CVE-2025-48543
CVE-2025-48543 is a security flaw in Android Runtime, Google’s operating system for phones and tablets. Someone who already has a foothold can use Android Runtime to take full control of the machine. The US Cybersecurity and Infrastructure Security Agency (CISA) added it to its catalog of flaws known to be used in attacks on 4 Sep 2025.[1]
Android Runtime is in things households have, such as phones, computers, browsers and everyday apps, so the fix matters at home as much as at work. Android has published a fix or advice.
Description
CISA calls it an use-after-free in Android Runtime. In its words: “Android Runtime contains a use-after-free vulnerability potentially allowing a chrome sandbox escape leading to local privilege escalation.”[1]
The CVE record adds: “In multiple locations, there is a possible way to escape chrome sandbox to attack android system_server due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.”[2]
The underlying weakness is use after free (CWE-416), in MITRE’s list of common software weaknesses.
It scores 8.8 out of 10 on the Common Vulnerability Scoring System, which rates it high, scored by the organisation that published the CVE using CVSS 3.1.[2]
Affected versions
NVD’s record doesn’t list version ranges for it; Android’s advisory has them[3]. CISA names the product as Android Runtime.
Every device with Android Runtime needs the update.
Exploitation
CISA added it to its catalog of known exploited vulnerabilities on 4 Sep 2025, within a day of it being made public. CISA lists a flaw only when it has reliable evidence of it being exploited, and gave US federal agencies until 25 Sep 2025 to fix it.[1]
FIRST’s Exploit Prediction Scoring System, which estimates how likely a flaw is to be used in attacks in the next 30 days from what it sees across the internet, puts it at under 1%. That’s in the top 50% of the flaws it scores.[4]
CISA assesses it as not automatable: each attack takes some work.
CISA doesn’t say who was attacked, or how.
Fix
Android has published a fix or advice.[3] CISA’s required action: “Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.”[1]
- Update Android Runtime now.On Android: Settings, then System or Software update. Phones only get these fixes while their maker still supports them. Then turn on automatic updates, so the next fix arrives on its own.
- If there’s no update, stop using it.CISA’s advice when a flaw being used in attacks has no fix is to stop using the product until it does.
Timeline
| Date | Event |
|---|---|
| The flaw is made public in the National Vulnerability Database, with a severity score of 8.8.[2] | |
| CISA adds it to its catalog of flaws known to be used in attacks.[1] | |
| CISA’s deadline for US government agencies to fix it.[1] | |
| FIRST puts the odds of it being used in attacks in the next 30 days at under 1%.[4] |
See also
Other Android flaws
- CVE-2025-48595, Android Framework: integer overflow ·
- CVE-2025-48633, Android Framework: information disclosure ·
- CVE-2025-48572, Android Framework: privilege escalation ·
- CVE-2024-43093, Android Framework: privilege escalation ·
- CVE-2024-36971, Android Kernel: remote code execution ·
Other use after free flaws
- CVE-2026-109619, PHP: stale internal request-state ·
- CVE-2026-109618, PHP: memory corruption ·
- CVE-2026-68820, Microsoft Windows Ancillary Function Driver for WinSock: use-after-free ·
- CVE-2010-0249, Microsoft Internet Explorer: use-after-free ·
- CVE-2020-9715, Adobe Acrobat: use-after-free ·
Added the same day
- CVE-2025-53690, Sitecore products: deserialization of untrusted data ·
- CVE-2025-38352, Linux Kernel: time-of-check time-of-use (TOCTOU) race condition ·
Every Android flaw on CISA’s list · Everything added in September 2025
References
- ^ Cybersecurity and Infrastructure Security Agency. “Android Runtime Use-After-Free Vulnerability”. Known Exploited Vulnerabilities Catalog, added 4 Sep 2025.
- ^ National Institute of Standards and Technology. “CVE-2025-48543 Detail”. National Vulnerability Database, published 4 Sep 2025.
- ^ Android. Advisories and fixes: source.android.com, android.googlesource.com, source.android.com.
- ^ FIRST. “Exploit Prediction Scoring System”. EPSS 0.006, percentile 50.4, 31 Oct 2026.
- CVE Program. “CVE-2025-48543”. The official CVE record.
This article is built from CISA’s catalog (version 2026.10.30), NVD’s record and FIRST’s scores, kept in HARD’s database and checked every morning. The plain English is HARD’s.