CISA Known Exploited Vulnerability (KEV)
Android Runtime Use-After-Free Vulnerability
September 4, 2025
September 25, 2025
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Description
In multiple locations, there is a possible way to escape chrome sandbox to attack android system_server due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
References
Weakness Enumeration
| CWE-ID | CWE Name |
|---|---|
|
CWE-416 |
Use After Free |