Sandbox escape: browser renderer to root privilege escalation chain (IonStack/GhostLock)

Ethan Andrews@eandrews

•updated Jul 29, 2026•2•0•6

Detects a suspicious sequence of events where a browser process (Firefox or Tor) is followed by a process escalation to root within 15 minutes on the same device. This pattern is indicative of a browser sandbox escape combined with kernel privilege escalation (e.g., exploitation of CVE-2026-10702 and CVE-2026-43499).