Cyberpediaby Brain
ENDEFR

Rowhammer, the DRAM bit-flip attack

Rowhammer alters a device's DRAM memory without touching it directly. What an employee sees, how it works and which habits help.

In 30 seconds

Where it happens
In the DRAM memory of computers and devices, including when a website runs JavaScript in the browser1.
What the attacker wants
To change bits that their program is not allowed to modify, for example to gain administrator rights13.
The reflex
Keep the system, the browser and the software up to date, because regular software updates are a protective measure cited by MITRE ATT&CK against the exploitation of flaws34.
If it has already happened
Report any unusual behaviour of the device to the security team, for example the sudden failure of an antivirus, which MITRE ATT&CK lists among the signs of a flaw being exploited4.

What it is

A basic rule of computer security is that a memory location can only be changed by programs allowed to write to it. Rowhammer gets around this rule: by reading certain areas of DRAM memory very often, a program can change the contents of neighbouring cells without accessing them1.

For an employee, the point to remember is that a website running JavaScript is enough to carry out this attack1. It targets the hardware itself, and according to the authors, the countermeasures that existed in 2015 did not block it1.

Straight answers

What is Rowhammer?

It is a flaw in DRAM memory. The authors of Rowhammer.js explain that parasitic effects in DRAM can change the contents of a memory cell without accessing it, by accessing other locations at high frequency1. They state that this flaw appears in most memory modules in use at the date of their paper1.

Why does this flaw exist?

According to the second version of the paper, DRAM has become denser, and its cells are therefore less isolated from one another2. Repeated accesses to rows of DRAM can then cause random bit flips in an adjacent row2.

Is a flipped bit really serious?

Yes, according to the same authors. The flaw has already been used to gain root rights and to escape a sandbox2. A sandbox is an isolated space in which a program is supposed to stay confined.

Does the attacker need access to the computer?

Not necessarily. Rowhammer.js, according to its authors, is the first remote software-induced hardware-fault attack: it requires neither physical access to the machine, nor native code execution, nor special instructions2. A website containing JavaScript is enough to cause faults on remote hardware1.

What does the victim see?

The sources cited here describe no message or sign on screen. They indicate that these JavaScript-based attacks can target millions of users discreetly and simultaneously2.

1Inside the attacker's head1 min

The attacker starts from an obstacle: a program running with few rights cannot access certain system resources. MITRE ATT&CK describes this step as privilege escalation, which can take an attacker from user level to SYSTEM or root rights3. It can also allow escape from a virtualised environment, such as a virtual machine or a container, to reach the host machine3.

Rowhammer offers a path to get there, since it makes it possible to alter memory without authorisation. The authors of Rowhammer.js mention privilege escalation attacks among the consequences1. They also indicate that a website is enough to obtain unrestricted access to the systems of its visitors1.

MITRE ATT&CK describes another technique, exploiting a flaw to evade detection, which consists of acting so as to reduce visibility or to blend in with legitimate activity4. This article does not say that Rowhammer has been used in this way: the sources cited here do not mention it.

2What you see on screen1 min

The sources cited here give no description of what the user perceives. They say only that the attack through a browser can be carried out discreetly2. In the scenario described by the authors of Rowhammer.js, the victim visits a website that contains JavaScript1.

Since Rowhammer has no visible sign of its own, the clues to watch for are those of any flaw exploitation. MITRE ATT&CK cites abnormal process behaviour, such as an antivirus or a detection tool that stops unexpectedly, or logs that have gaps4.

3Under the hoodIT teams1 min

DRAM memory stores data in cells organised in rows. When density increases, the cells are less well isolated from one another2. Reading a row very often can then flip bits in the neighbouring row2.

The first exploits written to take advantage of this flaw used native code and special instructions meant to flush data from the cache2. All studies and attacks prior to Rowhammer.js depended on the availability of a cache-flush instruction, in order to cause DRAM accesses at a sufficient frequency1.

Rowhammer.js removed this limit. Its authors show that the cache can be forced to evict its data quickly and that the flaw can be triggered with ordinary memory accesses1. The attack then becomes possible in restricted environments, including scripting ones1. An eviction strategy found by a generic algorithm raises the eviction rate from 95.2 % to 99.99 %2.

The authors state that the countermeasures existing at the time of their paper did not protect against this new attack1. In the second version, they propose countermeasures that can be applied immediately2.

4Case filesReal cases1 min

Rowhammer.js, July 2015

On 24 July 2015, Daniel Gruss, Clémentine Maurice and Stefan Mangard submitted the Rowhammer.js paper to arXiv1. In it they present an implementation of the attack in JavaScript2. They describe a fully automated attack that requires nothing more than a website with JavaScript to cause faults on remote hardware1.

According to them, the attack works on commodity systems and gives unrestricted access to the systems of the website's visitors1. A second version appeared on 27 August 2015, and the latest version dates from 5 April 201612. The paper was accepted at the 13th DIMVA conference in 20161.

5What you do1 min

The sources cited here give no step specific to Rowhammer, either on ECC memory or on recent DDR generations. They only allow the retention of the general measure given by MITRE ATT&CK: updating software regularly, with patch management for the company's workstations and servers34.

For an employee, this means accepting the updates offered by the IT team and not putting them off without reason. MITRE ATT&CK also cites protections that detect exploitation behaviour, as well as application isolation through sandboxing, which makes it harder for an attacker to progress4.

Fact sheet

Identifier
CP-088
Wing
1. Attacks and techniques
Brain skill
Securing Devices & Mobile (secure_devices)
Brain reflex
cr-055
Diagram
G3 · System & Protocol Anatomy
Languages
de, en, fr
Sources
4 sources checked on 3 November 2026
Sources4 sources
  1. arXiv, “Rowhammer.js: A Remote Software-Induced Fault Attack in JavaScript”, 24 July 2015. https://arxiv.org/abs/1507.06955 (accessed 3 November 2026)
  2. arXiv, “Rowhammer.js: A Remote Software-Induced Fault Attack in JavaScript”, 27 August 2015. https://arxiv.org/abs/1507.06955v2 (accessed 3 November 2026)
  3. MITRE ATT&CK, “Exploitation for Privilege Escalation, Technique T1068 - Enterprise | MITRE ATT&CK®”. https://attack.mitre.org/techniques/T1068/ (accessed 3 November 2026)
  4. MITRE ATT&CK, “Exploitation for Stealth, Technique T1211 - Enterprise | MITRE ATT&CK®”. https://attack.mitre.org/techniques/T1211/ (accessed 3 November 2026)

Cite this article

Brain, “Rowhammer, the DRAM bit-flip attack”, Cyberpedia, 2026. https://startbrain.io/cyberpedia/en/articles/rowhammer-dram-bit-flips/

BibTeX 
@misc{brain_cp088_en_2026,
  author = {Brain},
  title = {Rowhammer, the DRAM bit-flip attack},
  year = {2026},
  howpublished = {Cyberpedia},
  url = {https://startbrain.io/cyberpedia/en/articles/rowhammer-dram-bit-flips/},
  note = {CC BY 4.0}
}
CC BY 4.0 licence