Nebula Security says a patched Firefox JIT flaw could be triggered by simply visiting a malicious webpage and was also used to compromise Tor Browser.
Tracked as CVE-2026-10702, the bug provides arbitrary code execution inside the browser's renderer process. Mozilla rated it High and fixed it in the Firefox 151.0.3 update.
"No settings or additional user interaction are required," Eten Zou, CEO of Nebula Security, told The Hacker News. "Visiting a malicious webpage is enough to trigger it," Zou said every Tor Browser release that incorporated a vulnerable Firefox version was affected, though researchers have not identified the exact Tor releases.
On its own, the bug runs code only inside Firefox's sandboxed content process. Nebula released public exploit material and used the flaw as the first stage of IonStack, a browser-to-kernel chain built for an ARM64 device running Android 17. The released end-to-end code targets one supported Google build, although Zou said the browser flaw itself is not ARM-specific.
The public code contains Firefox 151.0 offsets for the supported ARM64 Android 17 build. Zou said each exploitation step is architecture-independent and described the x86 path as more stable, although Nebula has not completed the full chain for that architecture.
Firefox users should update to the latest release. The Hacker News traced the faulty alias declaration through Mozilla's source history to Bug 1995077, which landed for Firefox 147. The override is present in Firefox 151.0.2 and absent from Firefox 151.0.3. That places the affected stable-release range at Firefox 147 through 151.0.2.
Mozilla's advisory does not list Firefox ESR, and the faulty override is absent from Firefox ESR 140.12. As of July 28, 2026, the available primary-source record does not establish exploitation against users in the wild.
In its technical analysis, Nebula traces the issue to MObjectToIterator when it runs with skipRegistration set to true. Firefox's just-in-time (JIT) compiler turns frequently run JavaScript into native machine code, and to do that safely it has to track which operations can touch memory.
Firefox treated the operation as a read even though resolving a lazy property can allocate a replacement dynamic-slots buffer and free the old one.
Global value numbering then treated a later slots-buffer load as redundant and reused the earlier pointer after it had become stale. Nebula's released exploit reclaims the freed allocation, leaks a hidden-class pointer, builds a fake object, and corrupts a Uint8Array to gain arbitrary memory read and write. The Android code then changes memory protections and redirects a WebAssembly function entry point to ARM64 shellcode.
The failure turns on a narrow compiler contract: an operation capable of replacing the object's dynamic-slots buffer was labelled as a read. That incorrect contract let otherwise valid optimisation logic preserve a pointer the runtime had already invalidated.
Mozilla's source-level fix removes the custom read-only alias handling from ObjectToIterator and adjusts the related iterator operation. That prevents the optimiser from treating a mutation-capable step as a harmless load and retaining the stale pointer.
IonStack's second stage is CVE-2026-43499, a separate Linux kernel futex flaw that Nebula calls GhostLock. CVE-2026-10702 provides the remote browser foothold; CVE-2026-43499 carries it to root on the supported Android build.
Zou said GhostLock is invoked directly from Firefox. He added that Android's weaker sandbox makes exploitation easier, but Nebula does not believe a stronger desktop sandbox would prevent the attack.
Updating Firefox blocks the documented browser entry point, but it does not patch GhostLock itself.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
English (US) ·