Here is a scenario that should make you update your browser immediately. A security researcher has demonstrated that simply visiting a malicious webpage is enough to trigger a critical Firefox vulnerability. No clicks. No downloads. No warnings. Just a visit.
The flaw, tracked as CVE-2026-10702, provides arbitrary code execution inside the browser's renderer process. Mozilla rated it High and fixed it in the Firefox 151.0.3 update. But the story does not stop there. The vulnerability also affects Tor Browser, and it has been used as part of a browser-to-kernel exploit chain on Android.
Nebula Security's CEO Eten Zou shared the details with The Hacker News, and the technical analysis reveals a fascinating and dangerous bug in Firefox's just-in-time compiler. Let me walk you through what happened and why you need to update right now.
Description of Firefox CVE-2026-10702
The Firefox vulnerability refers to a flaw in the JIT compiler of the Firefox browser. The JIT Compiler for Firefox converts JavaScript that is reused in the application to machine code. In order for this process to be conducted in a safe manner, the compiler has to distinguish between those operations that have the ability to access the memory from those operations which cannot.
But in this Firefox vulnerability, the compiler got it wrong. An operation called MObjectToIterator was labelled as a read operation when it ran with a specific setting called skipRegistration. The problem? Resolving a lazy property can actually allocate a replacement dynamic-slots buffer and free the old one. That is not a read. That is a mutation.
By labelling a mutation-capable operation as a read, the Firefox vulnerability created a dangerous situation. Global value numbering, an optimization technique used by the compiler, treated a later slots-buffer load as redundant and reused the earlier pointer. But the earlier pointer had already become stale because the buffer had been freed.
"Nebula Security says a patched Firefox JIT flaw could be triggered by simply visiting a malicious webpage and was also used to compromise Tor Browser."
How Does the Firefox Vulnerability Actually Work?
Nebula's technical analysis traces the issue to a specific compiler contract failure. An operation capable of replacing the object's dynamic-slots buffer was labelled as a read. That incorrect contract let otherwise valid optimization logic preserve a pointer the runtime had already invalidated.
The exploit chain for this Firefox vulnerability works like this:
- An attacker crafts a malicious webpage with JavaScript that triggers the JIT flaw
- Firefox's optimizer reuses a stale pointer after the dynamic-slots buffer has been freed
- The exploit reclaims the freed allocation and leaks a hidden-class pointer
The attacker builds a fake object and corrupts a Uint8Array to gain arbitrary memory read and write - On the Android build, the exploit changes memory protections and redirects a WebAssembly function entry point to ARM64 shellcode
The result is code execution inside the browser's renderer process. On its own, that is limited to the sandboxed content process. But Nebula did not stop there.
The IonStack Browser-to-Kernel Chain
The Firefox vulnerability was used as the first stage of IonStack, a browser-to-kernel exploit chain built for an ARM64 device running Android 17. The second stage is a separate Linux kernel futex flaw called GhostLock, tracked as CVE-2026-43499.
The Firefox vulnerability provides the remote browser foothold. GhostLock carries it to root on the supported Android build. Zou said GhostLock is invoked directly from Firefox, and he added that Android's weaker sandbox makes exploitation easier. Nebula does not believe a stronger desktop sandbox would prevent the attack.
The released end-to-end code targets one supported Google build, although Zou said the browser flaw itself is not ARM-specific. The public code contains Firefox 151.0 offsets for the supported ARM64 Android 17 build. Zou said each exploitation step is architecture-independent and described the x86 path as more stable, although Nebula has not completed the full chain for that architecture.
Which Firefox Versions Are Affected by This Vulnerability?
The Firefox vulnerability affects a specific range of releases. The Hacker News traced the faulty alias declaration through Mozilla's source history to Bug 1995077, which landed for Firefox 147. The override is present in Firefox 151.0.2 and absent from Firefox 151.0.3.
That places the affected stable-release range at Firefox 147 through 151.0.2. Mozilla's advisory does not list Firefox ESR, and the faulty override is absent from Firefox ESR 140.12. If you are using Firefox ESR, you are not affected by this specific vulnerability.
Does the Firefox Vulnerability Affect Tor Browser?
Yes. Zou told The Hacker News that every Tor Browser release that incorporated a vulnerable Firefox version was affected. Researchers have not identified the exact Tor releases, but the implication is clear: if your Tor Browser is based on an affected Firefox version, it is vulnerable.
Tor Browser users should check for updates and apply them immediately. The Tor Project typically releases updates shortly after Mozilla patches critical vulnerabilities.
Has This Firefox Vulnerability Been Exploited in the Wild?
As of July 28, 2026, the available primary-source record does not establish exploitation against users in the wild. That is good news, but it does not mean the Firefox vulnerability is safe to ignore.
Nebula released public exploit material. The technical details are now public. The PoC is available. Attackers will analyze the code and develop their own exploits. The window of opportunity is closing.
How Did Mozilla Tackle the Firefox Vulnerability?
The fix introduced by Mozilla at the source level is the removal of custom handling of read-only alias for ObjectToIterator and modifying the associated iterator method. This would ensure that the optimizer cannot consider such mutation capability as a load without an issue.
This fix came in Firefox version 151.0.3. Users who update to this version or later are protected against the Firefox vulnerability.
What About the GhostLock Kernel Flaw?
- Updating Firefox blocks the documented browser entry point, but it does not patch GhostLock itself. CVE-2026-43499 is a separate Linux kernel futex flaw that remains unpatched in the supported Android build used in Nebula's demonstration.
- For most users, the immediate concern is the Firefox vulnerability. Updating your browser prevents the remote exploitation that leads to the kernel chain. But for those running the specific affected Android build, the deeper issue remains.
What Should You Do About This Firefox Vulnerability?
- The answer is simple: update Firefox to the latest version. If you are running Firefox 147 through 151.0.2, you are vulnerable to CVE-2026-10702. Update to 151.0.3 or later.
- If you use Tor Browser, check for updates and apply them. The Tor Project will have released or will soon release a version that incorporates the Firefox fix.
- For organizations, consider the broader implications. Any browser which can be exploited simply by visiting a web page poses a serious security problem. Ensure that policies are put in place to promote or require automatic updates for these browsers.
Wrapping It Up
The Firefox CVE-2026-10702 vulnerability is a serious JIT flaw that allows remote code execution by simply visiting a malicious webpage. Tor Browser is also affected. Mozilla has released a fix in Firefox 151.0.3.
Nebula Security has demonstrated that this Firefox vulnerability can be used as part of a browser-to-kernel exploit chain on Android. The technical details are public. The PoC is available.
Update your browser now. Check your Tor Browser. And stay vigilant. This Firefox vulnerability is serious, and it is not going away just because a patch is available.
FAQ Section
What is the Firefox CVE-2026-10702 vulnerability?
It is a vulnerability in Firefox's JIT compiler that can be exploited to run any code in the Firefox browser renderer process. Accessing a malicious website will be sufficient to exploit this bug. It was fixed in Firefox 151.0.3.
Which Firefox versions are affected by this vulnerability?
The vulnerability affects Firefox 147 through 151.0.2. Firefox ESR 140.12 is not affected. Users should update to Firefox 151.0.3 or later.
Does this Firefox vulnerability affect Tor Browser?
Yes. Nebula Security confirmed that every Tor Browser release incorporating a vulnerable Firefox version is affected. Tor Browser users should check for updates.
Has the Firefox vulnerability been exploited in the wild?
As of July 28, 2026, no proven record of the exploit being used against users exists at the moment. The reason for this is that Nebula has publicly released an exploit code and attackers will have to develop their own.
What is the IonStack browser-to-kernel chain?
IonStack uses CVE-2026-10702 as the browser entry point and CVE-2026-43499 (GhostLock), a Linux kernel futex flaw, as the second stage to achieve root on a supported Android 17 build. Updating Firefox blocks the browser entry point but does not patch GhostLock.
