CVE-2025-48543

HIGH
2025-09-04 [email protected]
8.8
CVSS 3.1
Share

CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

4
Analysis Generated
Mar 28, 2026 - 19:10 vuln.today
Patch Released
Mar 28, 2026 - 19:10 nvd
Patch available
Added to CISA KEV
Oct 23, 2025 - 14:52 cisa
CISA KEV
CVE Published
Sep 04, 2025 - 19:15 nvd
HIGH 8.8

Tags

Memory Corruption Google Use After Free Denial Of Service Privilege Escalation Android Chrome

Description

In multiple locations, there is a possible way to escape chrome sandbox to attack android system_server due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Analysis

Android Chrome sandbox contains a use-after-free enabling sandbox escape and local privilege escalation to attack the Android system_server process.

Technical Context

The CWE-416 use-after-free allows escaping Chrome's sandbox on Android to execute code as the system_server process, which has broad system privileges.

Affected Products

['Android (affected versions)']

Remediation

Apply Android security updates. Ensure Chrome is updated to the latest version.

Priority Score

94
Low Medium High Critical
KEV: +50
EPSS: +0.3
CVSS: +44
POC: 0

Share

CVE-2025-48543 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy