Researchers demonstrate exploiting the Rowhammer hardware flaw from app with no special user permissions, rooting devices from LG, Motorola, Samsung, OnePlus
Permission-less apps take only seconds to root phones from LG, Samsung and Motorola. — Researchers have devised an attack …
Context & Ripple Effects
This demonstration lands mid-way through a brutal 2016 for Android's security model. Earlier in the year, researchers disclosed a nearly three-year-old privilege escalation bug in the Linux kernel imperiling PCs, servers, and Android phones, followed by work extracting disk encryption keys from Qualcomm-chip Android devices using publicly available attack code.
What makes the Rowhammer result different is its layer: it abuses a DRAM hardware defect rather than a software bug, so it defeats the app-permission sandbox that Android's entire consumer security story rests on — no special permissions required, rooting in seconds.
First-order effects
- Owners of unpatched LG, Motorola, Samsung, and OnePlus phones are exposed to any malicious app, which can gain root-level control without asking for a single permission or triggering Android's install-time warnings.
- The four named vendors must ship fixes or mitigations through their update pipelines, where carrier delays historically leave most devices exposed for months.
Second-order effects
- Because the flaw is in memory hardware rather than Android code, pressure shifts upstream to chipmakers and DRAM suppliers, whose refresh-rate and error-correction choices become part of the phone's security posture.
- The attack template proves extensible: two years later researchers demonstrate GLitch, which turns Rowhammer into remote code execution through the browser, forcing Chrome patches and a Firefox fix attempt — expanding the blast radius from sideloaded apps to web pages.
Third-order effects
- If hardware-level flaws keep yielding permission-less device takeover, Android's defense-in-depth model — sandboxing plus timely OS patches — is structurally insufficient, pushing the industry toward hardware-enforced mitigations as a baseline requirement.
- The pattern persists beyond research demos: by 2019 attackers were exploiting an Android zero-day via malicious apps to control roughly 18 phone models including four Pixels, suggesting app-delivered system compromise is a standing operational threat, not a lab curiosity.
The trend: Mobile security is being forced down the stack, from app-permission sandboxes and OS patches to hardware-level defenses, as researchers and attackers alike learn to weaponize silicon defects.