Firefox JIT Flaw Enables Tor Browser Code Execution

Nebula Security researcher Eten Zou disclosed a JIT miscompilation bug in Firefox’s JavaScript engine that turns a single webpage visit into a code execution opportunity inside the browser’s renderer process. No additional user interaction required — loading the page is sufficient.

The vulnerability, tracked as CVE-2026-10702, was fixed in Firefox 151.0.3 in June. That would be unremarkable on its own. But because Tor Browser uses Firefox’s engine under the hood, it inherited the same flaw — and Nebula Security confirmed the technique worked against it as well.

What the flaw is

JIT — just-in-time compilation — is the part of a JavaScript engine that converts bytecode into native machine instructions at runtime to speed things up. JIT miscompilation bugs are a known category: when the compiler generates incorrect native code, an attacker controlling the JavaScript being compiled can sometimes steer that incorrect output toward useful behavior, like corrupting adjacent memory or bypassing type checks.

That’s the category this falls into. Execution lands inside the renderer process, which modern browsers sandbox separately from the rest of the OS. NVD rates CVE-2026-10702 at CVSS 4.3, a medium score that reflects the sandbox containment — a renderer-only exploit doesn’t automatically translate to full system compromise. Mozilla’s own severity rating was higher, labeled High, which likely accounts for how reliably the technique worked against unpatched builds and the Tor Browser exposure specifically.

Both ratings are defensible. They’re measuring different things. The CVSS score reflects technical scope; Mozilla’s rating reflects what they observed in practice.

Why Tor Browser matters here

Tor Browser occupies a specific niche: it’s the browser of choice for people who have a particular reason to care about their browsing environment — journalists, activists, people operating in restricted jurisdictions. When a researcher can demonstrate that visiting a single page is enough to execute code inside that browser’s renderer, the population of people who most need that browser to function correctly is exactly who should pay attention first.

Nebula Security noted no specific active exploitation of this flaw in Tor Browser sessions. But the absence of observed exploitation isn’t confirmation of safety — it means no evidence has been produced yet. For a browser whose value proposition is privacy and attack surface reduction, that distinction matters more than it would for a general-purpose browser.

This follows an earlier Mozilla advisory in July that addressed separate Firefox flaws with public exploit code available. JIT bugs have been a productive hunting ground for browser security researchers across vendors for years, and that hasn’t changed.

What to do

Firefox auto-updates for most users; verify via Help → About Firefox if unsure. Tor Browser users should update immediately — the Tor Project ships patched versions as their upstream Firefox base updates. If your Tor Browser build predates the 151.0.3 base, the vulnerability is present and unmitigated.

For security teams managing images or browser version policies: this is a case for an out-of-cycle update. The no-interaction trigger condition means exposure is broader than a flaw that requires user action to trigger.