First-Ever 1- Click Android 17 Exploit Allows Attackers to Gain Full Control Over Your Android Phone

A full-chain exploit dubbed “IonStack” demonstrates how a single malicious URL click can hand attackers complete control over an Android device.

The proof-of-concept by Nebula Security, described as the world’s first public Android 17 root demo, chains two zero-day vulnerabilities spanning Firefox and the Linux kernel to achieve remote code execution and privilege escalation without further user interaction.

IonStack exploits two previously unknown vulnerabilities:

• Firefox 0-day: Affects all versions prior to v151.0.2, serving as the initial browser-based entry point when a victim visits or clicks a crafted URL.
• Linux kernel 0-day: A vulnerability present across mainstream Linux distributions for approximately 15 years, enabling the attacker to escalate from browser sandbox to full kernel-level control.

The exploit chain works by first compromising the Firefox renderer process through the browser flaw, then pivoting to the underlying Linux kernel (which powers Android) to break out of sandbox restrictions entirely.

Once kernel access is achieved, the attacker effectively owns the device, gaining capabilities that include data exfiltration, surveillance, persistent backdoor installation, and full remote control.

Both zero-days were identified by VEGA, Nebula Security’s automated code scanning agent. According to Nebula, VEGA outperformed comparable tools, including the scanner Mythos, in surfacing these deeply embedded flaws.

The researchers emphasize that VEGA’s detection of a 15-year-old kernel bug highlights how automated static and dynamic analysis can uncover vulnerabilities that have evaded manual audits and existing tooling for over a decade.

Browser-to-kernel exploit chains represent some of the most severe threats in mobile security because they require zero interaction beyond a single click and bypass multiple layers of OS-level sandboxing.

The long dwell time of the Linux kernel flaw (15 years) underscores a persistent challenge: legacy code in widely deployed open-source components can harbor critical bugs long after initial release, affecting billions of devices running Android and other Linux-based systems.

Nebula Security states the vulnerabilities were disclosed responsibly and were not found in the wild prior to their research, positioning IonStack as a defensive demonstration rather than an active in-the-wild threat.

• Update Firefox to v151.0.2 or later immediately.
• Monitor for Linux kernel patches addressing the disclosed CVE once assigned and published.
• Enterprises should prioritize patch management cycles for browser and kernel components.
• Security teams should consider integrating automated vulnerability scanning (such as VEGA) into CI/CD pipelines to enable continuous detection.

Stop Accepting SLAs Written for 2019 SOCs – Here’s the 2026 AI SLA Vendor Checklist – Download Free AI SOC SLA Guide