Single Webpage Visit Triggers Firefox JIT Flaw (CVE-2026-10702) to Compromise Tor Browser
Executive Summary
On July 29, 2026, security research firm Nebula Security disclosed technical details and proof-of-concept (PoC) exploit material for CVE-2026-10702, a critical Just-In-Time (JIT) compilation vulnerability in Mozilla Firefox and Tor Browser. The flaw allows remote unauthenticated attackers to achieve arbitrary code execution inside the browser renderer process without requiring any user interaction or custom configuration settings beyond visiting a malicious web page (The Hacker News).
Mozilla rated the vulnerability as High severity and issued a fix in Firefox 151.0.3. Crucially, because Tor Browser relies on the underlying Firefox codebase, all Tor Browser releases incorporating the affected Firefox versions (stable releases 147 through 151.0.2) were similarly vulnerable to remote exploitation, presenting severe risks to journalists, dissidents, and privacy-conscious users worldwide (The Hacker News).
Deep-Dive Technical Analysis
SpiderMonkey JIT Alias Misclassification
The root cause of CVE-2026-10702 lies within SpiderMonkey, Mozilla's JavaScript engine, specifically inside the MObjectToIterator instruction when executed with the skipRegistration flag set to true (The Hacker News).
During JIT compilation, SpiderMonkey tracks memory operations to optimize native machine code safely. Compiler optimization passes categorize instructions as reads, writes, or side-effecting operations. In this vulnerability, SpiderMonkey incorrectly labeled MObjectToIterator as a read-only operation. In reality, resolving a lazy property on an object can trigger dynamic allocation of a replacement dynamic-slots buffer and free the old buffer memory (The Hacker News).
Optimization Contract Failure & Use-After-Free
Because the JIT compiler optimizer treated the operation as a harmless, mutation-free read:
* Global Value Numbering (GVN): The compiler optimization pass assumed the dynamic-slots buffer pointer remained valid across the iterator call.
* Stale Pointer Reuse: Subsequent loads from the slots buffer were treated as redundant and instructed to reuse the earlier pointer value.
* Use-After-Free (UAF): Because the underlying runtime had freed and replaced the dynamic-slots buffer during property resolution, the JIT-compiled native code retained and used a stale pointer to freed heap memory (The Hacker News).
Exploit Mechanics
Nebula Security demonstrated an end-to-end exploit chain using this Use-After-Free primitive:
* Heap Grooming: The exploit reclaims the freed allocation with attacker-controlled data.
* Hidden Class Pointer Leak: By leaking object shape and hidden-class pointers, the exploit bypasses Address Space Layout Randomization (ASLR).
* Fake Object Construction: The attacker constructs a fake JavaScript object and corrupts a Uint8Array's backing store length and buffer pointer, establishing an arbitrary memory read/write primitive inside the browser content process (The Hacker News).
* Execution Hijacking: On ARM64/Android platforms, the exploit modifies memory protections on a WebAssembly (Wasm) function entry point, redirecting execution to ARM64 shellcode (The Hacker News).
The "IonStack" Exploit Chain & Tor Browser Threat Model
The IonStack Exploit Chain
Nebula Security integrated CVE-2026-10702 as the initial browser foothold in IonStack, a full browser-to-kernel chain built for ARM64 Android devices (The Hacker News):
* Stage 1 (Browser Foothold): CVE-2026-10702 achieves arbitrary code execution inside the Firefox/Tor Browser renderer process.
* Stage 2 (Kernel Escalation - "GhostLock"): The exploit invokes CVE-2026-43499 ("GhostLock"), a separate Linux kernel futex vulnerability, directly from the compromised browser process to break out of the sandbox and gain full root privileges on the device (The Hacker News).
Nebula Security CEO Eten Zou noted that while the initial demonstration targeted ARM64 Android, the browser JIT vulnerability itself is architecture-independent, with x86 exploitation logic expected to be even more stable (The Hacker News).
Implications for Tor Browser and Privacy-Centric Users
Tor Browser relies heavily on Firefox as its foundation. A zero-click browser RCE flaw represents an existential threat to anonymity tools:
* Deanonymization: Once code execution is gained inside the browser renderer, attackers can query local network interfaces, system hardware IDs, and real IP addresses, completely bypassing Tor network routing.
* Zero-Interaction Drive-By Attacks: Because no user prompts, downloads, or custom configurations are required, simply visiting a compromised or malicious onion service or website triggers the attack chain.
Affected Releases & Source Tracking
Mozilla's source history traces the faulty alias declaration to Bug 1995077, which landed in Firefox 147 (The Hacker News).
* Affected Stable Releases: Firefox 147 through 151.0.2, as well as all Tor Browser builds compiled from these Firefox branches.
* Patched Releases: Firefox 151.0.3 and updated Tor Browser releases.
* ESR Releases: The faulty override was absent from Firefox ESR 140.12 (The Hacker News).
Actionable Mitigations
1. Immediate Browser Upgrades:
* Upgrade standalone Firefox installations to version 151.0.3 or higher immediately.
* Update Tor Browser to the latest patched release incorporating Firefox 151.0.3 code.
2. Enable Strict JavaScript Controls in Tor Browser:
* In Tor Browser, set the Security Level to "Safest". This disables JavaScript entirely on non-HTTPS sites and restricts JIT compilation, blocking the primary attack surface required for CVE-2026-10702 exploitation.
* Configure NoScript to block JIT and untrusted inline scripts across all sensitive browsing sessions.
3. Kernel & OS Hardening:
* Apply Linux/Android kernel updates to address secondary sandbox-escape vectors such as CVE-2026-43499 (GhostLock).
* Employ containerized or virtualized browser isolation (e.g., Qubes OS, disposable VMs) when accessing untrusted onion services or high-risk web pages.
Reported on July 29, 2026 for DigitalSpying.com. Sources: The Hacker News