CVE-2025-48543
Android Runtime Use-After-Free Vulnerability
Description
CVE-2025-48543 is a high-severity use-after-free vulnerability in the Android Runtime that enables a local attacker to escape the Chrome sandbox and attack the Android system_server process. The vulnerability exists in multiple locations within the Android operating system and affects Android versions 13.0, 14.0, 15.0, and 16.0. Successful exploitation leads to local escalation of privilege with no additional execution privileges needed and no user interaction required. With a CVSS v3.1 base score of 8.8 and a changed scope, this vulnerability allows privilege escalation from a compromised app or browser renderer process to system-level access. CISA has added CVE-2025-48543 to the Known Exploited Vulnerabilities catalog with a remediation deadline of September 25, 2025, and its EPSS score of 0.29% at the 52nd percentile indicates targeted exploitation activity.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| android | 13.0; 14.0; 15.0; 16.0 |
References
- https://android.googlesource.com/platform/art/+/444fc40dfb04d2ec5f74c443ed3a4dd45d3131f2(Patch, Product)
- https://source.android.com/security/bulletin/2025-09-01(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-48543(Third Party Advisory, US Government Resource)
Weakness Type
CWE-416: Use After Free
CVE-2025-48543 is classified under CWE-416 (Use After Free), a weakness where the software continues to reference memory after it has been freed. In the Android Runtime, a use-after-free condition allows an attacker operating within the Chrome sandbox to reference freed memory objects in a way that enables escape from the sandbox and escalation of privileges to the system_server process, which controls core Android system services.
Learn more: CWE-416 — Use After Free
Impact Analysis
CVE-2025-48543 carries a CVSS v3.1 base score of 8.8 (High severity) with a changed scope (S:C), indicating that exploitation of the Android Runtime vulnerability allows an attacker to break out of the Chrome sandbox and compromise the system_server — a highly privileged Android process. The attack requires local access (AV:L) with low attack complexity (AC:L) and low privileges (PR:L), with no user interaction needed (UI:N). Confidentiality and integrity both face high impact because gaining system_server access grants the attacker control over core Android services including account management, notification handling, activity management, and permission enforcement. Availability also faces high impact as the attacker can disrupt or disable system services. The vulnerability is particularly dangerous because it can be chained with a browser exploit — an attacker who first compromises the Chrome renderer through a web-based vulnerability can then use CVE-2025-48543 to escape the sandbox and achieve system-level access on the Android device. This affects Android versions 13 through 16, covering the vast majority of actively used Android devices.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2025-48543 by adding it to the Known Exploited Vulnerabilities catalog, indicating that threat actors are using this Android Runtime use-after-free vulnerability in real-world attacks. The EPSS score of 0.29% at the 52nd percentile suggests that exploitation is currently targeted rather than widespread, consistent with the pattern of mobile exploitation where sophisticated actors use sandbox escape vulnerabilities in spear-phishing campaigns or targeted surveillance operations. No public exploit code has been tagged in the available references, and the ransomware association is classified as unknown. Google addressed this vulnerability in the September 2025 Android Security Bulletin with a patch to the Android Runtime. The combination of sandbox escape capability and KEV catalog inclusion suggests this vulnerability may be part of an exploit chain used in targeted mobile attacks.
Remediation
-
Apply the September 2025 Android security patch (security patch level 2025-09-01 or later) on all affected devices. For enterprise-managed devices, push the update through your MDM solution. The patch is available in the Android Security Bulletin.
-
Prioritize devices running Android 13 through 16 for immediate patching, as all four major versions are confirmed vulnerable. Work with device manufacturers (Samsung, Google Pixel, etc.) to ensure OEM-specific patches are available and deployed.
-
Enforce automatic security updates on managed Android devices through enterprise MDM policies. Configure devices to install security updates automatically and set compliance policies that flag or restrict devices that fall behind on patches.
-
Implement mobile threat defense (MTD) solutions that can detect exploitation attempts, including sandbox escape behaviors, unusual privilege escalation patterns, and indicators of compromise associated with Android Runtime exploitation.
-
Advise users to avoid untrusted websites and applications while devices remain unpatched, since the vulnerability can be triggered through Chrome sandbox escape. Deploying web content filtering on managed devices provides an additional layer of protection against malicious web pages that might deliver the initial browser exploit.
Technical Details
CVE-2025-48543 is a use-after-free vulnerability (CWE-416) in the Android Runtime affecting Android versions 13.0, 14.0, 15.0, and 16.0. The CVSS v3.1 vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H reflects a local attack with low complexity and a changed scope, enabling sandbox escape. The vulnerability exists in multiple locations within the Android Runtime where memory is freed but references to the freed objects remain accessible. An attacker operating within the Chrome browser sandbox — which runs as a low-privileged process — can trigger the use-after-free condition to manipulate memory in a way that allows escape from the renderer sandbox and interaction with the system_server process. The system_server is one of the most privileged processes in Android, responsible for managing core system services including activity management, package management, and window management. By corrupting freed memory objects and replacing them with attacker-controlled data, the attacker can hijack execution flow within the Android Runtime to gain system_server-level privileges. The patch addresses the use-after-free by ensuring proper lifetime management of the affected objects.
Frequently Asked Questions
Is CVE-2025-48543 being actively exploited?
Yes. CISA has confirmed active exploitation by adding CVE-2025-48543 to the KEV catalog. The targeted nature of the exploitation, consistent with mobile device attack patterns, suggests use in sophisticated campaigns rather than mass exploitation.
What products are affected by CVE-2025-48543?
Google Android versions 13.0, 14.0, 15.0, and 16.0 are affected. The vulnerability is in the Android Runtime component, and the specific exploitation path involves escaping the Chrome browser sandbox to attack the system_server process.
How do I fix CVE-2025-48543?
Apply the September 2025 Android security update (patch level 2025-09-01 or later). For managed devices, deploy the update through your MDM solution. Contact your device manufacturer for OEM-specific patch availability.
How severe is CVE-2025-48543?
CVE-2025-48543 has a CVSS v3.1 base score of 8.8 (High) with a changed scope. The use-after-free enables Chrome sandbox escape and escalation to system_server privileges, effectively granting an attacker control over core Android system services on the compromised device.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.