Mozilla has released an emergency update Firefox 151.0.3 that fixes the high-severity vulnerability CVE-2026-10702 in the browser’s JIT compiler. The bug affects stable Firefox builds from 147 through 151.0.2 and allows arbitrary code execution in the rendering process simply by visiting a malicious web page — without any additional user interaction. The situation is aggravated by the fact that the research company Nebula Security has already published a working exploit, although as of July 28, 2026, there have been no confirmed cases of exploitation in real-world attacks.
Technical essence of the vulnerability
According to the technical analysis by Nebula Security, the root cause lies in the MObjectToIterator operation when executed with the flag skipRegistration = true. The Firefox JIT compiler translates frequently executed JavaScript into native machine code and must correctly track which operations can modify memory.
Firefox mistakenly classified this operation as a read-only operation, although resolving a “lazy” property of an object can result in allocation of a new dynamic slot buffer and freeing of the old one. The Global Value Numbering optimization then treated a subsequent reload of the slot-buffer pointer as redundant and reused a previously obtained pointer — after it had already been invalidated by the runtime. The result is a classic use-after-free condition.
The vulnerable code was introduced as part of Bug 1995077 and first appeared in Firefox 147. Source code analysis confirms that the incorrect override of read-only aliases is present in Firefox 151.0.2 and absent in Firefox 151.0.3.
Affected and unaffected versions
- Affected: Firefox 147 — 151.0.2 (stable releases)
- Fixed in: Firefox 151.0.3
- Not affected: Firefox ESR 140.12 — the vulnerable code is absent in the ESR branch sources; Mozilla does not mention ESR in the security advisory
The code-level fix removes the custom handling of “read-only” aliases from ObjectToIterator and corrects the related iterator operation, preventing the optimizer from retaining a stale pointer.
Public exploit and the IonStack chain
Nebula Security used CVE-2026-10702 as the first stage of an exploit chain called IonStack, targeting an ARM64 device running Android 17. The published exploit reclaims the freed allocation, extracts a pointer to a hidden class, creates a fake object, and corrupts a Uint8Array to obtain arbitrary memory read and write. On Android, the code then changes memory access permissions and redirects the WebAssembly function entry point to ARM64 shellcode.
According to the researchers, the released code contains offsets for Firefox 151.0 on a specific ARM64 Android 17 build, but the browser vulnerability itself is not tied to the ARM architecture. Nebula Security describes the exploitation path on x86 as more stable, although the full chain for this architecture has not yet been completed.
The second stage of the IonStack chain is CVE-2026-43499 — a vulnerability in the Linux kernel futex subsystem that Nebula calls GhostLock. This stage provides privilege escalation to root on the target Android build. According to the researchers, GhostLock is invoked directly from Firefox, and Android’s weaker sandboxing simplifies exploitation — while, in Nebula’s opinion, the stricter desktop sandbox would not necessarily prevent the attack. It should be noted that this assessment comes from a single research source and has not been confirmed by the vendor.
Impact assessment
The highest risk falls on Firefox users on all platforms running versions 147–151.0.2. The availability of a public exploit significantly lowers the barrier to entry for potential attackers, even though the released code targets a specific Android build. Adapting the browser stage to other platforms is a matter of engineering effort rather than fundamental limitations.
Firefox ESR 140.12 users, based on source code analysis, are not affected by this vulnerability. The current exploitation status is: a public PoC is available; neither Mozilla nor CISA report active exploitation in real-world attacks.
Recommendations
- Update Firefox immediately to version 151.0.3 or newer. This update closes the browser entry point.
- Check your current version: open
about:supportin the Firefox address bar and make sure the version number is at least 151.0.3. - For Android users: update Firefox via Google Play. Given the existence of a complete exploit chain for Android 17, mobile users are at elevated risk.
- For enterprise administrators: if you are using Firefox ESR 140.12, this branch is not affected. However, you should ensure that none of your managed installations are running stable versions in the 147–151.0.2 range.
- Updating Firefox does not fix CVE-2026-43499 (GhostLock) — the Linux kernel vulnerability requires a separate patch at the operating system level. Monitor Android and Linux kernel security updates.
The publication of a working exploit for CVE-2026-10702 makes upgrading Firefox to version 151.0.3 a priority — especially on Android devices, where a full chain from visiting a web page to obtaining root access has been demonstrated. Mobile users should also install all available operating system security updates to close the GhostLock kernel vulnerability.
