JIT miscompilation in Firefox JavaScript engine allows renderer code execution

CVE-2026-10702 is a JIT miscompilation vulnerability in the JavaScript engine shipped with Mozilla Firefox. A JIT (just-in-time) compiler converts JavaScript bytecode into native machine instructions at runtime; when that compilation step produces incorrect code, an attacker who controls the JavaScript being executed can sometimes steer the resulting native instructions toward useful behavior — in this case, arbitrary code execution inside the browser’s renderer process.

Nebula Security researcher Eten Zou demonstrated that triggering the flaw requires only that the victim visit a malicious webpage; no additional user interaction or configuration change is necessary.

Scope: Execution is confined to the browser’s renderer process, which modern browsers sandbox separately from the underlying OS. NVD’s CVSS 4.3 (medium) score reflects this containment — a renderer-only exploit does not automatically produce full system compromise. Mozilla’s internal severity rating was High, accounting for the reliability of the technique and the Tor Browser exposure described below.

Tor Browser: Tor Browser uses Firefox’s engine as its base. The flaw was confirmed exploitable against Tor Browser as well, which is notable given the privacy-sensitive populations that rely on it.

Fix: Mozilla patched this in Firefox 151.0.3. Tor Project shipped updated builds based on the 151.0.3 baseline.

No KEV addition as of 2026-07-29. No confirmed active exploitation reported; CVSS 4.3 with sandbox containment places this below most KEV thresholds, though the no-interaction trigger condition warrants prompt patching.