Affected Systems

Mozilla Firefox versions 147 through 151.0.2 (stable releases). Tor Browser releases incorporating vulnerable Firefox versions also affected. Firefox ESR not affected. Vulnerability is cross-platform (Windows, Linux, macOS, Android) though public exploit targets ARM64 Android 17.

Exploitation Status

Public exploit code released by Nebula Security for ARM64 Android 17. Used as first stage in IonStack browser-to-kernel exploit chain. No confirmed exploitation in the wild as of July 28, 2026. Exploit requires only visiting a malicious webpage with no user interaction.

Business Impact

High-severity JIT compiler flaw allows arbitrary code execution in Firefox renderer process by visiting malicious webpage. No user interaction required beyond page visit. Runs within sandbox but provides foothold for multi-stage attacks. Public exploit demonstrates full browser-to-root chain when combined with Linux kernel flaw CVE-2026-43499 (GhostLock) on Android. Desktop systems also vulnerable to browser compromise; stronger sandboxing may not prevent full exploitation according to researchers.

Urgency

🔴 Immediate

Recommended Actions

  • Update Mozilla Firefox to version 151.0.3 or later immediately on all endpoints
  • Update Tor Browser to latest release incorporating Firefox 151.0.3 or newer
  • Review web proxy and browser isolation logs for connections to suspicious domains between Firefox 147 release and patching date
  • Apply Linux kernel patches for CVE-2026-43499 (GhostLock) on Android and Linux systems to block second-stage privilege escalation
  • Consider deploying browser isolation technology for high-risk users until full patch deployment is verified

---

# Threat Actor Context

Actor Profile

Nebula Security is a cybersecurity research firm that disclosed CVE-2026-10702, a high-severity Firefox JIT compiler vulnerability. The organization's CEO, Eten Zou, led the research effort. Nebula Security developed IonStack, a browser-to-kernel exploit chain demonstrating the vulnerability's impact, and released public exploit material targeting ARM64 Android 17 devices. The disclosure appears motivated by security research and responsible disclosure practices, as the vulnerability was patched by Mozilla prior to public release of technical details.

TTPs (Tactics, Techniques, Procedures)

The attack leverages T1189 (Drive-by Compromise) through a malicious webpage requiring no user interaction beyond navigation. The vulnerability exploits Firefox's JIT compiler (T1203 - Exploitation for Client Execution) via incorrect alias handling in MObjectToIterator operations. The JIT compiler incorrectly labels a mutation-capable operation as read-only, allowing global value numbering optimization to preserve stale pointers after memory reallocation. Exploitation achieves arbitrary memory read/write through object corruption (T1055 - Process Injection techniques), then uses WebAssembly function entry point redirection to execute ARM64 shellcode within the sandboxed renderer process. The IonStack chain combines CVE-2026-10702 with CVE-2026-43499 (GhostLock kernel futex flaw) for privilege escalation to root on Android 17 (T1068 - Exploitation for Privilege Escalation).

Targets & Patterns

The vulnerability affects technology and software development sectors, particularly organizations and individuals relying on Firefox-based browsers for secure communications. Tor Browser users represent high-value targets due to their privacy-focused threat models, including journalists, activists, researchers, and individuals in restrictive environments. Every Tor Browser release incorporating Firefox versions 147 through 151.0.2 was vulnerable. The attack surface includes any user visiting a malicious webpage, with Android users facing elevated risk due to weaker sandbox protections compared to desktop environments. The zero-click nature (no settings changes or additional interaction required) makes this vulnerability particularly dangerous for targeted surveillance operations against privacy-conscious users.

Historical Context

CVE-2026-10702 originated from Mozilla Bug 1995077, which landed in Firefox 147. The faulty alias declaration override was present through Firefox 151.0.2 and removed in the patched 151.0.3 release. Firefox ESR was not affected, with the faulty override absent from Firefox ESR 140.12. As of July 28, 2026, no evidence of in-the-wild exploitation against users has been documented in primary-source records. Nebula Security's IonStack represents a demonstration exploit chain combining this browser vulnerability with the separate GhostLock kernel flaw (CVE-2026-43499). The research follows a pattern of security firms developing full-chain exploits to demonstrate real-world impact of individual vulnerabilities, similar to previous browser-to-system exploitation research.

Defensive Recommendations

  • Update Firefox to version 151.0.3 or later immediately; verify Tor Browser incorporates patched Firefox versions (post-147 through 151.0.2 range)
  • Monitor for T1189 drive-by compromise indicators: unexpected renderer process crashes, abnormal JIT compilation behavior, or WebAssembly module loading from untrusted origins
  • Deploy browser isolation technologies (remote browser isolation or sandboxed browsing environments) for high-risk users in technology and software development sectors
  • Patch Linux kernel to address CVE-2026-43499 (GhostLock) on Android and Linux systems to break the browser-to-kernel exploitation chain
  • Implement memory safety monitoring for browser processes: detect T1055 process injection attempts via abnormal memory protection changes (mprotect syscalls) and suspicious WebAssembly function pointer modifications