IonStack Android 17 Exploit Chain Shows How One Malicious Link Could Lead to Full Device Control

A new exploit chain called IonStack shows how one malicious link could move from a browser compromise to full root access on an Android 17 device.

Nebula Security describes IonStack as the world’s first Android 17 root demo. The company says the chain combines a Firefox vulnerability with a Linux kernel privilege escalation flaw to show how a single URL click could give an attacker full control of a phone.

The chain does not mean every Android user has already been attacked. Google’s Android 17 Security Release Notes say Android 17 devices with a 2026-07-01 security patch level or later include fixes for the issues addressed as part of the Android 17 release, and Google said it had no reports of active customer exploitation for the newly reported Android 17 issues listed there.

What IonStack demonstrates

IonStack links two different bug classes. The first gives an attacker code execution through Firefox after the victim opens a crafted web page. The second raises that foothold from a browser context to kernel-level control.

The Firefox side centers on CVE-2026-10702. Mozilla’s Firefox 151.0.3 security advisory lists the bug as a high-impact JIT miscompilation issue in the JavaScript Engine and credits Nebula Security as the reporter.

The kernel side centers on GhostLock, tracked as CVE-2026-43499. In a GhostLock technical writeup, Nebula says the flaw affects Linux kernel rtmutex and futex priority-inheritance code and can turn local unprivileged execution into root access on unpatched systems.

Exploit stage	Vulnerability	Role in the chain
Browser entry point	CVE-2026-10702	Compromises Firefox through a JavaScript engine JIT bug after a user opens a malicious page.
Privilege escalation	CVE-2026-43499	Uses a Linux kernel flaw to move from local code execution to root-level control.
Full-chain result	IonStack	Combines browser compromise and kernel escalation into a one-click Android root demonstration.

Firefox flaw fixed in version 151.0.3

The browser flaw has a clear official fix path. The Mozilla advisory says Firefox 151.0.3 fixed CVE-2026-10702, along with another high-impact issue.

The NVD entry for CVE-2026-10702 also identifies the issue as a JIT miscompilation in Firefox’s JavaScript Engine and states that Firefox 151.0.3 fixed it.

Nebula Security is now backed by Y Combinator.

We’re celebrating by bringing you the world’s first Android 17 root demo — “IonStack”, a url click can let attacker fully control your phone.

This is not only an Android root demo. We’re bringing you a full chain browser-to-kernel… pic.twitter.com/AvcpdCUvpj

— Nebula Security (@nebusecurity) June 24, 2026

That correction matters because users and administrators should not stop at Firefox 151.0.2. The safer instruction is to update Firefox to 151.0.3 or later, depending on the current release available for the device.

GhostLock turns local code execution into root

GhostLock gives the chain its most serious endpoint impact. Nebula says the bug sat in Linux since 2011 and affects systems built with the relevant futex priority-inheritance support, which the company says appears by default on essentially every mainstream distribution.

The NVD entry for CVE-2026-43499 describes the Linux kernel issue as a flaw in rtmutex handling during proxy-lock rollback in the futex requeue path.

On its own, GhostLock needs local code execution. In a mobile exploit chain, the browser bug can supply that first foothold, then the kernel bug can carry the attacker to root.

Why one-click mobile chains matter

Browser-to-kernel exploit chains rank among the most serious mobile threats because they cross multiple security boundaries. The victim may only see a link, but the attacker’s path can move through browser execution, sandbox escape behavior, kernel exploitation, and full device compromise.

Nebula says both IonStack flaws came from VEGA, its automated code-scanning agent. VEGA scans codebases and produces evidence-backed findings across complex targets, including operating systems and browsers.

The broader security lesson goes beyond one demo. As automated vulnerability research improves, defenders should expect more old, deeply buried bugs in browsers, kernels, and mobile stacks to surface faster.

• Update Firefox to 151.0.3 or later.
• Install Android security updates as soon as the device maker releases them.
• Check the Android security patch level on managed devices.
• Prioritize kernel updates on Linux systems, servers, containers, and developer machines.
• Limit mobile browsing from high-risk links, unknown senders, and untrusted QR codes.
• Monitor enterprise devices for unusual browser crashes, privilege escalation alerts, and suspicious post-exploitation behavior.

Android 17 patch status and user impact

Google says Android partners receive vulnerability details before publication, and source code patches for Android 17 issues reach AOSP as part of the release process. The Android security notes also point users toward Android platform protections and Google Play Protect as additional defenses.

That does not mean every phone receives the same fix on the same day. Pixel devices, Android Open Source Project builds, OEM devices, carrier models, and enterprise-managed phones can receive updates on different timelines.

For most users, the most important steps are simple: update the browser, install the latest Android security patch, avoid unknown links, and keep Google Play Protect enabled.

What enterprises should do

Enterprises should treat IonStack as a warning about chained mobile exploitation. A browser vulnerability may look less severe if it only gives code execution inside a constrained process, while a kernel bug may look local-only if it requires an initial foothold. Together, those assumptions break down.

Security teams should confirm the status of Firefox across mobile and desktop fleets. The CVE-2026-10702 record gives defenders a useful tracking reference for vulnerability management tools.

Teams that manage Linux infrastructure should also track the CVE-2026-43499 record and distribution-specific kernel updates, since GhostLock affects more than Android-focused threat models.

Bottom line

IonStack shows how attackers can combine a browser flaw and a kernel flaw into a high-impact mobile compromise chain. The demo turns a single malicious link into a possible path toward full device control, but available patches and security updates sharply reduce the risk.

The most urgent action for users is to update Firefox to 151.0.3 or later and apply the newest Android security update available for their device.

For defenders, the larger takeaway comes from Nebula Security’s IonStack disclosure, the GhostLock research, and the role of VEGA. Browser, kernel, and automated bug-finding risks now need one coordinated patching and monitoring strategy.

FAQ