Critical Firefox JIT Flaw Allows Browser Compromise via Single Malicious Webpage Visit
A recently patched vulnerability in Firefox's Just-In-Time compiler could allow attackers to execute arbitrary code by simply tricking a user into visiting a malicious webpage, also impacting the Tor Browser.
Researchers at Nebula Security have disclosed a critical vulnerability affecting Mozilla's Firefox browser, tracked as CVE-2026-10702. This flaw resides within the browser's Just-In-Time (JIT) compiler and can be triggered by a user simply visiting a malicious webpage, requiring no further interaction or special settings.
The vulnerability allows for arbitrary code execution within the browser's sandboxed content process. While this sandbox typically limits the damage an exploit can cause, Nebula Security has demonstrated its potential by using it as the initial stage in a more complex exploit chain called IonStack. This chain, designed for an ARM64 Android device, aims to escalate privileges from the browser to the kernel.
Mozilla has addressed the issue in Firefox version 151.0.3. The vulnerability was present in Firefox releases from version 147 up to 151.0.2. Notably, the Tor Browser, which is based on Firefox, was also affected in all versions that incorporated a vulnerable Firefox build. The exact range of affected Tor Browser releases has not been specified by the researchers.
Nebula Security's technical analysis points to an issue within the MObjectToIterator function when operating with skipRegistration set to true. The JIT compiler, responsible for optimizing frequently executed JavaScript code into native machine code, incorrectly treated an operation that could reallocate memory as a simple read. This misclassification allowed the compiler's optimization logic to reuse a pointer that had already been invalidated, leading to memory corruption.
The exploit developed by Nebula reclaims the freed memory allocation, leaks a pointer to a hidden class, constructs a fake object, and corrupts a Uint8Array to achieve arbitrary memory read and write capabilities. For the IonStack exploit chain, this browser foothold is then leveraged with a separate Linux kernel vulnerability, CVE-2026-43499 (dubbed GhostLock), to gain root privileges on the targeted Android build.
While the browser flaw itself is not architecture-specific, Nebula has released public exploit code targeting an ARM64 Android build. They have also indicated that the x86 exploitation path is more stable, though not yet fully developed. The researchers have not yet identified any instances of this vulnerability being exploited in the wild.
Firefox users are strongly advised to update to the latest version, 151.0.3, to patch this critical vulnerability. While updating Firefox addresses the initial browser compromise vector, it does not patch the secondary kernel exploit (GhostLock) used in Nebula's IonStack chain. The full impact and exploitation potential of this browser flaw, especially when chained with other vulnerabilities, highlights the ongoing need for robust browser security and timely patching.
The new article from Cyber Security News provides additional technical details regarding CVE-2026-10702, specifically outlining the vulnerability's root cause within SpiderMonkey's Ion/Warp JIT compilation pipeline. It elaborates on the specific optimization passes involved, including Object.keys() processing, lazy property resolution, and alias analysis, which lead to a use-after-free condition. The article also highlights the rapid disclosure and patch cycle, noting Nebula Security's zero-day report to Mozilla on May 20, 2026, and the subsequent patches.