One Visit Compromises Tor Browser: A Firefox JIT Vulnerability

Nebula Security has disclosed the details of a Firefox vulnerability that could be triggered without any involvement from the victim — all it took was opening a compromised web page. The bug, assigned the identifier CVE-2026-10702, allowed arbitrary code to be executed inside the browser's renderer process. Mozilla rated it “high” in severity and closed it in the Firefox 151.0.3 update.

“No configuration, no additional user interaction. Just visiting a malicious page,” Nebula Security head Ethan Zou told The Hacker News. According to him, every Tor Browser release built on top of an affected Firefox version was vulnerable, though the researchers did not pin down the exact list of Tor releases. The range of vulnerable stable Firefox versions runs from 147 to 151.0.2; according to Mozilla, the ESR branches are not affected.

How the bug works

The root of the problem lies in the JIT compiler, which turns frequently executed JavaScript into machine code. To do this safely, the compiler has to track which operations are capable of touching memory. Firefox mistakenly treated the MObjectToIterator operation (with the skipRegistration flag enabled) as a read, when in reality it could free an object's old dynamic slots buffer and allocate a new one. As a result, the optimizer held on to a pointer that the runtime had already marked as invalid.

The exploit published by Nebula takes advantage of this desynchronization: it reclaims the freed memory, extracts a pointer to the hidden class, constructs a fake object and corrupts a Uint8Array, gaining the ability to read from and write to memory arbitrarily. Mozilla's fix removes the nonstandard handling of the operation so that the compiler no longer mistakes a state-changing step for a harmless load.

From the browser to the kernel

On its own, the vulnerability only yields code execution within an isolated process. Nebula built it into a chain called IonStack, taken all the way to full takeover of an ARM64 device running Android 17. The second link in the chain is a separate flaw in the Linux kernel's futex subsystem (CVE-2026-43499, dubbed GhostLock), which escalates privileges to root. The published code targets a specific Google build, but according to Zou the browser vulnerability itself does not depend on the architecture, and the x86 path is even more stable — though it has not been fully completed.

Zou noted that Android's weaker sandbox makes the attack easier, but in his view the stronger isolation of desktop systems would not have stopped it. Firefox users are advised to update to the current release as soon as possible: this closes the documented entry point into the browser, but does not eliminate the GhostLock kernel vulnerability itself. As of July 28, 2026, there is no evidence of exploitation in real-world attacks.

Source: The Hacker News