A recently disclosed vulnerability in Mozilla Firefox, identified as CVE-2026-10702, enables attackers to execute arbitrary code by simply enticing users to visit a malicious webpage. This flaw, rated as High severity by Mozilla, has been addressed in the Firefox 151.0.3 update.
The vulnerability resides in Firefox’s just-in-time (JIT) compiler, which optimizes JavaScript execution by converting frequently used code into native machine instructions. The issue arises from the MObjectToIterator operation, which, when executed with the skipRegistration parameter set to true, can lead to memory mismanagement. Specifically, the operation was incorrectly classified as a read-only action, despite its potential to allocate new memory and free existing buffers. This misclassification allowed the compiler to retain stale pointers, leading to exploitable conditions.
Security researchers at Nebula Security have demonstrated that exploiting this flaw requires no user interaction beyond visiting a compromised website. Once exploited, the vulnerability allows code execution within Firefox’s sandboxed content process. Nebula Security has released public exploit material showcasing this vulnerability as the initial stage of a multi-step attack chain, dubbed IonStack, targeting ARM64 devices running Android 17. While the provided exploit code is tailored for a specific Google build, the underlying browser flaw is not architecture-specific, indicating potential risks across various platforms.
Users of Firefox are strongly advised to update to version 151.0.3 or later to mitigate this risk. The vulnerability affects Firefox versions from 147 through 151.0.2. Notably, Firefox Extended Support Release (ESR) versions are not impacted, as the problematic code is absent from Firefox ESR 140.12.
In their technical analysis, Nebula Security traced the issue to the MObjectToIterator operation’s handling within the JIT compiler. The compiler’s optimization process, known as global value numbering, erroneously treated certain operations as redundant, leading to the reuse of invalidated pointers. This flaw underscores the complexities and potential pitfalls inherent in JIT compilation and memory management.
Mozilla’s corrective measures involved removing the custom read-only alias handling from the ObjectToIterator operation and adjusting related iterator functions. These changes prevent the compiler from misclassifying operations that can mutate memory, thereby averting the retention of stale pointers.
Beyond the browser vulnerability, Nebula Security’s IonStack attack chain incorporates a second-stage exploit targeting a separate Linux kernel flaw, CVE-2026-43499, referred to as GhostLock. This combination of vulnerabilities facilitates a progression from remote code execution within the browser to obtaining root privileges on affected Android devices.
This incident highlights the critical importance of timely software updates and the need for continuous vigilance in the face of evolving cybersecurity threats. Users and organizations must prioritize patching known vulnerabilities to safeguard against potential exploits that can compromise system integrity and user data.
