Firefox JIT flaw gave malicious webpages a code-execution path into Tor Browser

On July 29, 2026, Nebula Security detailed CVE-2026-10702, a High-severity Firefox JIT flaw that can execute arbitrary code in the renderer when a user visits a malicious page. Mozilla fixed it in Firefox 151.0.3; Tor Browser builds incorporating vulnerable Firefox versions were also affected.

Why a single visit was enough

The exploit required no changed settings, download or additional click. JavaScript on a hostile page could trigger the flaw and establish a foothold inside Firefox’s sandboxed content process. Researchers did not identify the exact affected Tor Browser releases.

The browser bug did not provide root access by itself. Nebula used it as the first stage of IonStack, a browser-to-kernel chain targeting one supported Google build on an ARM64 device running Android 17.

A stale pointer in the JIT compiler

Mozilla’s source history places the affected stable range at Firefox 147 through 151.0.2. The faulty override is absent from Firefox ESR 140.12, and Mozilla’s advisory does not list ESR as affected. As of July 28, no primary-source evidence established exploitation against users in the wild.

“No settings or additional user interaction are required. Visiting a malicious webpage is enough to trigger it.”

The defect involved MObjectToIterator with skipRegistration enabled. Firefox classified an operation as a read even though resolving a lazy property could replace a dynamic-slots buffer and free the old allocation. JIT optimisation then reused the stale pointer.

Nebula’s public exploit reclaims the freed memory, creates a fake object and corrupts a Uint8Array to obtain arbitrary memory access. It then redirects a WebAssembly entry point to ARM64 shellcode. IonStack pairs this foothold with CVE-2026-43499, the Linux kernel futex flaw called GhostLock, to reach root.

What businesses should do

Organisations should verify that managed Firefox installations run 151.0.3 or later and review Tor Browser deployments for builds containing the fix. Updating Firefox closes the documented browser entry point but does not patch GhostLock, so Android and kernel exposure must be assessed separately.