Full research report
Researchers Show a Single Malicious Webpage Visit Can Compromise Tor Browser
Executive assessment
The central verified fact is a high-severity Firefox SpiderMonkey optimisation flaw fixed in Firefox 151.0.3, for which detailed public exploit material now exists. Nebula demonstrated that browser foothold as part of IonStack, pairing it with GhostLock to reach root on a supported ARM64 Android target. The Tor Browser claim is credible because it comes from the original researcher and is repeated by independent reporting, but no Tor-specific advisory or exact vulnerable release was found. Consequently, defenders should treat exposure as urgent where affected browser and kernel code coexist while avoiding the unsupported conclusion that active attacks or universal Tor Browser exposure have been established.
What happened
Nebula Security reported CVE-2026-10702 to Mozilla on 20 May 2026, and Mozilla released Firefox 151.0.3 with the fix on 2 June. During July, Nebula published analysis and public exploit material showing that a malicious webpage could obtain code execution in Firefox's sandboxed content process and serve as the first stage of its IonStack chain. The demonstrated chain paired the browser flaw with Linux kernel vulnerability CVE-2026-43499 to obtain root on a supported ARM64 Android build; reporting on the Tor Browser demonstration appeared on 29 July.
Affected scope
Mozilla confirms Firefox versions before the fixed Firefox 151.0.3 release are affected by CVE-2026-10702, although its advisory does not enumerate the complete vulnerable range or Firefox Extended Support Release scope. Nebula states that it also compromised Tor Browser, but the exact Tor Browser release, channel, operating system and embedded Firefox version used in that demonstration have not been published. CVE-2026-43499 affects Linux kernels containing the vulnerable rtmutex code introduced in 2011 and lacking the upstream correction, including relevant Android kernels; distribution-specific package status must be checked with each supplier.
Technical assessment
CVE-2026-10702 is a SpiderMonkey just-in-time compiler correctness flaw: an operation capable of changing object storage was represented too narrowly during optimisation, allowing compiled JavaScript to retain a stale memory reference and ultimately gain renderer-process memory access. Browser sandboxing limits that stage alone, but Nebula combined it with GhostLock, a Linux rtmutex rollback flaw that can leave a dangling kernel pointer when proxy-lock cleanup operates on the wrong task. Public code materially increases reproduction risk, but a published proof of concept and a laboratory chain do not establish attacks against users.
Recommended defensive actions
- update Firefox to version 151.0.3 or later across managed desktops and mobile devices.
- update Tor Browser to the latest release and verify its bundled Firefox version against Tor Project release information when a Tor-specific advisory becomes available.
- patch Linux and Android kernels using current supplier packages that include the CVE-2026-43499 correction and any subsequent stability fixes.
- inventory internet-facing, shared, container-hosting and mobile systems that combine vulnerable browser code with an affected Linux kernel.
- hunt for browser renderer crashes followed by unexpected child-process behaviour, privilege transitions or security-context changes on potentially exposed systems.
- verify endpoint and mobile controls detect unauthorised privilege escalation originating from browser processes rather than relying solely on webpage filtering.
Uncertainties and evidence gaps
- No verified primary source identifies the exact Tor Browser release or build used in the demonstration, so the headline's Tor-wide scope cannot be precisely established.
- Mozilla's advisory confirms the fixed Firefox release but does not enumerate the complete affected-version range or list Firefox Extended Support Release as affected.
- The available evidence does not establish exploitation against users in the wild.
- The demonstrated end-to-end chain is platform-specific; portability to other Android devices, desktop architectures or stronger browser sandboxes has not been independently established.
- Nebula's page metadata and its embedded timeline give different July publication dates for the browser analysis.
Vulnerability flow
Defender-oriented path reconstructed only from sourced report findings. Unknown stages are omitted.
No confirmed active exploitation; public proof-of-concept and exploit code are available, and researchers demonstrated a browser-to-kernel compromise chain against a supported ARM64 Android build.
The investigation began by testing whether the supplied report represented real-world attacks or a controlled vulnerability demonstration. Mozilla and National Vulnerability Database records confirm both CVEs and the Firefox fix, while Nebula's original research and repositories confirm public exploit material and a demonstrated two-stage chain. The evidence supports a serious, reproducible research result, but not confirmed active exploitation or a claim that every current Tor Browser release is vulnerable.
- What event and claims did the supplied story describe?Read the supplied article and followed its cited vendor, researcher, source-history and exploit references.thehackernews.com ↗
The article attributed a webpage-triggered Firefox renderer exploit and a Tor Browser demonstration to Nebula Security, then linked CVE-2026-43499 as the kernel escalation stage.
why This separated the focused Tor claim from the broader IonStack research chain and identified the claims needing primary confirmation.
- Was there additional independent reporting or authoritative indexing for CVE-2026-10702?Performed four focused searches across major web-search services for CVE-2026-10702, Mozilla and Firefox.
The searches yielded no additional usable corroborating result because result access was blocked or incomplete.
why The lack of usable search results made direct review of the supplied primary references and authoritative vulnerability records necessary.
- Does Mozilla confirm the browser vulnerability and fixed release?Opened Mozilla Foundation Security Advisory 2026-54.mozilla.org ↗
Mozilla lists high-severity CVE-2026-10702 as a JavaScript engine JIT miscompilation and identifies Firefox 151.0.3 as fixed.
why This independently validates the CVE, affected product and minimum fixed Firefox release without relying on the news article.
- What did the original browser researchers establish?Read Nebula Security's IonStack Part I analysis and disclosure timeline.nebusec.ai ↗
Nebula describes arbitrary code execution in the Firefox renderer, states that it used the flaw against Tor Browser, records disclosure on 20 May and the Firefox fix on 2 June, and recommends updating Firefox.
why This confirms the technical mechanism and research demonstration while showing that the Tor claim currently rests primarily on the researcher's account.
- How does GhostLock relate to the browser story?Reviewed the separate reporting on CVE-2026-43499 and followed its primary references.thehackernews.com ↗
The report identifies GhostLock as a local Linux kernel privilege-escalation flaw with public exploit code and as IonStack's second stage.
why This prevents conflating renderer code execution with root compromise and establishes the distinct prerequisites of the second vulnerability.
- Is public browser exploit material actually available?Opened Nebula Security's public CVE-2026-10702 repository directory.github.com ↗
The directory contains an exploit HTML file and associated JavaScript material for CVE-2026-10702.
why This verifies public proof-of-concept availability but does not demonstrate exploitation in the wild.
- What is the kernel flaw's original technical and affected-scope assessment?Read Nebula Security's IonStack Part II analysis.nebusec.ai ↗
Nebula attributes GhostLock to rtmutex code introduced in Linux 2.6.39, describes unprivileged local root and container escape, and identifies an April 2026 upstream correction.
why The source establishes the local-access boundary, broad kernel lineage and potential impact of the second stage.
- Do government vulnerability records corroborate both CVEs?Reviewed the National Vulnerability Database entries for CVE-2026-43499 and CVE-2026-10702.nvd.nist.gov ↗
The kernel record describes proxy-lock rollback operating on the wrong task, leaving a dangling pointer, and records a local low-privilege attack vector; the separately visited CVE-2026-10702 record confirms the Firefox JIT issue and version 151.0.3 fix.
why These records independently corroborate the two security boundaries and show why the browser and kernel vulnerabilities must be assessed separately.
- Is working GhostLock code publicly accessible and platform-specific material present?Opened Nebula Security's public CVE-2026-43499 repository directory.github.com ↗
The repository exposes both proof-of-concept and exploit directories, including material described for a Pixel 6 target.
why This confirms practical public exploit availability while supporting caution about generalising the demonstrated chain to every architecture and device.
Research coverage
All 68 registered source leaves were evaluated for this run: 61 completed, 0 were unavailable, 0 failed and 7 were disabled. For this story, 2 registered sources supplied useful evidence (2 primary, 0 corroborating, 0 contextual and 0 PoC/exploit references). 59 completed sources contained no matched information for this story.
Complete source-by-source audit 68 sources
| Source | Run result | Value | Why it was useful — or not |
|---|---|---|---|
| NVDcve | ok900 records | Primary evidence2 matched items | Supplied a vendor or government advisory opened and verified during focused research. |
| The Hacker Newsnews | ok14 records | Primary evidence1 matched items | Published the source report used to frame and date the event. |
| AlienVault OTXdark_web | ok10 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| BleepingComputernews | ok9 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| CIRCL CVEcve | ok30 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| CISA Alertsnews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| CISA KEVkev | ok1656 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Cisco PSIRTvendor_advisory | ok5309 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Cisco Talosnews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| deepdarkCTI CVE most exploiteddeepdarkcti | ok94 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Discorddeepdarkcti | ok7 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI exploitsdeepdarkcti | ok24 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI forumsdeepdarkcti | ok260 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI malware as a servicedeepdarkcti | ok7 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI malware samplesdeepdarkcti | ok3 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI marketsdeepdarkcti | ok127 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI phishingdeepdarkcti | ok19 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI ransomware gangsdeepdarkcti | ok667 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI RATsdeepdarkcti | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Telegram infostealerdeepdarkcti | ok130 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Telegram threat actorsdeepdarkcti | ok1005 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Twitter threat actorsdeepdarkcti | ok39 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| DNSDumpster domain IOC enrichmentresearch | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Exploit-DBexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| FIRST EPSSepss | ok | Checked — no match | The source completed, but none of its retained records matched this story. |
| Fortinet PSIRTvendor_advisory | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| GitHub topic: cveresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: exploitresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: penetration-testingresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: pocresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: vulnerabilityresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GreyNoiseexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| KrebsOnSecuritynews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| LinkedIn RSS proxy feeds (disabled)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| MalwareBazaardark_web | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #cveresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #cybersecurityresearch | ok19 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #exploitresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #infosecresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #malwareresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #ransomwareresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #threatintelresearch | ok14 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #vulnerabilityresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Metasploit module metadataexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Microsoft MSRCvendor_advisory | ok1588 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Microsoft Securitynews | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| MISP Galaxyresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| MISP threat actor galaxyactor | ok0 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Palo Alto Networks PSIRTvendor_advisory | ok25 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| ProjectDiscovery nuclei templatesexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Rapid7news | ok2 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Reddit r/AskNetsec (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/cybersecurity (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/malware (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/netsec (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/ReverseEngineering (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| SANS ISCnews | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Shadowserver public aggregate honeypot observationsexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Shodanresearch | ok8 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Sigma Rulesresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Sophos IOCsresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| ThreatFoxthreat_intelligence | ok100 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| UK NCSCnews | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Unit42 IOCsresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| URLhausdark_web | ok10 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| VirusTotal Community IOC enrichmentresearch | ok4 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| VulnCheck KEVkev | ok500 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Vulnerability Lookupcve | ok30 records | Checked — no match | The source completed, but none of its retained records matched this story. |
Additional verified pages 12 opened outside the registered collection
Reporting-linked PoC claims4
Linked by reporting but not validated as PoC by the configured exploit indexes.
Linked by reporting but not validated as PoC by the configured exploit indexes.
Linked by reporting but not validated as PoC by the configured exploit indexes.
Linked by reporting but not validated as PoC by the configured exploit indexes.
Technical references1
Repository captured from the source article as technical context; not validated as PoC or exploit code.
PoC & exploit code2
Public repository containing browser proof-of-concept and exploit material.
Public repository containing GhostLock proof-of-concept and platform-specific exploit code.
Vendor & gov advisories3
Mozilla rates CVE-2026-10702 high severity and identifies Firefox 151.0.3 as the fixed release.
Confirms a Firefox JavaScript just-in-time compiler miscompilation fixed in Firefox 151.0.3.
Describes the Linux rtmutex rollback error, dangling pointer and upstream correction.
Analysis & research4
Original researcher analysis, disclosure timeline and browser-stage technical findings.
Original analysis of the Linux kernel privilege-escalation stage and affected code lineage.
Independent reporting connecting the two vulnerabilities and documenting unresolved Tor Browser version scope.
Independent reporting on GhostLock exploitation prerequisites, public code and patch availability.