CVE-2026-10702: One Click Is All It Takes to Compromise Tor…

A JIT compiler bug in Firefox propagates to Tor Browser, enabling arbitrary code execution on a single page visit. Mozilla patched it in Firefox 151.0.3, but Tor Browser releases built on vulnerable Firefox versions remain exposed. Nebula Security has published a full exploit chain — IonStack — that escalates from browser to kernel root on Android 17 ARM64.

A vulnerability in Firefox's JavaScript engine allows arbitrary code execution inside the renderer sandbox simply by visiting a malicious web page. The flaw, tracked as CVE-2026-10702, extends to Tor Browser — the anonymity-focused browser — and a public exploit has already been released by Nebula Security. The news was published on July 29, 2026.

The impact goes beyond a routine patch advisory: researchers have demonstrated a complete browser-to-kernel-root chain on Android, turning a compiler optimization error into a practical vehicle for surveillance and targeted attack.

Key Takeaways

CVE-2026-10702 is a JIT miscompilation in Firefox's SpiderMonkey engine: visiting a malicious page triggers the exploit with no further user interaction.
Every Tor Browser release that incorporated a vulnerable Firefox version is affected, though researchers have not identified the specific releases.
Nebula Security published public exploit material with offsets for Firefox 151.0 on ARM64 Android 17 builds, demonstrating escalation to root privileges via the IonStack chain.
Mozilla fixed the vulnerability in Firefox 151.0.3; ESR 140.12 is not affected because the faulty override is absent.

The Mechanism: When the JIT Compiler Lies About Its Own Contract

The bug resides in the SpiderMonkey JIT compiler's MObjectToIterator operation. When executed with the skipRegistration=true parameter, this operation was incorrectly classified as read-only despite being capable of allocating a new dynamic-slots buffer and freeing the previous one. This alias-contract violation has cascading effects: the Global Value Numbering (GVN) pass, which eliminates redundant computations, treated a subsequent buffer load as superfluous and reused a now-invalid pointer.

The exploit published by Nebula Security exploits this inconsistency window. It reclaims the freshly freed allocation, constructs a fake object by corrupting the Uint8Array structure, and achieves arbitrary read/write inside the renderer process sandbox. Mozilla's fix removes the custom read-only alias handling from ObjectToIterator and adjusts the related iterator operation.

According to the NVD record for CVE-2026-10702, the associated weaknesses are CWE-843 (Type Confusion) and CWE-733 (Compiler Optimization Removal). The CPE indicates Mozilla Firefox versions up to 151.0.2, excluding the patched 151.0.3. The NVD record reports two competing CVSS 3.1 vectors: one with a high score (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H, contributed by Red Hat SADP) and one with a low score (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L, contributed by CISA-ADP).

From Firefox to Tor Browser: Inherited Anonymity and Its Fragility

Tor Browser is built on Firefox Extended Support Release, with modifications geared toward network privacy. The shared codebase has a side effect: rendering-engine vulnerabilities propagate automatically. Eten Zou, CEO of Nebula Security, confirmed that every Tor Browser release incorporating a vulnerable Firefox version was affected, though researchers did not identify the exact releases. As of July 28, 2026, no in-the-wild exploitation against users had been observed.

The specific gravity of the Tor target lies in its user profile: journalists, activists, security researchers, and operators in high-risk zones. For these subjects, browser compromise is not a productivity incident but a breach of their personal security perimeter. The renderer sandbox, designed to contain damage, becomes insufficient when the bug sits in the heart of the JIT execution engine — precisely where user code meets the native compiler.

"No settings or additional user interaction are required. Visiting a malicious webpage is enough to trigger it" — Eten Zou, CEO Nebula Security

IonStack: From Sandbox to Android Root

Nebula Security turned CVE-2026-10702 into the first stage of IonStack, a browser-to-kernel chain. The second stage exploits CVE-2026-43499 (GhostLock), a vulnerability in the Linux kernel's futex subsystem with CVSS 7.8 HIGH (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The demonstrated chain achieves root privileges on Android 17 ARM64.

The published materials contain specific offsets for Firefox 151.0 on Google-supported ARM64 Android 17 builds. Zou indicated the exploit is "more stable" on x86_64, but the full browser-to-kernel chain has not been completed for that architecture. The Firefox 151.0.3 patch does not fix GhostLock: the two vulnerabilities remain technically distinct and require separate mitigations.

The publication of an end-to-end exploit with pre-built offsets drastically lowers the barrier to entry for actors seeking to replicate the attack. No zero-day research or target reverse-engineering is required: the path is documented and the code is available.

What to Do Now

Update Firefox to version 151.0.3 or later: Mozilla fixed CVE-2026-10702 in this release, and the official CPE confirms versions up to 151.0.2 are affected.
Verify the underlying Firefox version incorporated in Tor Browser: until the Tor release bundles Firefox 151.0.3 or later, the browser retains the exposed attack surface.
Assess exposure of Firefox ESR 140.12: according to Nebula Security, the faulty override is absent in this version, which is therefore not vulnerable to the described JIT mechanism.
Isolate Android 17 ARM64 devices running unpatched Firefox: the IonStack chain demonstrated by Nebula Security reaches kernel root on this specific combination.

Why the Sandbox Is No Longer Enough

The lesson of CVE-2026-10702 is structural. Sandbox-based security guarantees — renderer containment, process isolation, privilege restrictions — assume the code executing inside the sandbox undergoes correct translation. When the translator itself, the JIT compiler, violates its own internal contracts, the boundary between "inside" and "outside" dissolves at the moment of optimization.

Nebula Security's work exposed this fragility with surgical precision: not a buffer overflow, not a classic use-after-free, but a misclassification in the alias-analysis system the compiler uses to decide what is safe to eliminate. Optimization, from accelerator, becomes vulnerability.

For Tor Browser users, the implication is specific and severe. Network anonymity — onion routing, circuit isolation, traffic-analysis resistance — becomes irrelevant if the browser itself executes adversary-controlled code. The Tor network protects the packet, not the process that generates it. And when the process is compromised on the first click, network protection remains theatrical.

The security community now awaits identification of the actually affected Tor Browser releases and any subsequent corrective update. Until then, the combination of public exploit and high-value targets constitutes a risk profile that passive defenses do not cover.

Information verified against cited sources and current as of publication.

Sources

Sources and references