Researchers Show a Single Malicious Webpage Visit Can Compromise Tor Browser
Summary: Nebula Security says CVE-2026-10702, a Firefox JIT flaw rated High and fixed in Firefox 151.0.3, allows arbitrary code execution in the renderer process from simply visiting a malicious webpage, with no settings or user interaction required, and affected every Tor Browser release built on a vulnerable Firefox version. The Hacker News traced the faulty alias declaration to Bug 1995077, placing the affected stable range at Firefox 147 through 151.0.2, and Nebula used the bug as the first stage of IonStack, a browser-to-kernel chain pairing it with CVE-2026-43499, a Linux kernel futex flaw it calls GhostLock, to reach root on an ARM64 Android 17 build.
Why it matters: The entry point is a single page visit with no click and no settings change, and updating Firefox closes only that documented browser foothold, not GhostLock itself, which Nebula invokes directly from Firefox to carry the attack to root.