Posthammer: Pervasive Browser-based Rowhammer Attacks with Postponed Refresh Commands

Rowhammer attacks are pervasive in client systems when launched natively. The biggest Rowhammer threat for such systems, however, lies in the browser. Our large-scale evaluation of browser-based Rowhammer attacks shows that they can only trigger bit flips on a small fraction of DRAM devices. Postponing refresh commands that trigger in-DRAM mitigations can boost the performance of Rowhammer attacks, but it has never been demonstrated in practice. We introduce POSTHAMMER, a new Rowhammer attack in JavaScript that forces the CPU's memory controller to postpone refresh commands by creating long durations of intense Rowhammer activity followed by sufficiently long delay windows to allow the memory controller to batch refresh commands. POSTHAMMER features a new abstraction called lane, which enables a subset of addresses in a Rowhammer pattern to be accessed more often. Lanes enable POSTHAMMER to support effective refresh-postponed non-uniform patterns in the browser for the first time. Our evaluation shows that POSTHAMMER is 2.8 × more effective than the state of the art, triggering bit flips on 86 % of our 28 DDR4 test devices. Based on the LaTeX template for Artifact Evaluation V20231005. Submission, reviewing and badging methodology followed for the evaluation of this artifact can be found at https://secartifacts.github.io/usenixsec2025/ .