Back to CVE Browser

CVE-2025-48543

🔥 Known Exploited (CISA KEV)HIGH

8.8

CVSS Severity Score

EPSS Score0.0000%

EPSS Percentile0.00th

Published2025-09-04

Last Modified2026-06-17

Data SourcesNVDCISA KEV

Vulnerability Description

In multiple locations, there is a possible way to escape chrome sandbox to attack android system_server due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Affected Platforms (CPE)

💻

Google

Android

= 13.0= 14.0= 15.0= 16.0

References & Advisories

🔗 https://android.googlesource.com/platform/art/+/444fc40dfb04d2ec5f74c443ed3a4dd45d3131f2

🔗 https://source.android.com/security/bulletin/2025-09-01

🔗 https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-48543

Related Security Intelligence Articles

Global Cyber Intel Digest: July 24, 2026

This digest covers active exploitation of Check Point CVE-2026-16232 SmartConsole authentication bypass, Russian LAUNDRY BEAR targeting Zimbra vulnerabilities, malicious Claude Desktop ad campaigns deploying SectopRAT, and Chaos ransomware msaRAT operations.

Global Cyber Intel Digest: July 23, 2026

Key threat updates including CISA's KEV addition of Langflow CVE-2026-0770 remote code execution, unauthenticated path traversal in Windmill CVE-2026-29059, and ongoing incident response guidance for SonicWall SMA1000 zero-day exposures.

Global Cyber Intel Digest: July 20, 2026

Technical analysis of zero-day exploit chains against SonicWall SMA1000 appliances (UTA0533), NGINX regular expression heap corruption vulnerabilities (CVE-2026-42533), and Sandworm's (UAC-0145) ClickFix fake CAPTCHA campaigns.

Related Vulnerabilities

CVE-2026-164047.4

Spoofing issue in Firefox for Android. This vulnerability was fixed in Firefox 153.

CVE-2026-163976.5

Clickjacking issue in the WebExtensions component in Firefox for Android. This vulnerability was fixed in Firefox 153.

CVE-2026-163737.5

Information disclosure in the Privacy component in Firefox for Android. This vulnerability was fixed in Firefox 153.

CVE-2026-159009.6

Use after free in GPU in Google Chrome on Android prior to 150.0.7871.128 allowed a remote attacker to potentially perform a sandb...

CVE-2025-48543 Detail & Impact Analysis | CVSS 8.8 (HIGH) | Cyber-Sec.Space | Cyber-Sec.Space