Key Takeaways
- Nebula Security disclosed CVE‑2026‑10702, a high‑severity JIT compiler bug in Firefox that can be exploited merely by visiting a malicious webpage, with no additional user interaction required.
- The flaw affects Firefox versions 147 through 151.0.2 (including the corresponding Tor Browser builds) and was fixed in Firefox 151.0.3; Firefox ESR remains unaffected.
- Nebula released public exploit code that uses the bug as the first stage of “IonStack,” a browser‑to‑kernel attack chain targeting an ARM64 device running Android 17.
- The second stage of IonStack relies on a separate Linux kernel futex vulnerability (CVE‑2026‑43499, dubbed “GhostLock”) to achieve root privileges on the same Android build.
- While the Firefox JIT flaw is architecture‑independent, Nebula notes the x86 exploitation path is more stable, though a full chain for that architecture has not yet been completed.
- Updating Firefox to the latest release blocks the documented browser entry point, but it does not mitigate the underlying GhostLock kernel flaw.
Overview of the Disclosed Firefox JIT Vulnerability
Nebula Security identified a critical just‑in‑time (JIT) compiler defect in Firefox, tracked as CVE‑2026‑10702. The bug permits arbitrary code execution inside the browser’s renderer process when a user simply loads a malicious webpage; no extra clicks, downloads, or permission prompts are needed. Mozilla classified the issue as “High” and addressed it in the Firefox 151.0.3 point release. Because Tor Browser bundles Firefox, any Tor release that incorporated a vulnerable Firefox version was also exposed, although Nebula has not pinpointed the exact Tor builds affected.
Affected Firefox Versions and Patch Status
The faulty code originated from an alias declaration introduced in Bug 1995077, which landed in Firefox 147. The problematic override persisted through Firefox 151.0.2 and was removed in the 151.0.3 update. Consequently, the vulnerable stable‑release window spans Firefox 147 → 151.0.2. Mozilla’s security advisory does not list Firefox ESR, and inspection of the ESR 140.12 source shows the offending alias is absent, leaving ESR users safe from this particular flaw. As of July 28, 2026, there is no publicly available evidence that the vulnerability has been exploited in the wild.
Nebula’s Public Exploit and the IonStack Chain
Alongside the disclosure, Nebula published exploit material that demonstrates how CVE‑2026‑10702 can serve as the initial foothold in a multi‑stage attack dubbed “IonStack.” The released code targets a specific ARM64 Android 17 build supplied by Google, containing the precise Firefox 151.0 offsets needed for that platform. Nebula’s CEO, Eten Zou, emphasized that the underlying browser bug is not ARM‑specific; the exploit’s architecture‑dependence stems mainly from the subsequent kernel‑level steps. While the x86 path is described as more stable, Nebula has not yet finished a full end‑to‑end chain for desktop processors.
Technical Root Cause: MObjectToIterator Misclassification
Nebula’s technical analysis traces the bug to the MObjectToIterator operation when it runs with skipRegistration set to true. Firefox’s JIT compiler translates hot JavaScript functions into native machine code, requiring it to conservatively track which operations may touch memory. In this case, the JIT incorrectly labelled a operation capable of replacing an object’s dynamic‑slots buffer as a mere “read.” Consequently, global value numbering (GVN) optimisation treated a later slots‑buffer load as redundant and reused a pointer that had already been freed by the runtime.
Exploitation Flow: From Stale Pointer to Arbitrary Memory Access
The mistaken optimisation leaves a stale pointer hanging after the original slots buffer is freed. Nebula’s exploit reclaims the freed memory region, leaks a hidden‑class pointer, fabricates a fake object, and then corrupts a Uint8Array to gain arbitrary read and write primitives within the renderer process. On the Android target, these primitives are used to alter memory page protections and hijack the entry point of a WebAssembly function, redirecting execution to attacker‑supplied ARM64 shellcode. This chain demonstrates how a subtle JIT mis‑classification can be leveraged to break out of the browser sandbox.
From Browser Foothold to Kernel Privilege: GhostLock
The browser exploit constitutes only the first stage of IonStack. Nebula couples it with a distinct Linux kernel futex vulnerability, CVE‑2026‑43499, which they christen “GhostLock.” The Firefox JIT flaw provides remote code execution in the content process; GhostLock then elevates that privilege to root on the supported Android 17 build. Zou explained that GhostLock is invoked directly from the compromised Firefox process, taking advantage of Android’s relatively weaker application sandbox compared to desktop Linux environments. He added that even a stronger desktop sandbox would not necessarily prevent the attack, because the browser flaw already grants arbitrary memory read/write that could be used to bypass many mitigations.
Implications for Users and Mitigation Steps
For end‑users, the immediate defense is to update Firefox to version 151.0.3 or later, which removes the faulty alias and prevents the JIT optimisation that underpins CVE‑2026‑10702. This action blocks the documented browser entry point used by IonStack. However, updating Firefox does not address the underlying GhostLock kernel issue; devices remain potentially exposed to the second stage if an attacker can achieve code execution via another vector. Nebula recommends that Android 17 users also apply any available kernel patches for CVE‑2026‑43499 or consider additional mitigations such as SELinux enforcing modes and restricting untrusted WebAssembly execution.
Conclusion: A Reminder of JIT‑Complexity Risks
The CVE‑2026‑10702 case underscores how subtle mistakes in a JIT compiler’s memory‑access tracking can undermine browser sandbox guarantees. By mis‑classifying a mutating operation as a read‑only load, the optimiser retained a dangling pointer that attackers could resurrect to achieve arbitrary memory control. Nebula’s public exploit shows that, when paired with a kernel weakness, such a flaw can enable a full browser‑to‑kernel compromise. The incident reinforces the importance of rapid browser updates, diligent JIT auditing, and defense‑in‑depth strategies that treat both browser and OS layers as critical attack surfaces.