A recently disclosed high-severity vulnerability, identified as CVE-2026-10702, has been found in the Tor Browser, potentially allowing attackers to compromise users’ systems through a single malicious webpage. This flaw originates from a Just-In-Time (JIT) miscompilation issue within Firefox’s SpiderMonkey JavaScript engine, which serves as the foundation for the Tor Browser.
The vulnerability enables arbitrary code execution within the browser’s renderer process when users visit a specially crafted webpage. Unlike traditional attacks that require user interaction, this exploit operates seamlessly, posing a significant risk to users who rely on the Tor Browser for anonymity and privacy.
Mozilla addressed this issue by releasing Firefox version 151.0.3 on June 2, 2026, which includes a fix for the JIT flaw. Subsequently, the Tor Project integrated this patch into Tor Browser version 15.0.19, released on July 20, 2026. Users are strongly advised to update their browsers promptly to mitigate the risk associated with this vulnerability.
The root cause of this flaw lies in the SpiderMonkey engine’s handling of certain JavaScript operations, such as processing `Object.keys()` and resolving lazy properties. Errors in these processes can lead to use-after-free conditions, allowing attackers to exploit the browser’s memory management and execute arbitrary code.
For users of the Tor Browser, this incident underscores the importance of maintaining up-to-date software. While the Tor network provides anonymity, vulnerabilities in the browser itself can compromise user security. Regular updates are essential to protect against emerging threats and ensure the integrity of the browsing experience.
