Critical Tor Browser Bug Lets Attackers Hijack Users

Key Takeaways

• A critical vulnerability, CVE-2026-10702, in the Firefox JavaScript engine allowed attackers to compromise Tor Browser users.
• The flaw enabled remote code execution through a single malicious webpage, bypassing user interaction.
• Researchers at Nebula Security successfully demonstrated exploitation against Tor Browser.
• Mozilla addressed the issue in Firefox 151.0.3, and The Tor Project subsequently released patches.
• Users must update their Tor Browser immediately to mitigate the risk.

Critical Flaw Exposed Tor Browser Users to Remote Hijacking

A newly revealed vulnerability, tracked as CVE-2026-10702, allowed attackers to compromise users of unpatched Tor Browser builds merely by visiting a malicious webpage. This high-severity bug, found within Firefox’s JavaScript engine, was successfully exploited by researchers at Nebula Security, demonstrating a significant threat to user anonymity.

The flaw’s resolution came swiftly, with Mozilla resolving the vulnerability in Firefox 151.0.3 on June 2, 2026. Following this, The Tor Project integrated the necessary fixes into updated versions of its browser. Prompt updates are now essential for all users prioritizing their privacy and security.

Understanding the Exploitation Chain

The core of the vulnerability lies in a Just-In-Time (JIT) miscompilation defect within Firefox’s SpiderMonkey JavaScript engine. Given that Tor Browser is built upon the Firefox framework, any vulnerabilities in this foundational engine directly expose Tor users to potential drive-by attacks.

Crucially, this particular flaw enables arbitrary code execution within the browser’s renderer process without requiring user interaction like file downloads or permission prompts. Instead, merely rendering specially crafted web content is sufficient for exploitation. Nebula Security showcased this capability, tweeting on July 28, 2026:

The attack vector can be visualized as:

[Malicious Webpage] ──► [JavaScript Engine (SpiderMonkey)] ──► [JIT Optimization Error] ──► [Use-After-Free] ──► [Renderer Process Compromise]

Such a compromise of the renderer process is particularly dangerous for anonymity networks, as it can bypass browser-level compartmentalization and potentially expose a user’s identity.

Technical Deep Dive into SpiderMonkey

The root cause of the vulnerability resides deep within SpiderMonkey’s Ion/Warp JIT compilation pipeline. Specifically, the flaw occurs during optimization passes related to:

• Object.keys() Processing: Incorrect assumptions are made when handling array and object keys.
• Lazy Property Resolution: Errors emerge during implicit property lookups, such as those for length, name, or prototype.
• Alias Analysis: The system incorrectly treats memory-allocating operations as benign reads.

When SpiderMonkey attempts to lazily resolve function properties, complete property buffers often necessitate new memory allocations. However, the JIT optimizer can erroneously continue to reference the outdated property buffer. As detailed in Nebula Security’s research, this continued use of a stale pointer creates a use-after-free (UAF) condition. Attackers can then leverage this UAF to construct primitives for address disclosure and create fake objects, ultimately leading to arbitrary code execution.

The timeline for disclosure and patching was as follows:

• May 20, 2026: Nebula Security reported the zero-day flaw to Mozilla, which confirmed the root cause on the same day.
• June 2, 2026: Mozilla released Firefox 151.0.3, containing the fix for the JIT flaw.
• July 20, 2026: The Tor Project issued Tor Browser 15.0.19, incorporating the upstream fixes.

This incident underscores a critical principle for privacy-focused users: network-level anonymity safeguards can be circumvented by underlying browser vulnerabilities if software is not kept up-to-date. Immediate installation of official Tor Browser patches is crucial to close these drive-by exploitation vectors, and staying current with upstream Firefox security updates is essential for continuous protection against browser engine exploits.

What You Should Do

• Update Immediately: Ensure your Tor Browser is updated to version 15.0.19 or later. This is the most critical step to protect against CVE-2026-10702.
• Enable Automatic Updates: Configure Tor Browser to automatically check for and install updates to ensure you receive future security patches promptly.
• Verify Software Sources: Always download Tor Browser updates only from the official Tor Project website to avoid malicious lookalikes.
• Regularly Check for Updates: Even with automatic updates enabled, periodically check for new versions manually to confirm your browser is current.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.