Cybersecurity firm **Nebula Security** has unveiled details about a critical vulnerability in **Mozilla Firefox**'s JIT compiler, **CVE-2026-10702**. This high-severity bug, rated as such by **Mozilla**, enables arbitrary code execution within the browser's renderer process.  ### Simple Trigger, High Impact According to **Eten Zou**, CEO of **Nebula Security**, exploiting **CVE-2026-10702** requires no user interaction beyond visiting a specially crafted malicious webpage. "No settings or additional user interaction are required," Zou stated. This makes it a particularly dangerous 'drive-by' attack vector. Crucially, every **Tor Browser** release that incorporated a vulnerable **Firefox** version was also affected, though specific **Tor** releases have not yet been pinpointed. **Mozilla** addressed this flaw in the **Firefox 151.0.3** update. Users are strongly advised to update their browsers immediately. ### IonStack: A Browser-to-Kernel Chain While **CVE-2026-10702** initially provides code execution within **Firefox**'s sandboxed content process, **Nebula Security** demonstrated its potential as the first stage of 'IonStack'. This is a sophisticated browser-to-kernel exploit chain designed for **ARM64** devices running **Android 17**. **Nebula** has released public exploit material on GitHub, detailing how the flaw can be leveraged. Although the current end-to-end code targets a specific **Google** build, the browser flaw itself is architecture-independent, with **Nebula** noting the **x86** path as more stable, despite not completing the full chain for that architecture. ### The Technical Root of the Flaw **Nebula**'s technical analysis traces the issue to `MObjectToIterator` when it operates with `skipRegistration` set to true. **Firefox**'s JIT compiler, responsible for converting frequently executed JavaScript into native machine code, incorrectly treated this operation as a simple read. However, resolving a lazy property within this operation can allocate a new dynamic-slots buffer and free the old one. Global value numbering then mistakenly considered a subsequent slots-buffer load redundant, reusing a pointer that had already become stale. This critical misjudgment allowed for memory corruption. **Nebula**'s exploit reclaims the freed allocation, leaks a hidden-class pointer, constructs a fake object, and corrupts a `Uint8Array` to achieve arbitrary memory read and write capabilities. The **Android**-specific component then modifies memory protections and redirects a **WebAssembly** function entry point to **ARM64** shellcode. **Mozilla**'s fix, implemented at the source level, removes custom read-only alias handling from `ObjectToIterator` and adjusts the related iterator operation. This prevents the optimizer from misinterpreting a mutation-capable step as a harmless load, thereby eliminating the retention of stale pointers. ### The 'GhostLock' Connection **CVE-2026-10702** is just the initial foothold for 'IonStack'. The second stage of the exploit chain, **CVE-2026-43499**, targets a separate **Linux kernel futex** flaw, which **Nebula** refers to as '**GhostLock**'. This kernel vulnerability elevates privileges to root on the supported **Android** build. **Zou** confirmed that **GhostLock** is invoked directly from within **Firefox**. While **Android**'s weaker sandbox simplifies exploitation, **Nebula** believes a stronger desktop sandbox would not entirely prevent such an attack. It's important to note that updating **Firefox** blocks the browser entry point, but it does not patch **GhostLock** itself, emphasizing the multi-layered nature of this threat. The affected **Firefox** stable-release range spans versions **147** through **151.0.2**. **Firefox ESR** versions appear unaffected, with the faulty override absent from **Firefox ESR 140.12**. As of July 28, 2026, there is no public record of in-the-wild exploitation of **CVE-2026-10702** against general users.