNS traffic during VPN state transitions."}],"affected":[{"vendor":"Google","product":"ChromeOS","versions":[{"version":"16002.23.0","status":"affected","lessThan":"16002.23.0","versionType":"custom"}]}],"references":[{"url":"https://issuetracker.google.com/issues/342802975"},{"url":"https://issues.chromium.org/issues/b/342802975"}],"problemTypes":[{"descriptions":[{"lang":"en","description":"Network Security Isolation (NSI)"}]}],"providerMetadata":{"shortName":"ChromeOS","orgId":"7f6e188d-c52a-4a19-8674-3c3fa7d1fc7f","dateUpdated":"2025-05-08T19:15:06.169Z"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}},{"other":{"type":"ssvc","content":{"timestamp":"2025-04-17T13:32:48.693962Z","id":"CVE-2025-1566","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-1319","type":"CWE","lang":"en","description":"CWE-1319 Improper Protection against Electromagnetic Fault Injection (EM-FI)"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-05-07T19:45:29.043Z"}}]}}}