Researchers demonstrate GLitch, an Android exploit that uses Rowhammer attack to remotely execute code; Chrome is patched; Firefox's next patch attempt due 5/9
Dan Goodin / Ars Technica :
Context & Ripple Effects
Rowhammer has been climbing the stack: researchers showed in 2016 how the DRAM fault could root phones from an app running with no special permissions, but the attack still required code on the device. GLitch removes that precondition by triggering Rowhammer from JavaScript in a mobile browser, turning a hardware quirk into a remote code execution vector.
That puts it in the same family as earlier drive-by Android compromises demonstrated in Chrome back in 2015, and as BlueBorne, which showed how flaws below the OS layer can hit every major platform at once. The response split is telling: Google has already shipped a Chrome patch, while Mozilla's next fix attempt is scheduled for May 9.
First-order effects
- Android users on unpatched browsers face a drive-by risk: visiting a malicious page could execute code with no install step, and Google's Chrome patch is currently the only shield in place until Firefox ships its May 9 attempt.
- Mozilla is now on the clock — every day between Google's fix and its own patch window leaves Firefox-on-Android as the softer target for anyone weaponizing the technique.
Second-order effects
- Browser-level patches are whack-a-mole against a hardware flaw, so pressure shifts toward device makers and DRAM suppliers to mitigate at the silicon or firmware level — the same dynamic that followed the 2016 no-permission Rowhammer demonstrations.
- The long tail of Android devices that never receive updates becomes the practical target pool, echoing how critical bugs in older devices were absorbed into malvertising and drive-by campaigns once publicized.
Third-order effects
- If Rowhammer-class attacks keep moving from local proof-of-concept to remote delivery, the industry's isolation model — which assumes separate processes can't corrupt each other's memory at the physical layer — needs defenses pushed down into hardware, not just patched over in browsers.
- Cross-platform hardware vulnerabilities of this kind compress the patch race into days across independent vendors, favoring platforms with fast, centralized update pipelines and penalizing fragmented ones like Android.
The trend: Hardware-level flaws like Rowhammer are being escalated from local exploits to remotely deliverable attacks, making browser vendors the first responders to problems rooted in physical memory.