Skip to content
attack.paths
Anmelden
← RegistryDossier · 6 steps · 5 edges

Rowhammer → bit flip → in-browser sandbox escape

JavaScript hammers adjacent DRAM rows for tens of seconds; an unlucky-for-defender bit flip in a page-table entry hands the attacker a write primitive into another mapping. RIDL-class chain to native code.

Filed by AD Knowledge Base
§ Kill-chainDrag · zoom · scroll

§ Context

Assumed environment: target client device has DRAM susceptible to Rowhammer (most pre-2020 DDR4 in laptops / desktops). No DRAM ECC, no in-browser Rowhammer mitigations active.

§ Steps

  1. 01
    Sandbox escape → arbitrary native codeInitial Access
    T1190— Exploit Public-Facing Application
  2. 02
    Acquire read/write primitive in browserExecution
    T1059— Command and Scripting Interpreter
  3. 03
    Drop local implantPersistence
    T1547— Boot or Logon Autostart Execution
  4. 04
    Phish / drive-by to attacker pageInitial Access
    T1566— Phishing
  5. 05
    Achieve targeted bit flip in PTEPrivilege Escalation
    HW-ROWHAMMER— Rowhammer Bit Flip
  6. 06
    Hammer adjacent DRAM rows from JSPrivilege Escalation
    HW-ROWHAMMER— Rowhammer Bit Flip

§ References

§ Frequently asked

What is the "Rowhammer → bit flip → in-browser sandbox escape" attack path?
JavaScript hammers adjacent DRAM rows for tens of seconds; an unlucky-for-defender bit flip in a page-table entry hands the attacker a write primitive into another mapping. RIDL-class chain to native code. It chains 6 steps drawn from real-world offensive-security techniques.
What starting position does this attack require?
The first step is Sandbox escape → arbitrary native code (T1190) — a initial access primitive. Assumed environment: target client device has DRAM susceptible to Rowhammer (most pre-2020 DDR4 in laptops / desktops).
What is the final impact of this kill-chain?
The final step lands on Hammer adjacent DRAM rows from JS (HW-ROWHAMMER), which falls under Privilege Escalation. From here, an operator typically pivots into post-exploitation or maintains persistence.
How can defenders detect or prevent this attack?
Detection and prevention vary per step. Refer to each linked MITRE ATT&CK entry under "References" — every technique on that page lists defensive controls, detection telemetry, and known threat-actor usage.

§ Related dossiers