JIT miscompilation in the JavaScript Engine: JIT component.

CVE-2026-10702 is a type confusion flaw (CWE-843) in the IonMonkey/Warp JIT compiler within Firefox's SpiderMonkey engine. The MObjectToIterator instruction was defined with an incorrect alias set — treating a write operation (lazy property resolution that allocates new buffers) as a pure load. This breaks Global Value Numbering and Scalar Replacement optimizations, producing a use-after-free: subsequent slot access references a stale buffer pointer after reallocation. Nebula Security demonstrated a full exploitation chain from this primitive to arbitrary read/write in the renderer, and then chained it with CVE-2026-43499 (GhostLock, a Linux kernel futex UAF) for one-click root on Android 17. Affected versions: all Firefox builds prior to 151.0.3, including Firefox for Android. Tor Browser was vulnerable until version 15.0.19 (patched July 20, 2026).

The vendor's CVSS of 4.3 MEDIUM (C:N/I:N/A:L) is factually wrong. Scoring a JIT type confusion that yields arbitrary read/write as 'no confidentiality impact, no integrity impact, low availability impact' ignores the actual exploitation outcome demonstrated by Nebula Security. Red Hat independently scored this 7.5 HIGH (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H), which is far more aligned with reality. The vendor assessment appears to reflect only the surface-level crash behavior, not the weaponized outcome. With a public one-click exploit chain, a working PoC, and Tor Browser exposure, this is a textbook case of vendor under-rating.

Why this verdict

• Vendor CVSS is empirically wrong. The C:N/I:N/A:L impact rating is disproven by a public exploit achieving arbitrary read/write and code execution in the renderer. Red Hat's independent assessment of 7.5 HIGH (C:H/I:H/A:H) is correct.
• Public weaponized exploit chain. Nebula Security's IonStack writeup (July 21, 2026) provides a deterministic, reliable exploit — not a theoretical PoC. The gap from 'published research' to 'in-the-wild' is days, not months, for browser JIT bugs.
• Tor Browser amplifier. CVE-2026-10702 deanonymizes Tor Browser users (pre-15.0.19), making this a high-value target for state-sponsored actors and surveillance operations — an outsized impact on a specific, vulnerable population.
• Role multiplier: Firefox is predominantly deployed on *workstations and mobile endpoints* (category a/b). It is not a server, hypervisor, IdP, or fleet-management component. The blast radius of successful exploitation is per-user (session cookies, credentials, local files) — not fleet-scale or domain-scale. On Tor Browser, the blast radius includes identity exposure, which is critical for that population but does not translate to enterprise fleet compromise. No high-value-role floor override applies.
• Friction: user interaction required. The attack requires the victim to navigate to an attacker-controlled page. This is standard for browser exploitation and is a real but modest friction point — phishing and malvertising are well-understood delivery mechanisms.
• Friction: Firefox market share. Desktop Firefox sits at ~3-5% market share globally. In a 10,000-host enterprise, this likely means 300-500 endpoints running Firefox as primary or secondary browser, limiting the exposed population compared to Chrome/Edge-targeting attacks.

Why not higher?

Not CRITICAL because the blast radius is per-endpoint, not fleet-scale. Firefox is a workstation browser, not a domain controller, hypervisor, or identity provider. The exploit requires user interaction (visiting a malicious page), and Firefox's ~3-5% desktop market share limits the reachable population in most enterprises. No confirmed in-the-wild exploitation or KEV listing exists yet.

Why not lower?

Not MEDIUM because the vendor's 4.3 MEDIUM rating is factually wrong — a public, deterministic exploit chain achieves full renderer RCE, not just a DoS crash. The PoC is weaponized and published, EPSS will lag but the exploit maturity is undeniable, and the Tor Browser deanonymization risk adds a targeted-attack dimension that pure CVSS scoring misses.

1. Force-update Firefox to 151.0.3+ across all managed endpoints immediately — This is the definitive fix. Use your enterprise browser management tool (SCCM, Intune, Jamf, or Firefox's enterprise policies via policies.json) to enforce minimum version 151.0.3. Deploy within 30 days per the noisgate mitigation SLA for HIGH severity, though given the public PoC, moving faster is prudent.
2. Disable IonMonkey JIT as an interim control — Set javascript.options.ion to false via Firefox enterprise policy or about:config. This kills the vulnerable optimization pass entirely. Performance will degrade on JS-heavy sites but the JIT miscompilation cannot occur. Use this as a bridge if patching takes more than a few days. Deploy within 30 days per noisgate mitigation SLA.
3. Block known IonStack/PoC indicator domains at web proxy — Monitor threat intel feeds for domains hosting IonStack exploit pages. Add them to your web proxy and DNS sinkhole block lists. This is a partial control — novel domains will bypass it — but raises the cost for opportunistic attackers.
4. Enable browser exploit detection in EDR — Ensure your EDR (CrowdStrike, Defender for Endpoint, SentinelOne) has browser exploitation detection policies active. These should flag anomalous shellcode execution or memory manipulation within Firefox renderer child processes.
5. Audit Tor Browser deployments — If your organization permits Tor Browser (security researchers, journalists, privacy-sensitive roles), verify all instances are updated to 15.0.19+. Tor Browser users are high-value targets for this specific exploit. Deploy within 30 days per noisgate mitigation SLA.

Run this on each managed endpoint (Linux/macOS) or adapt the version-check logic for Windows. Execute as the user who runs Firefox — no elevated privileges needed. Example: bash check_cve_2026_10702.sh

#!/usr/bin/env bash
# CVE-2026-10702 Checker — Firefox JIT Type Confusion
# Checks if installed Firefox is vulnerable (< 151.0.3)
# Exit codes: 0 = PATCHED, 1 = VULNERABLE, 2 = UNKNOWN

set -euo pipefail

PATCHED_MAJOR=151
PATCHED_MINOR=0
PATCHED_PATCH=3

get_firefox_version() {
  local ff_bin
  for candidate in firefox firefox-esr firefox-bin; do
    ff_bin=$(command -v "$candidate" 2>/dev/null || true)
    if [ -n "$ff_bin" ]; then
      "$ff_bin" --version 2>/dev/null | grep -oE '[0-9]+\.[0-9]+\.?[0-9]*' | head -1
      return 0
    fi
  done
  # macOS application bundle
  if [ -x "/Applications/Firefox.app/Contents/MacOS/firefox" ]; then
    /Applications/Firefox.app/Contents/MacOS/firefox --version 2>/dev/null | grep -oE '[0-9]+\.[0-9]+\.?[0-9]*' | head -1
    return 0
  fi
  return 1
}

VERSION=$(get_firefox_version 2>/dev/null || true)

if [ -z "$VERSION" ]; then
  echo "UNKNOWN — Firefox not found on this host"
  exit 2
fi

IFS='.' read -r MAJOR MINOR PATCH <<< "$VERSION"
PATCH=${PATCH:-0}

echo "Detected Firefox version: $VERSION"

if [ "$MAJOR" -gt "$PATCHED_MAJOR" ]; then
  echo "PATCHED — Firefox $VERSION is newer than 151.0.3"
  exit 0
elif [ "$MAJOR" -eq "$PATCHED_MAJOR" ] && [ "$MINOR" -gt "$PATCHED_MINOR" ]; then
  echo "PATCHED — Firefox $VERSION is newer than 151.0.3"
  exit 0
elif [ "$MAJOR" -eq "$PATCHED_MAJOR" ] && [ "$MINOR" -eq "$PATCHED_MINOR" ] && [ "$PATCH" -ge "$PATCHED_PATCH" ]; then
  echo "PATCHED — Firefox $VERSION >= 151.0.3"
  exit 0
else
  echo "VULNERABLE — Firefox $VERSION is older than 151.0.3 (CVE-2026-10702)"
  exit 1
fi

Sources

1. Nebula Security — IonStack Part I: CVE-2026-10702 Technical Analysis
2. NVD — CVE-2026-10702
3. Rapid7 — MFSA-2026-54 / CVE-2026-10702
4. Lookout — Firefox for Android JIT Type Confusion Vulnerability
5. SentinelOne — CVE-2026-10702 Vulnerability Database
6. The Hacker News — Tor Browser Compromise via Firefox JIT Flaw
7. Cybersecurity News — Tor Browser Exploitation
8. Mozilla Security Advisory MFSA-2026-54