CVE-2026-10702: Mozilla Firefox, Tor Browser — Remote Code Execution via Webpage (July 2026)

CVE-2026-10702 — Mozilla Firefox, Tor Browser

CVE-2026-10702 (high severity) is a critical Just-In-Time (JIT) compiler vulnerability in Mozilla Firefox and Tor Browser, allowing remote code execution when a user visits a malicious webpage. The flaw is actively exploited in the wild, and public exploit code is available. No CVSS score is published yet, but risk is elevated due to demonstrated exploit chaining for full system compromise.

Attack Vector

Attackers lure users to a crafted webpage that triggers the JIT compiler vulnerability, enabling arbitrary code execution within the browser sandbox. Nebula Security demonstrated chaining this with CVE-2026-43499 (GhostLock, a Linux kernel futex flaw) to escalate privileges to root on ARM64 Android 17 devices. The attack requires only a single browser visit and no user interaction beyond page load. Exploitation is feasible on both desktop and mobile platforms where affected browser versions are deployed.

Who Is at Risk

All organizations and users running Firefox versions 147 through 151.0.2, and any Tor Browser release based on these versions, are vulnerable. Mozilla and the Tor Project are directly affected. Android devices running ARM64 builds with unpatched kernels are at heightened risk of full device compromise if both vulnerabilities are chained. Global exposure is confirmed.

Patch & Mitigate

• Patch: Update Firefox to version 151.0.3 or later immediately. Tor Browser users should upgrade to the next release based on the patched Firefox core. Kernel-level mitigation for GhostLock (CVE-2026-43499) requires separate Linux patching.
• Workaround: No reliable workaround exists for the browser vulnerability; disabling JavaScript may reduce risk but is not sufficient.
• Detect: Monitor for unusual browser process activity, unexpected child processes, and traffic to suspicious domains following webpage visits. Review logs for signs of privilege escalation on Android endpoints.

MITRE ATT&CK

• TA0001 — Initial Access: Attackers deliver exploit via malicious webpage to gain browser foothold.
• TA0005 — Defense Evasion: Exploit chains bypass browser sandbox and escalate privileges.
• TA0007 — Discovery: Post-exploitation, attackers may enumerate system details after code execution.

Source: https://thehackernews.com/2026/07/researchers-show-single-malicious.html