- Critical Firefox JIT flaw (CVE-2026-10702) enables remote code execution via a malicious webpage, patched in Firefox 151.0.3.
- The vulnerability also compromises Tor Browser, with no user interaction required.
- Nebula Security released a public exploit and deployed it as part of a browser-to-kernel chain targeting Android 17.
- The bug stems from a mislabelled compiler operation that treats a memory-mutation step as a read.
- A second-stage kernel flaw (CVE-2026-43499) provides root escalation on supported Android builds.
Nebula Security disclosed that a patched Firefox JIT flaw, tracked as CVE-2026-10702, could be triggered by simply visiting a malicious webpage and was also used to compromise Tor Browser. Mozilla rated the bug High and fixed it in the Firefox 151.0.3 update, according to the advisory.
“No settings or additional user interaction are required,” said Eten Zou, CEO of Nebula Security, adding that every Tor Browser release incorporating a vulnerable Firefox version was affected. The bug provides arbitrary code execution inside the browser’s sandboxed renderer process, though researchers have not identified the exact Tor releases.
Nebula released public exploit material and used the flaw as the first stage of IonStack, a browser-to-kernel chain built for an ARM64 device running Android 17. The released end-to-end code targets one supported Google build, although Zou said the browser flaw itself is not ARM-specific.
In its technical analysis, Nebula traces the issue to MObjectToIterator when it runs with skipRegistration set to true. Firefox’s JIT compiler treated the operation as a read even though resolving a lazy property can allocate a replacement dynamic-slots buffer and free the old one.
Global value numbering then treated a later slots-buffer load as redundant and reused the earlier pointer after it had become stale. Nebula’s released exploit reclaims the freed allocation, leaks a hidden-class pointer, and corrupts a Uint8Array to gain arbitrary memory read and write.
Mozilla’s source-level fix removes the custom read-only alias handling from ObjectToIterator, preventing the optimiser from retaining a stale pointer. The second stage, IonStack’s CVE-2026-43499 (dubbed GhostLock), is a separate Linux kernel futex flaw that carries the exploit to root on the supported Android build.
✅ Follow BITNEWSBOT on Telegram, Facebook, LinkedIn, X.com, and Google News for instant updates.
