Executive brief
A critical vulnerability in the Android operating system allows an attacker to bypass security protections designed to isolate web browsing activities. By exploiting this flaw, a malicious application or compromised web process can gain elevated system-level privileges, potentially taking full control of the device. This vulnerability has been observed being used in real-world attacks.
Technical details
A use-after-free (UAF) vulnerability exists within the Android Runtime (ART) across multiple locations. An attacker can leverage this flaw to escape the Chrome browser sandbox and target the 'system_server' process. The exploit requires no user interaction and no additional execution privileges, resulting in a local escalation of privilege (EoP). This vulnerability is tracked as CVE-2025-48543 and has been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. Google has released patches via the September 2025 Android Security Bulletin.
Affected products
- Google Android 13.0, 14.0, 15.0, 16.0
Timeline
- 2025-09-01: advisory: Vendor advisory published by Google in Android Security Bulletin
- 2025-09-04: disclosed: CVE published to NVD
- 2025-09-04: kev added: CISA added the vulnerability to the Known Exploited Vulnerabilities catalog