Nebula Security released a complete browser-to-kernel exploit chain for CVE-2026-10702, a Firefox JIT compiler flaw that requires no user interaction beyond visiting a malicious webpage. The release demonstrated the vulnerability as the first stage of a two-vulnerability chain called IonStack, which achieves code execution inside the browser’s renderer process and then escalates to root on Android devices. Every Tor Browser release built on an affected Firefox version is exposed to the same initial exploit, according to Nebula’s CEO Eten Zou.
CVE-2026-10702: A JIT Stale-Pointer Flaw in Firefox’s MObjectToIterator
CVE-2026-10702 sits in Firefox’s JIT compiler, specifically in the handling of MObjectToIterator when run with the skipRegistration=true flag. The root cause: Firefox’s JIT treated an operation as a read when it could in fact replace the object’s dynamic-slots buffer. This allowed global value numbering to reuse a stale pointer — a classic type confusion pattern in modern JIT compilers — enabling arbitrary code execution inside the renderer process.
Mozilla rated the flaw High severity and fixed it in Firefox 151.0.3. The affected range is Firefox 147 through 151.0.2. Firefox ESR 140.12 is not affected. As of July 28, no confirmed in-the-wild exploitation had been reported.
IonStack: From Malicious Webpage to Root on Android 17
Nebula used CVE-2026-10702 as the first stage of IonStack, targeting an ARM64 device running Android 17. The second stage is CVE-2026-43499, which Nebula calls GhostLock — a Linux kernel futex flaw that escalates privileges from the compromised renderer process to root. Zou noted that Android’s weaker sandbox makes exploitation easier than a hardened desktop environment, but also stated that a stronger desktop sandbox would not necessarily prevent the initial browser-stage attack.
The GhostLock kernel exploit targeting Android 17 remains unpatched, meaning users who update Firefox but run Android 17 retain a kernel-level risk from the second stage even after the browser flaw is closed.
Tor Browser Users Face Deanonymization from a Single Webpage Visit
The implications for Tor Browser users are particularly acute. Tor Browser is commonly used by journalists, activists, and individuals in high-risk environments who depend on browser-level anonymity as a meaningful protection layer. An attacker who can serve a malicious webpage to a Tor Browser user running an affected Firefox base can execute code inside the browser’s renderer process — the first step toward deanonymizing the session.
Which Tor Browser Releases Are Affected
Zou stated that every Tor Browser release incorporating a vulnerable Firefox version is affected, though Nebula did not identify specific Tor Browser release numbers in its disclosure. The affected Firefox range — versions 147 through 151.0.2 — maps onto Tor Browser releases built during that period. Tor Browser users should update to the latest release, which is based on Firefox ESR 140.12 and is explicitly not affected by CVE-2026-10702.
How the x86 Threat Picture Differs from the Demonstrated Android Chain
The IonStack chain was demonstrated against ARM64 hardware on Android 17, but Zou stated the vulnerability itself is architecture-independent. Developing offsets for x86 or x86-64 desktop targets would require additional research, but the underlying flaw is present in affected Firefox builds across all platforms. Zou’s framing suggests the ARM64 demonstration is a proof of weaponizability, not a ceiling on the attack’s reach.
Nebula’s IonStack Release Before GhostLock Kernel Patch Creates Layered Remediation Risk
The release of a working exploit chain against a patched vulnerability in a production browser — combined with an unpatched second stage in the host operating system — presents defenders with a layered remediation challenge. Closing CVE-2026-10702 by updating Firefox eliminates the entry point, but the GhostLock kernel flaw in Android 17 remains open, and users who update their browser while running an unpatched Android kernel retain partial exposure.
Nebula’s decision to publish a full working exploit chain before a kernel patch is available for Android 17 follows an increasingly common pattern in browser security research, where the browser-level fix is considered sufficient justification for publishing complete attack chains even when downstream components remain vulnerable. Mozilla’s patch in Firefox 151.0.3 covers the initial code execution stage; users should apply it regardless of Android patch status, as it removes the attacker’s first foothold. Tor Browser users should prioritize the update given the heightened consequence of renderer-level compromise in an anonymity-dependent context.
