{"id":2083,"date":"2026-07-29T14:08:41","date_gmt":"2026-07-29T14:08:41","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=2083"},"modified":"2026-07-29T14:08:41","modified_gmt":"2026-07-29T14:08:41","slug":"researchers-show-a-single-malicious-webpage-visit-can-compromise-tor-browser","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=2083","title":{"rendered":"Researchers Show a Single Malicious Webpage Visit Can Compromise Tor Browser"},"content":{"rendered":"
\n

\ue804<\/i>Swati Khandelwal<\/span>\ue802<\/i>Jul 29, 2026<\/span><\/span>Vulnerability \/ Browser Security<\/span><\/p>\n<\/div>\n

\n
<\/a><\/div>\n

Nebula Security says a patched Firefox JIT flaw could be triggered by simply visiting a malicious webpage and was also used to compromise Tor Browser.<\/p>\n

Tracked as CVE-2026-10702<\/strong>, the bug provides arbitrary code execution inside the browser’s renderer process. Mozilla rated it High and fixed it in the Firefox 151.0.3 update<\/a>.<\/p>\n

\u00abNo settings or additional user interaction are required,\u00bb Eten Zou, CEO of Nebula Security, told The Hacker News. \u00abVisiting a malicious webpage is enough to trigger it,\u00bb Zou said every Tor Browser release that incorporated a vulnerable Firefox version was affected, though researchers have not identified the exact Tor releases.<\/p>\n

On its own, the bug runs code only inside Firefox’s sandboxed content process. Nebula released public exploit material<\/a> and used the flaw as the first stage of IonStack, a browser-to-kernel chain built for an ARM64 device running Android 17. The released end-to-end code targets one supported Google build, although Zou said the browser flaw itself is not ARM-specific.<\/p>\n

The public code contains Firefox 151.0 offsets for the supported ARM64 Android 17 build. Zou said each exploitation step is architecture-independent and described the x86 path as more stable, although Nebula has not completed the full chain for that architecture.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

Firefox users should update to the latest release. The Hacker News traced the faulty alias declaration through Mozilla’s source history to Bug 1995077<\/a>, which landed for Firefox 147. The override is present in Firefox 151.0.2<\/a> and absent from Firefox 151.0.3<\/a>. That places the affected stable-release range at Firefox 147 through 151.0.2.<\/p>\n

<\/p>\n

Mozilla’s advisory does not list Firefox ESR, and the faulty override is absent from Firefox ESR 140.12<\/a>. As of July 28, 2026, the available primary-source record does not establish exploitation against users in the wild.<\/p>\n

In its technical analysis<\/a>, Nebula traces the issue to MObjectToIterator when it runs with skipRegistration set to true. Firefox’s just-in-time (JIT) compiler turns frequently run JavaScript into native machine code, and to do that safely it has to track which operations can touch memory.<\/p>\n

Firefox treated the operation as a read even though resolving a lazy property can allocate a replacement dynamic-slots buffer and free the old one.<\/p>\n

Global value numbering then treated a later slots-buffer load as redundant and reused the earlier pointer after it had become stale. Nebula’s released exploit<\/a> reclaims the freed allocation, leaks a hidden-class pointer, builds a fake object, and corrupts a Uint8Array to gain arbitrary memory read and write. The Android code then changes memory protections and redirects a WebAssembly function entry point to ARM64 shellcode.<\/p>\n

The failure turns on a narrow compiler contract: an operation capable of replacing the object’s dynamic-slots buffer was labelled as a read. That incorrect contract let otherwise valid optimisation logic preserve a pointer the runtime had already invalidated.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

Mozilla’s source-level fix<\/a> removes the custom read-only alias handling from ObjectToIterator and adjusts the related iterator operation. That prevents the optimiser from treating a mutation-capable step as a harmless load and retaining the stale pointer.<\/p>\n

IonStack’s second stage is CVE-2026-43499, a separate Linux kernel futex flaw that Nebula calls GhostLock. CVE-2026-10702 provides the remote browser foothold; CVE-2026-43499 carries it to root on the supported Android build.<\/p>\n

Zou said GhostLock is invoked directly from Firefox. He added that Android’s weaker sandbox makes exploitation easier, but Nebula does not believe a stronger desktop sandbox would prevent the attack.<\/p>\n

Updating Firefox blocks the documented browser entry point, but it does not patch GhostLock itself.<\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

\ue804Swati Khandelwal\ue802Jul 29, 2026Vulnerability \/ Browser Security Nebula Security says a patched Firefox JIT flaw could be triggered by simply visiting a malicious webpage and was also used to compromise…<\/p>\n","protected":false},"author":1,"featured_media":2084,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[265,869,33,605,2788,1461,2791,2790,2789],"class_list":["post-2083","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized","tag-browser","tag-compromise","tag-malicious","tag-researchers","tag-show","tag-single","tag-tor","tag-visit","tag-webpage"],"_links":{"self":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/2083","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=2083"}],"version-history":[{"count":0,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/2083\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/media\/2084"}],"wp:attachment":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=2083"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=2083"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=2083"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}