Skiovox: Kiosk App Breakout via File Manager

Kiosk mode locks a Chromebook into running a single application — typically a testing tool such as SecureTestBrowser, TestNav, or NWEA — with no way to switch windows, access the browser, or install extensions. Skiovox exploits a bug in how kiosk apps handle network errors: by disconnecting from Wi-Fi before launching a kiosk app, you can trigger an error screen that contains a Certificates, Diagnose, or accessibility button. Clicking through those buttons opens the ChromeOS File Manager, and from there you can open a full Chrome browser window in the kiosk’s unmanaged profile. Within that browser you can install extensions, access any website, and bypass virtually all school-imposed restrictions. Use CAUB to stay on a version where Skiovox works.

Version Compatibility

Version Range	Status
v118	Supported
v119–v120	Supported
v121	Supported
v124	Supported
v125–v126	Supported
v138–v144	Supported (currently works on v144)
v141	Separate method available

Use CAUB to prevent automatic ChromeOS updates and stay on a version where Skiovox works. CAUB works from v85 to v127; for v128+ use CAUB Flags, CAUB on Fentanyl, or DAUB.

Version-Specific Instructions

Skiovox v118

Notes:

A compatible kiosk application is required. Some kiosk apps will not work with this exploit.
Kiosk apps have their own profiles — this exploit browses using the kiosk profile.
Your Chromebook must be connected to Wi-Fi before you begin, and you will disconnect during the process.

Credits: AkaButNice, Bypassi#7037, AshtonDavies

Disconnect from Wi-Fi

On the sign-in screen, disconnect from your network.

Pre-enter your password (if applicable)

If usernames and photos are shown on the sign-in screen, enter your password but do not press Enter. Otherwise skip this step.

Launch a kiosk application

Launch one of your organisation’s kiosk applications from the apps menu.

Press Alt + Shift + S

Immediately press Alt + Shift + S. A toolbar should appear.

Wait for Network Unavailable

Wait for the Network Unavailable screen to appear.

Open Accessibility menu

In the toolbar, open the Accessibility menu and click the ? (question mark) button. A network error page should appear.

If a back button is available on the error page:

Click Add other Wi-Fi network

Click Add other Wi-Fi network, then immediately spam Esc twice. The sign-in screen should appear with your password still entered.

Press Enter to sign in

Press Enter to sign in. Do this within 4 seconds of clicking “Add other Wi-Fi network.”

Bypass the multiple sign-in message

If a Multiple sign-in has been disabled message appears, press Esc to bypass it.

Close the organisation window

If there is a window registered to your organisation’s profile, close it. There should be a clean window behind it. Open a new window from the current one — the new window will be less bugged.

If a back button is NOT available:

Click Diagnose

Click the Diagnose button. A diagnostics window should open (possibly invisibly).

Click Add other Wi-Fi network

Click Add other Wi-Fi network and wait for the diagnostics screen to appear. This step may be inconsistent — try a few times or try a different kiosk app.

Open in Settings

Expand the Wi-Fi dropdown, then click Open in Settings. A settings window should open.

Close the settings window

Close the settings window. A browsing window should become focused.

If a back button is NOT available (ChromeVox method):

Click Add other Wi-Fi network

Click Add other Wi-Fi network, then wait until the kiosk app loads.

Enable ChromeVox

Press Ctrl + Alt + Z to enable ChromeVox text-to-speech. A sound may play.

Open Resources

While holding Search, press O, then press T. Select Resources. Three links should appear.

Click a link to open Chrome

Click any of the three links. A Chrome window should open.

Disable ChromeVox

Press Ctrl + Alt + Z to disable ChromeVox.

Once inside a browser window, proceed to Skiovox Helper.

Skiovox v119–v120

Notes:

A compatible kiosk application is required.
Your Chromebook must be connected to Wi-Fi before you begin.

Credits: AkaButNice, Bypassi#7037, AshtonDavies

Disconnect from Wi-Fi

On the sign-in screen, disconnect from your network.

Pre-enter your password (if applicable)

If usernames and photos are shown, enter your password but do not press Enter.

Launch a kiosk application

Launch one of your organisation’s kiosk applications from the apps menu.

Press Alt + Shift + S

Immediately press Alt + Shift + S. A toolbar should appear.

Wait for Network Unavailable

Wait for the Network Unavailable screen to appear.

Open display settings

In the toolbar, show the display settings menu by clicking the button next to the brightness slider, then click the settings button to open the settings app.

Enable ChromeVox

Press Ctrl + Alt + Z to enable ChromeVox. A sound may play.

Open Resources

Select Resources. Three links should appear. Click any one of them — Chrome should open.

Disable ChromeVox

Press Ctrl + Alt + Z to disable ChromeVox.

Click Sign in as an existing user. Attempt to sign in — a Multiple sign-in has been disabled message should appear. Press Esc to bypass it. A browsing window should be focused.

Clean up the windows

Close the focused browsing window. Navigate to chrome://os-settings in the open settings window and reconnect to your network. Close the settings window — a browsing window should be focused. Open a new window from the Chrome panel and close the other browsing window.

Once inside a browser window, proceed to Skiovox Helper.

Skiovox v121

Notes:

This only works if your Gmail is saved to your Chromebook (your profile picture appears on the sign-in screen and you only need to type your password).

Credits: Brandon421-ops/Exploits-And-Hacks

Sign out

Sign out of your account.

Type your password (do not press Enter)

Enter your password on the sign-in screen but do not press Enter.

Open reset prompt

Press Esc + Shift + Alt + R, then click Cancel — do not powerwash.

Perform standard Skiovox

Turn off Wi-Fi, launch the kiosk app, press Alt + Shift + S, and navigate to Accessibility → question mark.

Rapid sequence (must be fast)

Click Add Wi-Fi then spam Esc. Then click Add other person and spam Esc.

Skiovox v124

Credits: eth3r.xyz/skiovox124 / Titanium Network

Sign out and turn off Wi-Fi

Sign out and turn off your Wi-Fi.

Handle missing 'Log in as existing user'

If the network unavailable page does not show Log in as existing user, click Add person and hold Esc.

Open the kiosk app

Click Apps and open your kiosk app of choice. Wait for the network page to show.

Rapid sequence (must be fast)

Click Add network, type random letters, and hit Enter. Then click Diagnose.

Open in Settings

Click Wi-Fi, then click Open in Settings. Click the close button (X) at the top right to go back to the Wi-Fi page.

Click Sign in as existing user (it should now be visible). Sign in.

Close the school window

Close the school window in the top right — there should be an unblocked Skiovox container page behind it.

Skiovox v125–v126

Requirements:

ChromeOS v125 or v126
An account saved on the device (Method 1)
External login page, if available (Method 2)

Credits: Con (.congaming), unknown-user (s0urce-c0de) / Titanium Network / Hack Hive — skiovox125.vercel.appMethod 1:

Go to the sign-in screen

Make sure you have an account saved on your device. Go to the sign-in screen and open Quick Settings.

Tab to the Wi-Fi toggle

Press Tab until focus lands on the Wi-Fi toggle.

Disable Wi-Fi and open the kiosk app

Hover your mouse over the Apps button and press Enter. This disables Wi-Fi. Before it reaches the no-Wi-Fi screen, press Apps (the search/launcher key), then press the key corresponding to your kiosk app (e.g. S for SecureTestBrowser). Do this very quickly.

Wait and then reset

Wait approximately 2 seconds (or until it says Waiting for app window), then press Ctrl + Alt + Shift + R and click Cancel.

Click Add other Wi-Fi, type random letters, press Enter, and click Sign in as existing.

Enter credentials and trigger the shortcut

Enter your username and password. Immediately after pressing Enter on the password, press Ctrl + Search + Esc.

Open Help Center

Go to Keyboard test, then click Help Center.

Method 2 (Legacy — requires external login page):

Enter credentials on the external login page

Enter your email and password on the external login page.

Watch for the launch moment

After pressing Enter, you will see a small spinning circle for approximately 0.5 seconds. Wait for the kiosk app to start launching.

Press the shortcut

Press Ctrl + Search + Esc.

Wait for Chrome browser

If the managed Chrome browser does not appear, restart from Step 1 and adjust your timing.

Navigate to Help Center

Press the keyboard icon to start the keyboard test, select the built-in keyboard test, then click Help Center and close any popups.

Common issues:

“I don’t have a Help Center button!” — Wait 2+ seconds after Step 3 before proceeding.
“My kiosk app loads normally!” — Adjust your timing on the launch step.

Skiovox v138–v144 (currently works on v144)

Credits: 2pro12342 (open file manager and Method 2), schoolexploitkid (open browser)Method 1:

Turn off Wi-Fi and sign out

Turn off your Wi-Fi, then sign out.

Launch a kiosk app

Ensure Wi-Fi is still off and go to any kiosk app.

Click Certificates

When it says Internet Not Found, click the Certificates button next to Diagnose. A menu should open. If it crashes or doesn’t open, try Method 2.

Open File Manager

Find the Import, Export, or Download button in the certificates menu. Clicking it should open the File Manager.

Method 2 (Wi-Fi/DNS approach — use if Method 1 does not work):

Sign out and powerwash

Sign out, then powerwash with Ctrl + Shift + Alt + R and confirm.

Handle the Get Started screen

If kiosk apps are visible on the Get Started screen (Path A): Click Get Started, click Add Wi-Fi, and enroll until you see kiosk apps.
If kiosk apps are NOT visible (Path B): Do not click Get Started. Instead, go to the Wi-Fi panel and connect to your Wi-Fi.

Change DNS to block network

Once connected, change the DNS to 0.0.0.0 or 52.207.185.90. This should produce a Wi-Fi Network Error or No Network Connection with a ! icon.

Launch a kiosk app

Go to any kiosk app.

Click Certificates and open File Manager

When it says Internet Not Found, click Certificates next to Diagnose. Find the Import, Export, or Download button to open File Manager.

Skiovox v141 (Website Kiosk Method)

This method targets website kiosks (kiosk apps that display a URL in the address bar while loading) rather than packaged app kiosks.Link: https://skiovox141.crosbreaker.dev/openCredits: crosbreaker — crosbreaker.dev / github.com/crosbreaker/skiovox-141

Find a website kiosk

Find a website kiosk that shows the URL while it is loading.

Navigate to a search engine

Find a way to navigate away from the main page and reach a search engine like Google.

Copy the injection HTML

In a text field (such as the search bar), copy the following snippet to your clipboard:

<script>window.open("javascript:alert();");</script>

Open a real-time HTML editor

Navigate to https://htmledit.squarefree.com/.

Paste the HTML

Paste the HTML snippet you copied. A Chrome window should open as a result.

File Manager Methods

Once you reach the ChromeOS File Manager through Skiovox (v138–v144), you need to open a browser window from within it. Two methods are available — try both and use whichever works.

File Manager Method 1 — New Folder

Right-click in the blank area

Right-click in the large blank area of the File Manager.

Create a new folder

Click New Folder.

Click the new folder

Click on the newly created folder to open it.

Open it in a browser window

Click the three-dots icon at the top right, then click the Open button (a square with an arrow icon).

File Manager Method 2 — Open File Settings (Recommended)

Click the three-dots icon

Click the three-dots icon at the top right of the File Manager.

Click Open File Settings

Click Open File Settings. A Settings window should appear.

Open a Chrome window

Press Ctrl + T to open a new Chrome window or click a popup link in the Settings app.

Skiovox Helper

After performing Skiovox, most keyboard shortcuts do not work, windows cannot be easily resized or moved, and adding Google accounts is difficult. Skiovox Helper is an extension that restores this functionality. It only needs to be set up once per device. Features:

Restores most keyboard shortcut functionality within the exploit
Allows resizing and dragging of windows
Makes it easier to add Google accounts and use the Chrome Web Store
Fixes functionality of some Google logins on webpages
Shows time, date, and battery status
Press Ctrl + T after shortcuts are configured to exit fullscreen

Credits: bypassi / github.com/bypassiwastaken/skiovox-helper

Download Skiovox Helper

Download Skiovox Helper from https://github.com/bypassiwastaken/skiovox-helper/releases. If you followed the back-button method, disable Ask where to save each file in browser settings before downloading.

Enable Developer Mode

Navigate to chrome://extensions and flip the Developer Mode switch on.

Load unpacked

Click Load unpacked. A file prompt will open.

Extract and open the folder

Find the downloaded Skiovox Helper ZIP file. Right-click → Extract all. Open the extracted folder. Select the file inside and click Open. Skiovox Helper should install and automatically open the keyboard shortcuts page.

Configure shortcuts

In each shortcut input field, press the keys shown in the placeholder to add emulated keyboard shortcuts.

You can install extensions from within Skiovox by visiting the New Tab page and clicking the Extensions icon.

Skiovox Breakout

Skiovox Breakout takes the Skiovox exploit further by allowing you to inject custom JavaScript into an installed extension, enabling persistent code execution that survives a reboot. Credits: munyDev / github.com/munyDev/skiovox-breakout

Get into Skiovox and install Helper

Perform Skiovox normally and install Skiovox Helper.

Download Skiovox Breakout

Navigate to https://github.com/munyDev/skiovox-breakout/. Click Code → Download ZIP (you can use the CSS or main branch).

Install the extension in dev mode

Go to chrome://extensions, enable Developer Mode, click Load unpacked, and load the downloaded extension folder.

Inject a script

Click the Skiovox Breakout extension icon. In the first input box, type the first 5 letters of the target extension ID. In the second box, enter your custom JavaScript or clear the box entirely.

Start injection

Click Start injection.

Open the injected file

Open any file (e.g. *.html) — a school window should open. Open the extension page and press any switch (or open background.js if no switches are present).

Bookmark the shim URL

Copy the URL filesystem:chrome-extension://ID_HERE/temporary/shim.html and make it a bookmark.

Reboot and use the bookmark

Reboot and log in normally. Right-click the bookmark and open it in a new tab — you now have a persistent arbitrary code executor.

ASH (Skiovox Downloaded to USB)

ASH is a method for making Skiovox persistent on a Chromebook by loading the Skiovox Helper extension from a USB drive rather than downloading it each time. It also enables a “hotswapping” technique to quickly switch between the kiosk profile and your school account. Requirements: ChromeOS v119–v120 (v121 may not work), a USB drive, and a kiosk app. Credits: Brandon421-ops/Exploits-And-Hacks

Perform Skiovox normally

Hold the power button to sign out. Turn off Wi-Fi, open the kiosk app, press Alt + Shift + S, click the ? in the panel, sign in as an existing user, bypass the multiple sign-in message with Esc, and close the school window.

Set startup pages

In chrome://settings → On startup, select Open a specific page or set of pages and add:

chrome://os-settings
chrome://file-manager

Set up persistence across reboots

Restart by holding the power button and selecting Sign out all. Repeat the Skiovox steps. After closing the default school window, you should see the OS settings and can toggle Wi-Fi back on.

Load Skiovox Helper from USB

Download the Skiovox Helper files from github.com/bypassiwastaken/skiovox-helper and put them on a USB drive. After performing Skiovox again, open the File Manager tab, right-click the ZIP file → Extract. Drag the extracted folder to Downloads.

Install via dev mode

Open a new window (three-dots menu), go to chrome://extensions, enable Developer Mode, click Load Unpacked, and select the inner folder in Downloads. Click Open.

Accept the new tab page alert

Open a new tab and accept Chrome’s alert about the new tab page extension.

Hotswapping (switching between the kiosk and school account):

Go to Pixlr and click Create new.
Once the editor opens, press Ctrl + S then Save as.
Name the file anything but remove the .png extension.
Open a new tab, go to Files, and double-click the file — this opens the school account window.
To swap back, delete the school account window.

Known issues:

Skiovox deleting itself from extensions (manifest): delete the current Skiovox file from Downloads, pull the file from the USB drive back into Downloads, and re-link it.
Esc not working to bypass the multiple sign-in message: no fix currently.

Unrestricted Browsing via Skiovox

Within the Skiovox kiosk browser window:

You can install extensions from the Chrome Web Store
You can bypass virtually all school-imposed web filters and DNS blocks
The browsing session uses the kiosk app’s unmanaged profile

Reference links (Bypassi’s slideshows with full visual instructions):

https://chrose.netlify.app/detail/skiovox/
https://www.skiovox.com/skiovox.pdf
https://skiovox.netlify.app/skiovox.pdf
https://drive.google.com/file/d/1tl8eP26MFRejHO38H5HwMLl2VaQrtn0Z/preview

Credits: bypassi / github.com/bypassiwastaken

Skebstore

Skebstore is a minimal alternative extension installer for Skiovox users whose Chrome Web Store (chromewebstore.google.com) is blocked by the school network. Credits: bypassi / github.com/bypassiwastaken/skebstore

KIOSK Exploit (up to v85)

The original kiosk exploit. Opens an unrestricted Chrome instance within a kiosk app using the ChromeVox accessibility shortcut. Works consistently on v76 and below; possible but less consistent on v77–v85 (only once per powerwash). Credits: B3AT, Divide, Luphoria, OlyB / Titanium Network Method 1 (v77–v85, requires fresh install/OOBE):

Sign out, turn off Wi-Fi, enable ChromeVox

Sign out. Turn off Wi-Fi. Press Ctrl + Alt + Z to enable ChromeVox.

Open a kiosk app and spam the shortcut

Open a kiosk app, then spam Search + O + K (keep re-pressing O and K).

Click Diagnose while spamming

While spamming the shortcut, click the Diagnose button.

Method 2 (v76 and below, more consistent):

Recover or powerwash, do not sign in

Recover or powerwash the device and do not sign in.

Turn off Wi-Fi and open kiosk app

Turn off Wi-Fi. Open a kiosk app and wait for the error screen.

Enable ChromeVox and spam shortcut

Press Ctrl + Alt + Z to enable ChromeVox. Spam Search + O (hold Search, spam O).

Click Diagnose

While spamming, click Diagnose. Keep spamming until a browser window appears (up to 5 seconds).

Open a new tab and disable ChromeVox

Open a new tab, then press Ctrl + Alt + Z to disable ChromeVox.

Re-enable Wi-Fi if needed

Visit chrome://os-settings to turn Wi-Fi back on.

PowerR3SET — Unenroll via ChromeOS Flex (up to v131)

Unenrolls a Chromebook by flashing ChromeOS Flex (which has no forced re-enrollment support). Requires physically opening the Chromebook to disable write protection.

This exploit was patched on ChromeOS v132 due to auto-enrollment support on ChromeOS Flex. You will need to physically disassemble your Chromebook to disable write protection. Bricking is a risk. There will be no Google Play on ChromeOS Flex.

Get the Mr. Chromebox BIOS for your Chromebook model. Verify your board has UEFI Firmware (Full ROM) support.
Enter developer mode, then EC reset (hold Esc during power-on).
Use BR1CK to enter the firmware flashing environment.
Disable write protection (jump the WP chip, remove battery, or use a SUZY-Q cable).
On v117+, use Ctrl + Alt + F2 for VT2 and use chronos; on v116 and below use Crosh.

Run:

cd; curl -LOk mrchromebox.tech/firmware-util.sh && sudo bash firmware-util.sh

Download a ChromeOS Flex board image from chromiumdash.appspot.com/serving-builds, flash to USB, and boot from it.
Install ChromeOS Flex and sign in with a personal account.

Result: The device is unenrolled. Reset to switch between accounts. There is no forced re-enrollment on ChromeOS Flex. Credits: Scutoid / Hack Hive / BLACKOUT NETWORK

Dump Kiosk Apps

Extracts a kiosk app’s extension files and converts it into a regular ChromeOS app by removing the kiosk_only manifest key. Requirements: Crosh and Developer Mode enabled. Known kiosk app IDs:

App	Extension ID
TestNav	`mdmkkicfmmkgmpkmkdikhlbggogpicma`
SecureTestBrowser	`hblfbmjdaalalhifaajnnodlkiloengc`
NWEA	`omkghcboodpimaoimdkmigofhjcpmpeb`
CollegeBoard	`joaneffahikmmipmidpkeedopejmhbbm`

Enable dev mode and add accounts

Enable Developer Mode, then add your home account followed by your school account.

Open Crosh and run shell

Open Crosh (Ctrl + Alt + T) and run shell.

Find the kiosk app ID

Navigate to /home/chronos/{user account hash}/extentions/kiosk/ and note the ID of the kiosk app you want.

Copy to Downloads

cp /home/chronos/{user account hash}/extentions/kiosk/(app ID) /home/chronos/{user account ID hash}/Downloads/

Edit the manifest

Open the copied folder and edit manifest.json. Delete the line "kiosk_only": true.

Load as an extension

Go to chrome://extensions, enable Developer Mode, click Load Unpacked, and select the modified folder.

Credits: Titanium Network

Unblock Crosh (Ext. or Terminal)

If chrome-untrusted://crosh is blocked, use the Secure Shell extension to open a Crosh instance via chrome.terminalPrivate. Method 1 — Secure Shell extension:

Install the Secure Shell Dev extension.
In the username box, type anything.
In the hostname box, type >crosh.
Press Enter — a Crosh window will open.

Method 2 — Terminal app:

Open the Terminal app and create a new SSH profile.
Set the hostname to ssh a@>crosh.
Save the profile, right-click the Terminal app icon, and select your new SSH profile.

Direct extension URLs:

chrome-extension://algkcnfjnajfhgimadimbjhmpaeohhln/html/crosh.html   (dev version)
chrome-extension://iodihamcpbpeioajjeobimgagajmlibd/html/crosh.html    (non-dev version)

If neither works, downgrade to any version below v91. Credits: Kaitlin, OlyB / Titanium Network

Unblock Crosh (Kiosk Apps)

Uses the Skiovox limbo sign-in state to access Crosh when it is normally blocked.

This may be patched on newer ChromeOS versions due to changes introduced alongside Skiovox patches.

Sign out and turn off Wi-Fi

Sign out and turn off Wi-Fi.

Enter the kiosk limbo state

Sign in to a kiosk app and let it reach the Connect to Wi-Fi to continue screen. Click the Back button (top left). You should be at the sign-in screen without the Apps button.

Sign in to your school account. You should see a browser in the background and a prompt saying Administrator has disabled multiple sign-ins. Press Esc to bypass it.

Open Crosh

Navigate to chrome-untrusted://crosh in the address bar.

Credits: fallenmoon8080 / Titanium Network

Unblock Files (Android Files App)

Opens blocked HTML and other files in Chrome via the Android Files app, bypassing extension enforcement. See the full guide in the JS Runners page. Works on: ChromeOS v137–v141 (and potentially others). Credits: q8j.__ / Titanium Network

ChromeOS System Exploits

Extension & Policy Bypasses

Network & Access

Browser & Utility Tools

Skiovox: Kiosk App Breakout via File Manager

Version Compatibility

Version-Specific Instructions

File Manager Methods

Skiovox Helper

Skiovox Breakout

ASH (Skiovox Downloaded to USB)

Unrestricted Browsing via Skiovox

Skebstore

KIOSK Exploit (up to v85)

PowerR3SET — Unenroll via ChromeOS Flex (up to v131)

Dump Kiosk Apps

Unblock Crosh (Ext. or Terminal)

Unblock Crosh (Kiosk Apps)

Unblock Files (Android Files App)

Build docs developers (and LLMs) love

ChromeOS System Exploits

Extension & Policy Bypasses

Network & Access

Browser & Utility Tools

Documentation Index

​Version Compatibility

​Version-Specific Instructions

​File Manager Methods

​Skiovox Helper

​Skiovox Breakout

​ASH (Skiovox Downloaded to USB)

​Unrestricted Browsing via Skiovox

​Skebstore

​Other Kiosk-Related Exploits

​KIOSK Exploit (up to v85)

​PowerR3SET — Unenroll via ChromeOS Flex (up to v131)

​Dump Kiosk Apps

​Unblock Crosh (Ext. or Terminal)

​Unblock Crosh (Kiosk Apps)

​Unblock Files (Android Files App)

Build docs developers (and LLMs) love

Version Compatibility

Version-Specific Instructions

File Manager Methods

Skiovox Helper

Skiovox Breakout

ASH (Skiovox Downloaded to USB)

Unrestricted Browsing via Skiovox

Skebstore

Other Kiosk-Related Exploits

KIOSK Exploit (up to v85)

PowerR3SET — Unenroll via ChromeOS Flex (up to v131)

Dump Kiosk Apps

Unblock Crosh (Ext. or Terminal)

Unblock Crosh (Kiosk Apps)

Unblock Files (Android Files App)