CVE-2026-10702Disclosure(mozilla / firefox)

CRITICALCVSS 4.3 · MEDIUM

Exploitation observed; activity peaked at 10 mentions and remains active

Immediate actions

Patch mozilla firefox systems immediately
Assume compromise if assets are exposed
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: Immediate (within 24h)

NVD description

JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 151.0.3.

mozilla CVEs Back to dashboard

8.0/ 10 priority

Sources & remediation

Vendor / third-party advisories

https://www.mozilla.org/security/advisories/mfsa2026-54/

Other references

Weakness type (CWE)

CWE-843CWE-733

Priority

CRITICAL

Exploitation

ACTIVE

PoC

YES

Patch

AVAILABLE

Momentum

DECLINING

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

firefox

Threat summary

Active exploitation appears in 4 classified signals
Public PoC and exploit tooling are both present
Patch or workaround signal is available
45 mentions across 18 observed days

What's happening

Active exploitation reported across 4 signals
Exploit tool or code specified in 8 signals
PoC mentioned or linked in 18 signals
Patch or workaround mentioned in 22 signals
Technical details provided in 36 signals
Disclosure: 16 classified signals
Peaked 9d ago at 10 mentions (2026-07-29); latest day: 1
45 total mentions across 18 days

Affected systems

Vendors

mozilla

Products

firefox

Deep dive

Activity timeline45 mentions / 18d

Signal classification6 categories

Disclosure

1635.6%

Patch

1022.2%

Exploit

613.3%

PoC

511.1%

Active Exploitation

48.9%

General

48.9%

Referenced assets24 URLs

By indicator

Classification over time

Date	Total	Labels

2026-06-03	1	Active Exploitation1
2026-06-25	3	Disclosure1Exploit1PoC1
2026-06-26	1	Disclosure1
2026-07-08	1	PoC1
2026-07-09	1	Exploit1
2026-07-10	2	General1PoC1
2026-07-16	2	Disclosure2
2026-07-28	2	Patch2
2026-07-29	10	Active Exploitation2Disclosure5Exploit1General1Patch1
2026-07-30	10	Active Exploitation1Disclosure4Patch4PoC1
2026-07-31	3	Disclosure1General1PoC1
2026-08-01	3	Disclosure1Exploit2
2026-08-02	1	Patch1
2026-08-03	1	Disclosure1
2026-08-04	1	Patch1
2026-08-11	1	Exploit1
2026-09-03	1	Patch1
2026-09-24	1	General1

Full discourse20 posts

Nebula Security@nebusecurity83d
Patch
Watch us open the camera and uncover the anonymous identity behind Tor browser: We published the writeup for the browser RCE in IonStack. Mythos reported 271 bugs in Firefox 150 but still missed this one. And the Tor Browser is also affected by CVE-2026-10702. Update your Tor! https://t.co/5TMQkRPAjN
Post summary
The author highlights a CVE-2026-10702 RCE affecting Tor Browser, shares a writeup, and urges users to update to mitigate the risk.
1812481.0K54874.2K
7.2K followersView on X
Cyber Security News@The_Cyber_News81d
Disclosure
‼️A single malicious page may be enough to compromise Tor Browser, according to new research into the Firefox flaw CVE-2026-10702. The bug allows arbitrary code execution in the browser renderer, and researchers say it also worked against Tor Browser before patches landed. Source: https://cybersecuritynews.com/hackers-can-compromise-your-tor-browser/ #cybersecurityawareness #cybersecuritynews
Post summary
Researchers have disclosed that CVE-2026-10702 enables arbitrary code execution via a single malicious page, potentially compromising Tor Browser before patches were applied; no exploit code or evidence of active exploitation is reported.
11151765823131.0K
73.6K followersView on X
Mobile Hacker@androidmalware2116d
Disclosure
Android 17 root Full chain browser-to-kernel exploit with two 0-day vulnerabilities affecting Firefox before v151.0.2 (CVE-2026-10702) Click on the link -> root Android Discovered by @nebusecurity PoC not available. Info: https://x.com/nebusecurity/status/2069707520160227688 https://t.co/kGstq1bKhz
Post summary
A zero‑day chain vulnerability in Firefox before v151.0.2 is disclosed, but no PoC, exploit code, or patch information is provided. The post reports the technical presence of the flaw without evidence of exploitation or resolution.
878357236253.2K
60.4K followersView on X
The Hacker News@TheHackersNews81d
Active Exploitation
🛑 One malicious webpage visit was enough to compromise Tor Browser. No settings changes. No extra clicks. Firefox JIT flaw, CVE-2026-10702, runs code inside the browser’s renderer process and forms the first stage of an Android 17 root chain. Read how the exploit works: https://thehackernews.com/2026/07/researchers-show-single-malicious.html
Post summary
A single malicious webpage can exploit the Firefox JIT vulnerability CVE-2026-10702 to compromise Tor Browser, demonstrating active exploitation and pointing to a detailed article.
10123644718670.4K
2.3M followersView on X
blackorbird@blackorbird101d
PoC
The first browser-to-kernel full-chain RCE on Android 17 #poc https://github.com/NebuSec/CyberMeowfia/tree/main/IonStack CVE-2026-10702: Firefox JIT RCE Vulnerability Explained ref: https://rootme.nebusec.io/ https://t.co/tsaZaFkyzh
Post summary
A proof‑of‑concept for a browser‑to‑kernel full‑chain RCE on Android 17 is shared via GitHub, and a Firefox JIT RCE is explained, but no active exploitation or patch information is provided.
451022916329.6K
43.7K followersView on X
Nebula Security@nebusecurity116d
PoC
"IonStack" is chained with two 0-days: CVE-2026-10702 and CVE-2026-43499. CVE-2026-10702 is a Firefox 0-day. At its core, it was an instruction-modeling flaw buried deep inside IonMonkey, Firefox’s highly complex JIT compiler. Even after Mythos’s extensive audits, the bug was still missed. This is the first publicly disclosed JIT vulnerability since then. We were able to uncover the vulnerability and turn it into a highly stable exploit with a nearly 100% success rate, ultimately achieving remote arbitrary code execution in Firefox. CVE-2026-43499 is a universal Linux kernel LPE vulnerability that has lived in the kernel tree for 15 years since v2.6.38 and affects every distribution: desktop, server, Android, and embedded. It does not require any special kernel modules; CONFIG_FUTEX_PI is all it needs, and to our knowledge, it’s enabled across all distributions we researched. The bug primitive is a UAF in stack caused by a race condition. Turning it into a reliable LPE takes several stack tricks, but eventually it becomes very stable. We measured 10/10 successful privilege escalations on Linux 6.12, along with a high success rate on Android. We will write a series of blog posts disclosing both 0-days used in “IonStack”. The first post is coming soon. Stay tuned.
Post summary
The text discloses two 0‑day CVEs, details their technical nature, and claims the author has developed stable exploits for both, with plans to publish the PoCs soon.
42511507513.2K
6.7K followersView on X
ANyONe Protocol@AnyoneFDN81d
Patch
Security is a moving target. This week’s Firefox JIT vulnerability (CVE-2026-10702) was disclosed and patched quickly in version 15.0.15. That’s how mature security should work. Some challenges, though, aren’t solved by a software update. Relay diversity, operator incentives, and geographic distribution are long-term engineering problems that require continuous investment. Fast patches matter. So does building resilient infrastructure.
Post summary
CVE-2026-10702 was disclosed and quickly patched in Firefox version 15.0.15, with no mention of active exploitation or a proof‑of‑concept.
629120117.2K
72.8K followersView on X
Frank Wu@FrankOverF1ow76d
Disclosure
IonStack Blog Series: Part I (Firefox SpiderMonkey JIT RCE): https://nebusec.ai/research/ionstack-part-1-cve-2026-10702/ Part II (GhostLock, a 15 yo universal Linux LPE): https://nebusec.ai/research/ionstack-part-2/ IonStack Part III (Rooting Android with GhostLock): https://nebusec.ai/research/ionstack-part-3/ https://t.co/8Jua8aR6OQ
Post summary
The text announces a blog series detailing the disclosure of CVE‑2026‑10702 and related Linux/Android LPE exploits, linking to research that likely contains PoC code, but it provides no evidence of active exploitation, patches, or tool specifics.
3251129709.9K
1.9K followersView on X
siri@fu4k1@sirifu4k1102d
PoC
android+Firefox=RCE 😎 https://github.com/NebuSec/CyberMeowfia/tree/main/IonStack/CVE-2026-10702
Post summary
A GitHub repository is shared that demonstrates a remote code execution vulnerability in Android’s Firefox, serving as a proof‑of‑concept for CVE-2026-10702.
0112605211.7K
7.1K followersView on X
Nebula Security@nebusecurity83d
Patch
IonBanana (CVE-2026-10702) was fixed in Firefox 151.0.3. Tor Browser stable tracks Firefox ESR and backported it in 15.0.19 on July 21. Our full writeup: https://nebusec.ai/research/ionstack-part-1-cve-2026-10702/
Post summary
CVE-2026-10702 was fixed in Firefox 151.0.3 and backported to Tor Browser 15.0.19 on July 21, with a detailed writeup linked for further information.
08036154.6K
7.2K followersView on X
VulnTracker@vuln_tracker101d
General
Pretty wild research 👀 A Firefox JIT bug (CVE-2026-10702) reportedly chained into a browser-to-kernel exploit on Android 17. Exploit chains like this show why defense-in-depth matters - even one vulnerability can become much bigger when combined with others. http://vulntracker.io
Post summary
Researchers reported that a Firefox JIT bug (CVE‑2026‑10702) was chained into a browser‑to‑kernel exploit on Android 17, highlighting the risk of exploit chains but providing no evidence of active exploitation or a published PoC.
00044575
716 followersView on X
Rıdvan Yağlı@ridvanyagli115d
Disclosure
Android 17 için, Firefox'un 151.0.2 öncesi sürümlerini etkilediği iddia edilen iki adet 0-day açığı birleştiren browser-to-kernel exploit zinciri (CVE-2026-10702) https://t.co/9wxXTEvlMX
Post summary
The tweet announces a new browser‑to‑kernel exploit chain (CVE‑2026‑10702) affecting pre‑151.0.2 Firefox for Android 17, but provides only the CVE identifier and a mention of two combined 0‑days without any PoC or exploitation details.
00132712
1.7K followersView on X
Xakep.ru@XakepRU79d
General
Одно посещение вредоносной страницы могло скомпрометировать Tor Browser Исследователи из компании Nebula Security раскрыли детали уязвимости CVE-2026-10702 в JIT-компиляторе Firefox. https://xakep.ru/2026/07/31/cve-2026-10702/
Post summary
The post announces that Nebula Security has disclosed details about CVE-2026-10702 in Firefox’s JIT compiler, but provides no further technical or exploit information.
01013749
46.1K followersView on X
Cyber Edition@CyberEdition80d
Patch
🦊 A critical Firefox flaw (CVE-2026-10702) could let attackers compromise outdated Tor Browser users just by visiting a malicious website. No downloads or clicks needed. Update Firefox and Tor Browser immediately. #Firefox #CyberSecurity Read more: https://thecyberedition.com/critical-firefox-cve-2026-10702-enables-drive-by-attacks-on-tor-browser-users/
Post summary
The post highlights a critical Firefox vulnerability affecting Tor Browser users and urges immediate updates, but it lacks evidence of active exploitation or detailed technical breakdowns.
00041265
767 followersView on X
ArpokratLeg@ArpoLegDep78d
Exploit
🔓 Bastava visitar uma página para assumir o controlo do Tor Browser. Passei a noite no relatório da Nebula Security, publicado a 29 de julho, e há um pormenor que me ficou atravessado. A falha, CVE-2026-10702, é um erro de compilação no SpiderMonkey, o motor de JavaScript do Firefox. O compilador JIT tratava uma operação como simples leitura quando ela podia libertar memória. A partir daí, ponteiro morto, leitura e escrita arbitrárias, execução de código no processo de renderização. Sem interação do utilizador, sem definição especial. Abrir a página chega. O pormenor que incomoda é a cronologia. A Mozilla corrigiu a 2 de junho, no Firefox 151.0.3. O Tor Project lançou a versão corrigida a 20 de julho. Sete semanas. Sete semanas com a correção pública, e portanto a falha também, e com os utilizadores do Tor Browser à espera. Não é uma crítica fácil de fazer. O Tor é mantido por uma equipa pequena que reconstrói um navegador inteiro por cima do Firefox ESR, e cada rebase dá trabalho. Mas a distância entre a correção a montante e a correção a jusante é exatamente a janela que um atacante procura. A rede Tor não foi quebrada. O anonimato do protocolo aguenta. O que cai é o navegador, e isso chega perfeitamente, porque código que corre na sua máquina já não precisa de desanonimizar nada. Já lá está dentro. ⚠️ Os investigadores publicaram o código de exploração para ARM64 em Android. Até agora não há exploração confirmada. Se usa o Tor Browser, confirme que está na 15.0.19 ou mais recente. Agora, não no fim de semana. 🧅 #Privacy #Cybersecurity
Post summary
CVE-2026-10702 is a JIT compilation flaw in SpiderMonkey that enables arbitrary memory access and code execution. Researchers have released an ARM64 Android exploit, but no in‑the‑wild exploitation has been confirmed yet.
00030251
34 followersView on X
Daily CyberSecurity@Daily_CyberSec79d
PoC
Discover the Firefox CVE-2026-10702 exploit. This severe Android vulnerability allows arbitrary code execution without downloads. Update your browser now. #Firefox #CVE202610702 #Cybersecurity #Android #InfoSec #GhostLock http://meterpreter.org/firefox-cve-2026-10702-exploit/
Post summary
The post announces a Firefox exploit for CVE-2026-10702, provides a link to the exploit code, and urges users to update, but does not indicate active exploitation or provide an official patch advisory.
01011475
12.6K followersView on X
Clubic@Clubic81d
PoC
Une page web piégée pouvait déclencher une faille JIT (CVE-2026-10702) et exécuter du code dans Firefox et Tor. Patch en 151.0.3, démo publique… à lire. 🛡️🕳️📌 👉 https://l.clubic.com/31f https://t.co/GeE4dK4uFM
Post summary
The text announces a public demonstration of a JIT-based code‑execution bug (CVE‑2026‑10702) in Firefox and Tor, notes that Firefox has patched the issue in version 151.0.3, and provides links to the demo.
10011879
94.2K followersView on X
Arpokrat@ArpokratPrivacy78d
Disclosure
🔓 A single malicious webpage was enough to run code inside Tor Browser. CVE-2026-10702 is a JIT miscompilation in Firefox's JavaScript engine. No clicks, no settings, no user interaction. Just the visit. Mozilla shipped the fix on 2 June. Tor Browser got it on 20 July. ⚠️ Seven weeks where the patch was public and the users were not. The network held. The client did not. Update to Tor Browser 15.0.19 or later. #Privacy #Cybersecurity
Post summary
CVE-2026-10702, a JIT miscompilation flaw in Firefox’s JavaScript engine, could be triggered by a single malicious webpage without user interaction. The fix was released on 2 June and patched in Tor Browser on 20 July, with a recommendation to update to 15.0.19 or newer.
1001084
64 followersView on X
Mr. OS@ksg93rd68d
Exploit
#exploit #Kernel_Security #Mobile_security IonStack Vulnerability Chain Part 1 - https://nebusec.ai/research/ionstack-part-1-cve-2026-10702 Unsound IonBanana Peel in Ion Compiler, Slipping Through Firefox's SpiderMonkey JIT // IonMonkey CVE-2026-10702 https://github.com/NebuSec/CyberMeowfia/tree/main/IonStack Part 2 - https://nebusec.ai/research/ionstack-part-2/ GhostLock, a stack-UAF that has existed in ALL Linux distributions for 15 years // GhostLock (CVE-2026-43499) + CVE-2026-53166 Part 3 - https://nebusec.ai/research/ionstack-part-3/ Rooting Android 17 with GhostLock // Using GhostLock to develop the world's first public root for Android 17 // http://www.cyberpocket.org
Post summary
The post announces a chain of CVEs in IonStack and GhostLock, shares publicly available PoC code via GitHub, and includes an exploit that grants root on Android 17, but it does not mention active wild exploitation or vendor patches.
00001190
3.4K followersView on X
ArpoDev@ArpoDev78d
Exploit
🔓 Une seule page web suffisait pour prendre le contrôle de Tor Browser. J'ai passé la soirée sur le rapport de Nebula Security publié le 29 juillet, et il y a un détail qui me reste en travers. La faille, CVE-2026-10702, est une erreur de compilation dans SpiderMonkey, le moteur JavaScript de Firefox. Le compilateur JIT traitait une opération comme une simple lecture alors qu'elle pouvait libérer de la mémoire. À partir de là, pointeur mort, lecture et écriture arbitraires, exécution de code dans le processus de rendu. Aucune interaction de l'utilisateur, aucun réglage particulier. Ouvrir la page suffit. Le détail qui gêne, c'est la chronologie. Mozilla a corrigé le 2 juin dans Firefox 151.0.3. Le Tor Project a publié la version corrigée le 20 juillet. Sept semaines. Sept semaines pendant lesquelles le correctif était public, donc la faille aussi, et pendant lesquelles les utilisateurs de Tor Browser restaient exposés. Ce n'est pas un reproche facile à faire. Tor est maintenu par une équipe minuscule qui reconstruit un navigateur entier par dessus Firefox ESR, et chaque rebase demande du travail. Mais l'écart entre le correctif amont et le correctif aval, c'est exactement la fenêtre que cherche un attaquant. Le réseau Tor n'est pas cassé. L'anonymat du protocole tient. C'est le navigateur qui tombe, et ça suffit largement, parce qu'un code qui s'exécute chez vous n'a plus besoin de désanonymiser quoi que ce soit. Il est déjà à l'intérieur. ⚠️ Les chercheurs ont publié le code d'exploitation pour ARM64 sur Android. Aucune exploitation constatée à ce jour. Si vous utilisez Tor Browser, vérifiez que vous êtes en 15.0.19 ou plus récent. Maintenant, pas ce week-end. 🧅 #Privacy #Cybersecurity
Post summary
The text reports CVE‑2026‑10702, confirms that attackers have published an exploitation code (functional PoC) for ARM64 on Android, highlights the timeline for patching, and advises users to update their Tor Browser.
0001098
374 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	mozilla	firefox	-	-	-

Explore more

Back to dashboard mozilla CVEs firefox vulnerabilities

What researchers are saying

CVE-2026-10702

Nebula Security[verified]@nebusecurityPatch

The author highlights a CVE-2026-10702 RCE affecting Tor Browser, shares a writeup, and urges users to update to mitigate the risk.

Cyber Security News[verified]@The_Cyber_NewsDisclosure

Researchers have disclosed that CVE-2026-10702 enables arbitrary code execution via a single malicious page, potentially compromising Tor Browser before patches were applied; no exploit code or evidence of active exploitation is reported.

blackorbird[verified]@blackorbirdPoC

A proof‑of‑concept for a browser‑to‑kernel full‑chain RCE on Android 17 is shared via GitHub, and a Firefox JIT RCE is explained, but no active exploitation or patch information is provided.

Nebula Security[verified]@nebusecurityPoC

The text discloses two 0‑day CVEs, details their technical nature, and claims the author has developed stable exploits for both, with plans to publish the PoCs soon.

ANyONe Protocol[verified]@AnyoneFDNPatch

CVE-2026-10702 was disclosed and quickly patched in Firefox version 15.0.15, with no mention of active exploitation or a proof‑of‑concept.

Frank Wu[verified]@FrankOverF1owDisclosure

The text announces a blog series detailing the disclosure of CVE‑2026‑10702 and related Linux/Android LPE exploits, linking to research that likely contains PoC code, but it provides no evidence of active exploitation, patches, or tool specifics.

Nebula Security[verified]@nebusecurityPatch

CVE-2026-10702 was fixed in Firefox 151.0.3 and backported to Tor Browser 15.0.19 on July 21, with a detailed writeup linked for further information.

VulnTracker[verified]@vuln_trackerGeneral

Researchers reported that a Firefox JIT bug (CVE‑2026‑10702) was chained into a browser‑to‑kernel exploit on Android 17, highlighting the risk of exploit chains but providing no evidence of active exploitation or a published PoC.