Researchers Show a Single Malicious Webpage Visit Can Compromise Tor Browser

Researchers at Nebula Security discovered a vulnerability in Firefox's JIT compiler that allows a single malicious webpage visit to compromise the browser, including Tor Browser. This vulnerability, CVE-2026-10702, can be exploited to gain remote code execution, and was used as the first stage in a browser-to-kernel attack chain named IonStack, which ultimately led to root access on a supported Android build. Mozilla has released a patch (Firefox 151.0.3) to address the browser vulnerability, but a separate Linux kernel vulnerability (CVE-2026-43499) remains unpatched.