One Webpage Visit Was Enough to Own Your Browser — and Then Your Kernel
A patched Firefox vulnerability demonstrates exactly how bad things can get when a JIT compiler makes one wrong assumption. Nebula Security has published full exploit material for CVE-2026-10702, a flaw that requires nothing from the victim except loading a page. No clicks, no downloads, no prompts.
Mozilla rated the bug High severity and shipped the fix in Firefox 151.0.3. Based on source history tracing back to Bug 1995077, the vulnerable code landed in Firefox 147 and remained present through 151.0.2. Firefox ESR 140.12 is clean. Tor Browser releases built on any of those Firefox versions were also affected, though Nebula hasn't pinned down the exact Tor release numbers.
The root cause sits inside MObjectToIterator, specifically when it runs with skipRegistration enabled. Firefox's JIT compiler, IonMonkey, converts hot JavaScript paths into native machine code and tracks memory access patterns to do that safely. The problem: resolving a lazy property can trigger allocation of a fresh dynamic-slots buffer and free the old one, but the compiler was treating this operation as a plain read. It wasn't.
Global value numbering, doing exactly what it's supposed to do, spotted a later load of the same slots buffer and concluded it could reuse the earlier result. Except by then, that pointer was stale. The freed allocation got reclaimed, the exploit leaked a hidden-class pointer, constructed a fake object, and corrupted a Uint8Array to achieve arbitrary memory read and write.
On its own, the bug only gets you code execution inside Firefox's sandboxed renderer. Useful, but not the end of the story.
Nebula built IonStack, a two-stage browser-to-kernel chain targeting ARM64 Android 17. The second stage, CVE-2026-43499, is a Linux kernel futex flaw they've named GhostLock. The browser bug provides the initial foothold; GhostLock escalates it to root. Nebula's CEO Eten Zou noted that GhostLock is invoked directly from inside Firefox, and while Android's sandbox is relatively weak compared to desktop environments, Nebula doesn't think a stronger sandbox would have stopped the attack anyway.
The released exploit code includes Firefox 151.0 offsets for a specific ARM64 Android 17 Google build. Zou says the underlying exploitation logic is architecture-independent, and the x86 path is reportedly more stable, though Nebula hasn't completed the full chain there yet.
Mozilla's fix removes the custom read-only alias handling from ObjectToIterator and adjusts the related iterator operation, preventing the optimiser from treating a mutation-capable step as benign.
As of late July 2026, there's no confirmed evidence of this being exploited in the wild. That may not last. The public exploit material is out there now.
Updating Firefox to 151.0.3 or later closes the browser entry point. It does nothing for GhostLock, which remains a separate open problem in the Linux kernel.