"No settings or additional user interaction are required," Eten Zou, CEO of Nebula Security, told The Hacker News.
CVE-2026-10702: a single-visit remote compromise
Nebula Security published research showing that a just‑in‑time (JIT) compiler bug in Firefox — tracked as CVE-2026-10702 — can be triggered simply by visiting a malicious webpage. Mozilla rated the flaw High and fixed it in Firefox 151.0.3. According to the public trace, the faulty override that enabled the issue entered Firefox in Bug 1995077 and first appeared in Firefox 147; it is present through Firefox 151.0.2 and absent from 151.0.3. Mozilla’s advisory does not list Firefox ESR, and the faulty override is absent from Firefox ESR 140.12.
How Nebula turned a browser bug into root on a phone — IonStack and GhostLock
Nebula released exploit material and used CVE-2026-10702 as the first stage of an end‑to‑end chain they call IonStack. The public code targets an ARM64 device running Android 17 and contains Firefox 151.0 offsets for a supported Google build. The browser flaw gives arbitrary code execution in the renderer (sandboxed content) process; Nebula’s Android code then changes memory protections and redirects a WebAssembly function entry point to ARM64 shellcode.
IonStack’s second stage is CVE-2026-43499, a separate Linux kernel futex flaw Nebula calls GhostLock. In Nebula’s chain, CVE-2026-10702 provides the remote browser foothold and CVE-2026-43499 carries that foothold to root on the supported Android build. Zou told The Hacker News that GhostLock is invoked directly from Firefox, and that Android’s weaker sandbox makes exploitation easier — while adding that Nebula does not believe a stronger desktop sandbox would have prevented the attack.
The technical failure: JIT assumptions and a stale slots pointer
Nebula’s analysis traces the bug to MObjectToIterator when it runs with skipRegistration set to true. Firefox’s JIT turns frequently executed JavaScript into native code and relies on precise rules about which operations can touch memory. In this case, an operation that can replace an object’s dynamic‑slots buffer was incorrectly treated as a read. Resolving a lazy property can allocate a replacement dynamic‑slots buffer and free the original; global value numbering then treated a later slots‑buffer load as redundant and reused the earlier pointer after it had become stale.
Nebula’s exploit reclaims the freed allocation, leaks a hidden‑class pointer, builds a fake object, and corrupts a Uint8Array to achieve arbitrary memory read and write. On the targeted Android build, the chain culminates by changing memory protections and redirecting execution to ARM64 shellcode. Mozilla’s source‑level fix removes the custom read‑only alias handling from ObjectToIterator and adjusts the related iterator operation so the optimiser no longer preserves the stale pointer.
Which Firefox and Tor Browser releases were affected
The Hacker News reported Nebula’s statement that every Tor Browser release that incorporated a vulnerable Firefox version was affected, though researchers have not identified the exact Tor releases. The public record places the affected stable Firefox range at versions 147 through 151.0.2; the issue is corrected in 151.0.3. As of July 28, 2026, primary‑source records do not establish exploitation against users in the wild.
What this means for Firefox users, Tor users, and Android device owners
- Firefox users: Updating to the fixed release (Firefox 151.0.3 or later) blocks the documented browser entry point (CVE-2026-10702). Mozilla’s fix addresses the JIT aliasing error in ObjectToIterator.
- Tor users: Nebula says every Tor Browser release built on a vulnerable Firefox version was affected, but the researchers have not published the exact Tor release identifiers that incorporated the vulnerable code. Tor users should follow Tor Browser updates that incorporate Mozilla’s patched Firefox build.
- Android device owners and administrators: Nebula’s end‑to‑end code targets an ARM64 Android 17 build and uses GhostLock (CVE-2026-43499) to escalate to root on the supported build. Updating Firefox blocks the browser foothold but does not patch GhostLock itself; remediation of the kernel vulnerability is a separate step.
Nebula’s public exploit code includes ARM64 offsets for Firefox 151.0 on the supported Android build, and the researchers described the x86 exploitation path as more stable in theory while noting they had not completed the full x86 chain.
The concrete takeaway is narrow but stark: a single webpage visit could deliver arbitrary code inside the renderer, and Nebula showed how that foothold can be extended to root on a targeted Android build using a separate kernel bug. Updating Firefox is the immediate, documented mitigation for the browser entry point; addressing the kernel escalation requires action on GhostLock.
Read the original report at The Hacker News: https://thehackernews.com/2026/07/researchers-show-single-malicious.html
