Full Report
Nebula Security says a patched Firefox JIT flaw could be triggered by simply visiting a malicious webpage and was also used to compromise Tor Browser. Tracked as CVE-2026-10702, the bug provides arbitrary code execution inside the browser's renderer process. Mozilla rated it High and fixed it in the Firefox 151.0.3 update. "No settings or additional user interaction are required," Eten Zou,
Analysis Summary
# Vulnerability: Firefox JIT Compiler Use-After-Free
## CVE Details
- **CVE ID:** CVE-2026-10702
- **CVSS Score:** Not explicitly listed in text (Assumed 8.8+ based on "High" rating and RCE impact)
- **CWE:** CWE-416 (Use-After-Free)
## Affected Systems
- **Products:** Mozilla Firefox, Tor Browser
- **Versions:** Firefox 147 through 151.0.2. (Tor Browser releases incorporating these Firefox versions are also affected).
- **Configurations:** Systems running affected browser versions; specifically noted as verified on ARM64 (Android 17) and x86 architectures.
## Vulnerability Description
The flaw exists within the Just-In-Time (JIT) compiler's handling of the `MObjectToIterator` operation when `skipRegistration` is set to true. The compiler incorrectly flagged this operation as a "read-only" alias. However, resolving a lazy property during this operation can trigger a memory allocation for a replacement dynamic-slots buffer, subsequently freeing the old buffer. Because the optimizer treated the step as a harmless read, it allowed Global Value Numbering (GVN) to reuse a stale pointer to the previously freed buffer, leading to a Use-After-Free (UAF) condition.
## Exploitation
- **Status:** PoC available (Released by Nebula Security as part of "IonStack"); used in demonstration chains.
- **Complexity:** Medium (Requires heap grooming to reclaim freed memory).
- **Attack Vector:** Network (Remote)
## Impact
- **Confidentiality:** High (Arbitrary memory read capabilities)
- **Integrity:** High (Arbitrary memory write and code execution within the renderer process)
- **Availability:** High (Potential for process crashes or full system takeover when chained with kernel exploits)
## Remediation
### Patches
- **Mozilla Firefox:** Update to version 151.0.3 or later.
- **Tor Browser:** Update to the latest version incorporating the Firefox 151.0.3 fix.
### Workarounds
- No specific software workarounds (e.g., configuration changes) were identified; updating the application is the primary remediation.
## Detection
- **Indicators of Compromise:** Unusual renderer process crashes or unexpected WebAssembly execution patterns.
- **Detection methods and tools:** Monitoring for exploitation attempts via browser-based memory defense tools or endpoint detection and response (EDR) systems looking for shellcode execution originating from browser processes.
## References
- **Mozilla Advisory:** hxxps[://]www[.]mozilla[.]org/en-US/security/advisories/mfsa2026-54/
- **Nebula Security Analysis:** hxxps[://]nebusec[.]ai/research/ionstack-part-1-cve-2026-10702/
- **Source Code Fix:** hxxps[://]github[.]com/mozilla-firefox/firefox/commit/e43e678
- **Bugzilla Entry:** hxxps[://]bugzilla[.]mozilla[.]org/show_bug.cgi?id=1995077