CVE-2025-48543
Published: 04 September 2025
Summary
CVE-2025-48543 is a high-severity Use After Free (CWE-416) vulnerability in Google Android. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked in the top 45.4% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-39 (Process Isolation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2025-48543 is a use-after-free vulnerability (CWE-416) present in multiple locations within the Android Runtime (ART) that permits escape from the Chrome sandbox to target the Android system_server process. The flaw affects Android devices and carries a CVSS 3.1 score of 8.8 reflecting local attack vector, low complexity, and high impact across confidentiality, integrity, and availability in a changed scope.
A local attacker who can execute code inside the Chrome sandbox can exploit the condition to achieve privilege escalation against system_server without requiring additional execution privileges or user interaction.
The September 2025 Android security bulletin and associated ART patches at the cited Google source repository address the issue through fixes that eliminate the use-after-free conditions. The vulnerability is also catalogued in CISA's known exploited vulnerabilities list, indicating confirmed real-world exploitation activity despite a current EPSS score of 0.0031.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-26791
Vulnerability details
In multiple locations, there is a possible way to escape chrome sandbox to attack android system_server due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not…
more
needed for exploitation.
- CWE(s)
- KEV Date Added
- 04 September 2025
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Use-after-free in ART enables local privilege escalation via Chrome sandbox escape to compromise system_server.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mandates timely remediation of known flaws like this use-after-free vulnerability through patching as specified in the Android Security Bulletin.
Implements memory protection mechanisms that defend against use-after-free exploits by preventing unauthorized memory access and code execution.
Enforces process isolation to strengthen sandbox boundaries, mitigating escapes from Chrome sandbox to system_server.