Nebula’s One-Click Android 17 Root Runs on a 15-Year-Old Kernel Bug

A single URL click on an Android 17 phone can now hand an attacker full kernel-level control. Researchers at Nebula Security disclosed the exploit chain on June 24, calling it IonStack, and billed it as the first public Android 17 root demo built entirely from zero-days. The chain links a Firefox JavaScript engine flaw to a privilege escalation buried in the Linux kernel, and together the two hand over the device with no further taps or dialogs.

Both flaws were found by VEGA, Nebula’s automated code scanning agent, in a single sweep. The kernel bug sits in code shipped to every major Linux distribution since 2011 and hid from manual audits for more than 15 years. Mozilla’s own AI scanner, Mythos Preview, surfaced 271 latent Firefox vulnerabilities in one release around the same period, which points to AI-driven discovery reshaping offense and defense at once.

What IonStack Actually Does

Click a link in Firefox on Android 17, and the chain begins. There is no installer prompt, no permission dialog, no second tap. The attacker owns the phone. Nebula’s demo targets Firefox 151 on Android arm64, the same configuration most users run by default on a current Pixel or comparable device.

Stage one compromises the Firefox renderer process through the JavaScript engine bug, a JIT miscompilation that corrupts memory in ways browsers are not supposed to allow. Stage two pivots through that foothold into the underlying Linux kernel that powers every Android device. The second bug escalates from the browser sandbox into the kernel, where most other isolation layers fall.

Once kernel access lands, the attacker can pull files from any app, listen through the microphone, install a persistent backdoor that survives reboots, and control the phone remotely. According to Nebula, no exploit code was found in the wild before this disclosure. The ‘Ion’ in IonStack comes from IonMonkey, the Firefox just-in-time compiler. The ‘Stack’ refers to how the two bugs stack: browser over kernel, one click deep. The browser entry point needs no scroll, no viewing of the URL bar, and no follow-up dialogs for the chain to complete.

The Two Zero-Days, Decoded

Two previously unknown bugs sit at the heart of the chain. Both were reported to vendors and patched before any public disclosure.

Both bugs were disclosed to Mozilla and to kernel.org security ahead of Nebula’s public demo. Google paid Nebula $92,337 through its kernelCTF program, per Nebula’s GhostLock technical writeup covering the kernel flaw. That bounty figure has not been independently posted by Google in the sources reviewed here, and should be read as Nebula’s account of the payment.

Where 15 Years of Code Went Untouched

GhostLock was introduced into the Linux kernel with a 2011 commit reworking the rtmutex code, and it sat there untouched until April 2026. The bug lives in a helper function, remove_waiter(), that cleans up a queued waiter on rtmutex rollback. The helper assumed the calling thread was always the waiter. In the proxy path, that assumption breaks.

The result is a dangling pointer into kernel stack memory that can be coaxed into a write primitive, giving an unprivileged user a way to hijack a function table. CONFIG_FUTEX_PI=y is the only kernel option required to trigger it, according to Nebula, with no user namespaces and no capabilities needed. The bookkeeping error turns into a full privilege escalation. Nebula’s writeup claims a 97% stable local exploit, and the NVD records a CVSS 3.1 base score of 7.8 for the kernel.org advisory.

The kernel.org fix landed on April 20, two days after Nebula reported the bug and shipped a draft patch to security@kernel.org. The first downstream backport landed on May 4, Google confirmed the kernelCTF submission and paid the claimed bounty on June 30, and Nebula published the full writeup on July 7. The dwell time is the headline: more than 15 years in code that ships to every major Linux distribution. Read alongside Nebula’s separate Linux kernel root exploit disclosed publicly earlier this year, the pattern of legacy code hiding bugs human review kept missing is harder to wave off.

• Affected kernel range: v2.6.39-rc1 to v7.1-rc1
• Required kernel option: CONFIG_FUTEX_PI=y
• Privilege needed to exploit: none, no capabilities or namespaces
• Bug-introducing commit: 8161239a8bcc
• Bug-fixing commit: 3bfdc63936dd

AI Scanners Just Changed Both Sides

Mozilla published its own AI-scanner account the same week Nebula went public. Since February, the Firefox security team has been collaborating with Anthropic to apply frontier AI models to the browser’s source, with hundreds of fixes shipping in two consecutive releases.

We use defense-in-depth to apply multiple layers of overlapping defenses, but no layer is bulletproof. Until now, the industry has largely fought security to a draw. Defenders finally have a chance to win, decisively.

Firefox 148 shipped with fixes for 22 vulnerabilities surfaced using Claude Opus 4.6, and Firefox 150 fixed 271 vulnerabilities identified by an early version of Claude Mythos Preview, per Mozilla’s account of AI scanners surfacing hundreds of Firefox bugs. Nebula’s tweet announcing IonStack called VEGA out by name against Mythos, claiming it outperformed Mozilla’s model. The bar is harder than that comparison suggests.

Mythos found 271 latent bugs across a single evaluation pass. Nebula found two that, together, form a remote one-tap exploit chain. Both results point at the same shift, since AI is now finding vulnerabilities on offense and defense at a pace human review cannot match. Mozilla’s security team has spent months preparing for what Mythos revealed, and Nebula, fresh off a Y Combinator batch, shipped VEGA inside that opening quarter.

What Got Patched, and What Hasn’t

The browser half is patched and shipping. The kernel half is mid-rolled-out, with several downstream distributions lagging in places that matter. Patching is the difference between an interesting demo and a real-world attack.

1. Update Firefox on every device to 151.0.3 or later, across Windows, macOS, Linux, and Android.
2. Apply the June 2026 Android security patch level on your phone as soon as your manufacturer pushes it.
3. Track CVE-2026-43499 (GhostLock) in your distribution’s security tracker: Debian bookworm is fixed in 6.1.176-1, trixie in 6.12.86-1, sid in 7.1.3-1, with older Ubuntu and several IoT kernels still flagged vulnerable in vendor trackers reviewed here.
4. Audit CI/CD pipelines for automated vulnerability scanning, VEGA or an equivalent, to catch the class of latent bug Mythos and VEGA now surface in other codebases.

Nebula’s writeup notes that public exploit code will ship on the CyberMeowfia repository. Publishing working kernel exploit code shortens the runway for any attacker who already has code execution on a Linux machine, who can adapt GhostLock directly. Mozilla’s blog frames the broader pattern: bringing exploits to zero was an unrealistic goal for years, and defenders can now aim higher. The patch gap, not the discovery, will decide how many IonStacks turn into real breaches. Read alongside Apple pulling its iOS security fix out of beta early under AI attacker pressure, the vendor-side reaction is moving at a speed tied to AI scanner output.

Several Linux distributions reviewed here still show GhostLock as unpatched in current security trackers. For an Android phone, the answer is layered: Firefox updates land immediately, while a kernel fix flows through the device manufacturer first. Older Samsung, Pixel, and Xiaomi devices on the June 2026 patch level should treat this as a priority update, and devices on older patch levels should avoid following suspicious Firefox links until they catch up.

The IonStack demo is a single point in a three-link chain. The bigger shift is the AI-scanner competition that surfaced it, since Nebula’s IonStack one-click Android 17 demo announcement framed the disclosure as a celebration of Y Combinator backing, but the same scanner passed over code Mozilla’s Mythos had reviewed. Each company’s posture shows the new asymmetry, since defenders can patch faster than before, and attackers can find older bugs they never had to find before.

Why the AI Scanner Race Matters More Than the Hack

The headlines will focus on the one-click exploit, which is the dramatic part. What lasts past the demo day is that a decade and a half of Linux kernel code just got scanned by AI tools and found wanting.

Nebula’s product page claims 730 validated findings and 698 Linux kernel bugs across its work, per the company’s own metrics. Mozilla’s Mythos run surfaced 271 Firefox vulnerabilities in one evaluation pass. Those numbers should be read as the companies publishing them, which is the standard caveat for any vendor-supplied security count. If the order of magnitude is right, the running tally of bugs in mature open-source projects is much larger than any one vendor can close at human speed. The IonStack demo is one proof point in a much larger sweep, and the next decade of disclosure will look more like it than like the manual CVE hunts of the past fifteen years.

Frequently Asked Questions

Should Android users worry about IonStack right now?

The browser half of the exploit chain is patched in Firefox 151.0.3, which Mozilla released June 2, 2026 through security advisory mfsa2026-54. The kernel half, GhostLock (CVE-2026-43499), will be patched through the June 2026 Android security update on supported devices. Until both reach your device, the safest move is to keep Firefox updated and avoid clicking links from unknown senders.

How does a single URL click root a phone?

It chains two previously unknown bugs. A malicious URL triggers the Firefox JavaScript engine flaw (CVE-2026-10702), and a second bug in the Linux kernel (CVE-2026-43499, GhostLock) escalates from the browser sandbox into the kernel. Together, that progression ends with root-level control of the device, all from one tap.

Which Firefox version fixes the browser half?

Firefox 151.0.3, shipped June 2, 2026. Update Firefox on every device you use, not just Android, since the Linux kernel bug also affects Linux desktops and servers running kernels from the same 2011-era rtmutex code.

When will the Android kernel fix arrive?

The kernel.org patch landed on April 20, 2026. Phone-by-phone delivery depends on the manufacturer’s June 2026 security update cycle. Google’s Pixel line and most flagship Android devices are expected to receive it first; older or carrier-locked devices may lag.

Is IonStack an active threat in the wild right now?

Nebula states the vulnerabilities were disclosed responsibly to Mozilla and to kernel.org before the public demo, and were not found in the wild prior to this disclosure. The risk window opens once the public exploit code ships under the CyberMeowfia repository.