Single Malicious Webpage Visit Can Compromise Tor Browser via Patched Firefox JIT Flaw

Nebula Security researchers have demonstrated that a single visit to a malicious webpage can compromise the Tor Browser by exploiting a patched Firefox JIT vulnerability, tracked as CVE-2026-10702. The flaw, rated High by Mozilla, allows arbitrary code execution within the browser’s renderer process without requiring any user interaction beyond visiting the page. Mozilla fixed the issue in Firefox 151.0.3, affecting Firefox versions 147 through 151.0.2. Tor Browser releases incorporating vulnerable Firefox versions are also impacted, though exact Tor releases have not been identified.

The vulnerability originates from a faulty alias declaration in Firefox’s JIT compiler, specifically in the MObjectToIterator operation when skipRegistration is set to true. The compiler incorrectly treated the operation as a read, even though resolving a lazy property can allocate a new dynamic-slots buffer and free the old one. This allowed global value numbering to reuse a stale pointer, leading to memory corruption. Nebula’s exploit reclaims the freed allocation, leaks a hidden-class pointer, builds a fake object, and corrupts a Uint8Array to gain arbitrary memory read and write. On Android, the code then changes memory protections and redirects a WebAssembly function entry point to ARM64 shellcode.

Nebula used CVE-2026-10702 as the first stage of IonStack, a browser-to-kernel chain targeting an ARM64 device running Android 17. The second stage is CVE-2026-43499 (GhostLock), a separate Linux kernel futex flaw that provides root access. While the browser flaw is architecture-independent, Nebula’s released exploit targets a specific Google build. The company noted that Android’s weaker sandbox makes exploitation easier, but a stronger desktop sandbox would not prevent the attack. Updating Firefox blocks the browser entry point but does not patch GhostLock. As of July 28, 2026, there is no evidence of exploitation in the wild.