A kiosk session is a locked-down device mode that starts a single approved app or workflow and hides most of the normal operating system. On ChromeOS and similar platforms, it is used for shared terminals, sign-in stations, point-of-sale devices, and other purpose-built endpoints.
From a security perspective, kiosk mode reduces the attack surface by limiting user choices, blocking access to settings, and often disabling local storage, shell access, and unrelated browser features. That helps defenders enforce least privilege and keep a public or semi-trusted device aligned with a narrow task. It also simplifies monitoring, because unexpected behavior is easier to detect when only one workflow should exist.
Attackers may try to escape a kiosk session by abusing misconfigurations, exploiting browser or OS bugs, or pivoting through allowed apps and integrations. For defenders, the main risk is not just malware but operational drift: if policies, updates, or permitted apps are not tightly controlled, the kiosk can become a normal desktop in disguise.