A recent discovery by Nebula Security highlights a significant vulnerability in the Tor Browser, which can be exploited merely by visiting a malicious webpage. The flaw, identified as CVE-2026-10702, allows arbitrary code execution within the browser’s renderer process. Mozilla has addressed this issue in the Firefox 151.0.3 update, rating the flaw as high severity.
Understanding the Vulnerability
The vulnerability impacts every Tor Browser version that incorporated the affected Firefox releases, although specific versions remain unidentified. According to Eten Zou, CEO of Nebula Security, users don’t need to adjust any settings or perform additional actions to trigger this exploit. The flaw operates within Firefox’s sandboxed content process and was used as the initial stage in a complex exploit chain called IonStack.
Nebula Security has released public exploit materials demonstrating how CVE-2026-10702 acts as the starting point for an attack on ARM64 devices running Android 17. While the exploit targets a specific Google build, the vulnerability itself is not exclusive to ARM architecture. Zou describes the x86 path as more stable, though a complete chain for this architecture is not yet available.
Technical Details and Exploitation
The vulnerability originates from a faulty alias declaration in Mozilla’s source code, leading to misinterpretation by Firefox’s just-in-time (JIT) compiler. This misinterpretation allows the reuse of a stale pointer, facilitating arbitrary memory read and write permissions. Nebula’s exploit leverages these permissions to manipulate memory and execute ARM64 shellcode.
The issue is traced to MObjectToIterator, with Firefox incorrectly treating a critical operation as a read. This oversight allowed optimization routines to preserve an invalidated pointer, enabling the exploit. Mozilla’s fix involves removing problematic alias handling and adjusting iterator operations to prevent similar issues.
Implications and Recommendations
IonStack’s second stage involves a separate vulnerability, CVE-2026-43499, known as GhostLock, which affects the Linux kernel. This flaw is pivotal in achieving root access on the targeted Android build. Zou notes that Android’s weaker sandbox contributes to easier exploitation, though a more robust desktop sandbox might not completely prevent attacks.
Users are strongly advised to update their Firefox browsers to the latest version to mitigate the browser entry point vulnerability. However, the underlying GhostLock flaw requires separate attention. Continuous vigilance and timely updates are crucial to maintaining browser security and protecting against potential exploits.
