Security shop Nebula has demonstrated that a single page load can break Tor Browser’s protections, exploiting a Firefox just-in-time compiler bug that Mozilla already patched.
The vulnerability, CVE-2026-10702, enables arbitrary code execution inside the browser’s renderer process. Mozilla rated it High and closed it in Firefox 151.0.3. No configuration change or extra user step is needed, according to Nebula CEO Eten Zou: simply visiting the page is sufficient to trigger it.
Any Tor Browser build bundling a vulnerable Firefox version is exposed, though the exact Tor releases have not been pinned down. The affected stable range runs from Firefox 147 through 151.0.2, rooted in a defective alias declaration in the JIT’s object-to-iterator handling.
By itself the bug only reaches the sandboxed content process. Nebula chained it as the opening stage of IonStack, a browser-to-kernel exploit path built for an ARM64 Android 17 device, combining it with GhostLock (CVE-2026-43499), a separate Linux kernel futex flaw that escalates to root.
The defect is a compiler-contract mismatch: an operation that can replace the object’s dynamic-slots buffer was treated as a read, so optimization kept a pointer the runtime had already invalidated. Nebula published exploit code, and Zou noted Android’s weaker sandbox eases exploitation, though a stronger desktop sandbox would not necessarily stop the attack.
Installing the Firefox update removes the documented browser entry point, but GhostLock itself remains unpatched. As of July 28, public records show no confirmed in-the-wild exploitation.
