Researchers at Nebula Security have disclosed details of a high severity Firefox just in time compiler vulnerability that can be exploited simply by visiting a malicious webpage, with the same flaw also impacting Tor Browser versions built on affected Firefox releases. The security issue, tracked as CVE 2026 10702, enables arbitrary code execution within the browser renderer process without requiring users to change settings or perform any additional interaction beyond opening a specially crafted webpage. Mozilla has rated the vulnerability as High and addressed the issue in Firefox version 151.0.3. According to Eten Zou, Chief Executive Officer of Nebula Security, every Tor Browser release incorporating a vulnerable Firefox version was affected, although researchers have not identified the exact Tor Browser versions impacted by the flaw.
Nebula Security explained that while the vulnerability allows attackers to execute code inside Firefox sandboxed content process, it also served as the first stage of IonStack, a browser to kernel exploitation chain created for an ARM64 device running Android 17. The company released public exploit material demonstrating the attack chain, with the available end to end code targeting a supported Google Android build. Zou noted that although the released code includes Firefox 151.0 specific offsets for ARM64 Android 17, the browser vulnerability itself is not limited to ARM architecture. He added that each stage of exploitation is architecture independent and described the x86 exploitation path as more stable, although Nebula has not completed the full exploitation chain for that platform. Firefox users have been advised to update to the latest browser version, as analysis traced the faulty implementation to Mozilla Bug 1995077, introduced in Firefox 147 and remaining present through Firefox 151.0.2 before being removed in Firefox 151.0.3. Mozilla advisory does not list Firefox ESR as affected, and researchers stated that, as of July 28, 2026, there is no confirmed evidence showing the vulnerability has been exploited against users in real world attacks.
According to Nebula technical analysis, the flaw originates in the MObjectToIterator function when executed with the skipRegistration parameter enabled. Firefox just in time compiler converts frequently executed JavaScript into native machine code and relies on memory tracking to perform optimizations safely. Researchers found that Firefox incorrectly classified an operation capable of modifying memory as a read only operation, even though resolving a lazy property could allocate a replacement dynamic slots buffer while freeing the previous one. This incorrect assumption allowed compiler optimization logic to reuse a pointer that had already become invalid. Nebula exploit demonstrates how attackers can reclaim the freed memory allocation, leak a hidden class pointer, create a fake object, and manipulate a Uint8Array to obtain arbitrary memory read and write capabilities. On Android, the exploit proceeds by modifying memory protections before redirecting a WebAssembly function entry point to ARM64 shellcode. Researchers said the vulnerability results from a narrow compiler contract where an operation capable of replacing an object dynamic slots buffer was incorrectly labeled as read only, allowing optimization logic to preserve a stale pointer that should no longer have been trusted.
Mozilla addressed the issue by removing the custom read only alias handling from ObjectToIterator and updating the related iterator operation so the optimizer no longer treats mutation capable operations as harmless memory reads. Nebula also disclosed that IonStack second stage relies on CVE 2026 43499, a separate Linux kernel futex vulnerability referred to as GhostLock. While CVE 2026 10702 provides attackers with an initial browser based foothold, GhostLock is used to escalate privileges to root on the supported Android build. Zou stated that GhostLock is invoked directly from Firefox and added that Android comparatively weaker sandbox environment makes exploitation easier, although Nebula does not believe a stronger desktop sandbox would completely prevent the attack. Researchers emphasized that updating Firefox blocks the documented browser entry point by fixing CVE 2026 10702, but users should note that the browser update does not address the separate GhostLock kernel vulnerability itself.
Follow the SPIN IDG WhatsApp Channel for updates across the Smart Pakistan Insights Network covering all of Pakistan’s technology ecosystem.
