Introduction
Attackers have exploited a use-after-free flaw in Android Runtime to escape Chrome's sandbox and compromise the system_server process on Android devices. The vulnerability has been observed in real-world targeted attacks and affects a broad range of Android versions, so both enterprises and individuals should treat patching as a priority.
Android is the most widely deployed mobile operating system globally, with billions of active devices. Its security model relies on process isolation, sandboxing, and a managed runtime (ART) that executes Java and Kotlin code. The system_server process is a privileged component responsible for core system services. Compromising it can lead to full device control.
Technical Information
CVE-2025-48543 is a use-after-free vulnerability (CWE-416) in the Android Runtime (ART) component. ART is the managed runtime environment that executes Java and Kotlin applications. The vulnerability comes from improper memory management in ART, specifically in how it handles object lifecycles. When an object is freed but is still referenced elsewhere, the reference becomes a dangling pointer. An attacker who manipulates the freed memory region before it is reused can inject malicious data or code.
In the main exploitation path, a malicious process (often originating from a compromised Chrome renderer) escapes its sandbox by targeting the ART use-after-free flaw. Once the attacker controls the freed memory, they can escalate privileges and execute code in the context of the highly privileged system_server process. From there, they can disable security controls, access sensitive data, or install persistent malware, among other actions. Exploitation does not require user interaction, which raises the risk of silent compromise.
The vulnerability is actively exploited in the wild. Google's Threat Analysis Group has observed targeted attacks that chain Chrome renderer exploits with this ART flaw for full device takeover. The root cause is that ART fails to manage object references properly, which leaves exploitable dangling pointers.
As of the September 2025 disclosure, no public code snippets or proof-of-concept exploit code have been released.
Patch Information
Google addressed CVE-2025-48543 in the Android Runtime (ART) component in the September 2025 Android Security Bulletin. The vulnerability affects Android versions 13 through 16. The patch strengthens security checks in ART to prevent unauthorized privilege escalation. Google distributes the fix through Google Play system updates, so devices with Google Mobile Services (GMS) receive protection promptly, even outside regular over-the-air updates.
Reference patch sources:
- https://source.android.com/docs/security/bulletin/2025-09-01
- https://thecyberexpress.com/cve-2025-48543-and-cve-2025-38352/
Affected Systems and Versions
- Android 13 (all releases)
- Android 14 (all releases)
- Android 15 (all releases)
- Android 16 (all releases)
Any configuration that uses the Android Runtime (ART) component is vulnerable if it runs one of these versions and has not been updated to the September 2025 patch level (2025-09-01 or later).
Vendor Security History
Google has previously fixed similar privilege escalation and sandbox escape vulnerabilities in Android system components, including the kernel and media framework. The Android Security team typically releases coordinated monthly security bulletins and distributes patches through Google Play system updates for supported devices. Ecosystem fragmentation can still delay patch delivery for some device models. Google's Threat Analysis Group has a track record of identifying and disclosing actively exploited vulnerabilities, which reflects a mature security response process.
