Researchers at Nebula Security have demonstrated that a single visit to a malicious webpage is enough to trigger CVE-2026-10702, a high-severity flaw in Firefox’s JIT (just-in-time) compiler that gives an attacker arbitrary code execution inside the browser’s renderer process. No user interaction beyond loading the page is required. Mozilla patched the bug in Firefox 151.0.3 and rated it High severity. Because Tor Browser ships a modified build of Firefox, every Tor Browser release that used a vulnerable Firefox version is also affected — though researchers have not yet identified the exact Tor release numbers that drew the line.
The research group named their attack chain IonStack, a browser-to-kernel exploit sequence that begins with the renderer bug and chains through additional steps to reach the host operating system. The released code targets an ARM64 device running Android 17, and the researchers say the x86 path exists but was not fully completed. The renderer-level bug itself is architecture-independent, meaning the risk extends beyond the demonstrated Android target. Nebula published technical details and exploit material publicly, which raises the likelihood that other actors will adapt the attack to additional platforms.
How to check if you’re affected
Affected versions of Firefox are any release before 151.0.3. Open Help → About Firefox to see your version number; if it is below 151.0.3, update immediately. Tor Browser users should update to the latest release from the official Tor Project website — affected versions are those built on Firefox releases before 151.0.3.