Hackers Can Compromise Tor Browser Users by Exploiting Firefox JIT Flaw

Tor Browser users on unpatched versions may be at risk of compromise simply by visiting a malicious webpage, following the disclosure of CVE-2026-10702, a serious vulnerability in Mozilla Firefox’s JavaScript engine.

Security researchers at Nebula Security have demonstrated that this flaw is exploitable in Tor Browser because it is built on Firefox’s underlying codebase.

Mozilla addressed the issue in Firefox version 151.0.3151.0.3 on June 22, 2026, while the Tor Project incorporated the relevant security fix into Tor Browser version 15.0.19, released on July 20, 2026. Users who have not updated remain vulnerable to potential browser attacks.

Hackers Can Compromise Tor Browser Users

The flaw exists in SpiderMonkey, Firefox’s JavaScript engine. It is caused by an error in the Just-In-Time (JIT) compilation process. JIT engines enhance browser performance by converting frequently executed JavaScript into optimized machine code, as reported by CSN.

However, improper optimization can lead to memory-safety issues that attackers can exploit. In this instance, a malicious webpage can trigger the vulnerability through specially crafted JavaScript without requiring users to download files, install extensions, or take any visible action other than loading the attacker-controlled content.

Researchers revealed that the issue affects SpiderMonkey’s Ion/Warp JIT optimization pipeline. The vulnerable code path involves incorrect assumptions during the processing of `Object.keys()`, lazy property resolution, and alias analysis.

Lazy resolution occurs when JavaScript properties, such as length, name, or prototype, are retrieved only when needed. During this process, SpiderMonkey may allocate a new property buffer.

The JIT optimizer can mistakenly continue using a reference to the previous buffer, leading to stale pointer reuse after the original memory has been freed.

This situation creates a use-after-free vulnerability that attackers can potentially exploit. According to Nebula Security’s research, an attacker could exploit this memory corruption bug to develop address-disclosure and fake-object capabilities.

Those capabilities may allow for arbitrary code execution within the browser’s renderer process. The attack chain can be described as follows: a malicious JavaScript triggers a JIT optimization error, causing a use-after-free condition that ultimately compromises the renderer process.

While executing code at the renderer level does not automatically reveal a user’s real identity, it poses a significant risk for Tor Browser users.

A compromised renderer may allow attackers to monitor browser activity, exploit additional sandbox-escape vulnerabilities, steal sensitive data, or chain the flaw with operating-system-level exploits.

Such attack chains could undermine browser compartmentalization and weaken the expected anonymity protections for users of the Tor network.

Nebula Security reportedly disclosed the zero-day vulnerability to Mozilla on May 20, 2026, and Mozilla confirmed the root cause the same day.

The rapid patch cycle emphasizes the importance of timely browser updates, especially for users facing heightened surveillance or targeted risks.

Tor Browser users are strongly advised to install the latest official release immediately and to avoid relying solely on anonymity tools as a substitute for proper patch management.

Keeping both Tor Browser and the underlying Firefox security updates up to date remains the most effective defense against browser-based drive-by exploits.

ALERT: 20+ government sites delivered malware to businesses and citizens. See full attack research to check your own exposure.