CISA Issues Alert on Android 0-Day Use-After-Free Vulnerability Under Active Exploitation

According to CISA, a newly discovered zero-day in the Android Runtime component is a use-after-free flaw that could allow attackers to escape the Chrome sandbox and achieve local privilege escalation on affected devices. The agency warns the vulnerability is under active exploitation and urges organisations and users to apply mitigations promptly. CISA added the flaw to its Known Exploited Vulnerabilities catalog on 4 September 2025 and set a due date of 25 September 2025 for applying available mitigations.

The CVE reference for this issue is CVE-2025-48543, with the description noting the potential to break out of the Chrome sandbox and gain higher device privileges. Mitigations include vendor patches, configuration hardening guidance, and, where no fix exists, discontinuing use of the affected product until a patch is available.

While it is not known whether the flaw has been used in ransomware attacks, the alert emphasises the urgency of proactive patching and adherence to security directives to prevent unauthorized access, data theft, or service disruption.