Researchers Show a Single Malicious Webpage Visit Can Compromise Tor Browser 研究人员展示单次恶意网页访问即可破坏Tor浏览器

TL;DR

• A critical vulnerability (CVE-2026-10702) in Firefox's Just-In-Time (JIT) compiler allows arbitrary code execution via a single visit to a malicious webpage, affecting Tor Browser versions based on vulnerable Firefox releases.
• The flaw stems from incorrect handling of memory operations during JIT compilation, enabling attackers to bypass sandbox restrictions and achieve remote code execution within the browser renderer process.
• Nebula Security demonstrated a full exploit chain called IonStack, combining this browser vulnerability with a Linux kernel flaw (CVE-2026-43499, GhostLock) to escalate privileges to root on Android 17 devices.
• Mozilla patched the issue in Firefox 151.0.3 by removing faulty alias handling from ObjectToIterator, but users must update immediately as no settings or user interaction are required for exploitation.
• The vulnerability is architecture-independent, though the public exploit targets ARM64 Android 17; x86 exploitation paths remain more stable but were not fully developed by researchers.

Why It Matters

This discovery highlights how subtle compiler optimizations can lead to severe security breaches even without user interaction beyond visiting a compromised site—posing significant risks to privacy-focused tools like Tor Browser. For AI practitioners and security researchers, it underscores the importance of rigorous static analysis and fuzzing of low-level components such as JIT engines, especially when they interact with complex memory management systems. Additionally, the successful chaining of browser and kernel vulnerabilities demonstrates the evolving sophistication of attack surfaces in mobile environments, urging developers to adopt defense-in-depth strategies across software stacks.

Technical Details

• Vulnerability Origin: The bug arises from MObjectToIterator being incorrectly marked as a read-only operation when it actually modifies dynamic-slots buffers during lazy property resolution, leading to stale pointer reuse after garbage collection.
• Exploit Mechanism: After triggering use-of-free via global value number optimization, Nebula’s exploit reclaims freed memory, leaks hidden-class pointers, constructs fake objects, corrupts Uint8Array instances, and achieves arbitrary read/write capabilities within the Firefox sandbox.
• Chain Composition: IonStack combines CVE-2026-10702 (browser-side) with CVE-2026-43499 (kernel-side futex race condition named GhostLock), allowing transition from web content context to full system control on Android 17 ARM64 builds.
• Patch Scope: Fix implemented in Firefox 151.0.3 removes custom read-only alias logic from ObjectToIterator, ensuring mutation-capable operations aren’t misclassified as pure loads during optimization phases.
• Affected Versions: Stable Firefox releases between v147 and v151.0.2 inclusive are impacted; ESR v140.12 remains unaffected due to absence of faulty override code.

Industry Insight

Browser vendors should prioritize formal verification of JIT compiler contracts involving memory access patterns, particularly those influencing alias analysis and redundancy elimination passes, since minor semantic mismatches can enable high-severity exploits regardless of sandbox boundaries. Security teams deploying Tor-based solutions must enforce strict version pinning and automated update mechanisms to mitigate exposure to transient vulnerabilities like this one before widespread patch adoption occurs. Furthermore, mobile OS providers need to strengthen inter-process isolation guarantees between web rendering kernels and underlying drivers, given that weaker sandboxes on platforms like Android significantly reduce attacker effort required for privilege escalation chains.

TL;DR

• Nebula Security 发现并公开了 Firefox JIT 编译器中的高危漏洞 CVE-2026-10702，仅需访问恶意网页即可触发任意代码执行。
• 该漏洞被用于构建 IonStack 链式攻击，结合 Linux 内核漏洞 CVE-2026-43499（GhostLock）实现从浏览器到 Android 系统的提权。
• 受影响范围为 Firefox 147 至 151.0.2，Tor Browser 若基于受影响版本同样存在风险；Mozilla 已在 151.0.3 中修复。
• 漏洞根源在于 MObjectToIterator 操作错误标记为“读”，导致优化器保留已失效指针，引发 Use-After-Free。
• 攻击链针对 ARM64 Android 17 设备，但浏览器端漏洞架构无关，x86 路径更稳定但未完成完整利用链。

为什么值得看

本文揭示了一个无需用户交互、仅靠浏览即可触发的远程代码执行漏洞，且已被实际用于构建完整的浏览器到内核提权链，对浏览器安全模型和隐私工具（如 Tor）构成直接威胁。同时，其技术细节深入 JIT 编译器优化逻辑与内存管理缺陷，为研究浏览器沙箱逃逸机制提供了典型案例。

技术解析

• 漏洞位于 Firefox JIT 编译器的 MObjectToIterator 函数中，当 skipRegistration=true 时，本应修改动态槽缓冲区的操作被误标为纯读操作，破坏了编译器契约。
• Global Value Numbering (GVN) 优化器因此将后续的槽缓冲区加载视为冗余，复用了已被运行时释放的旧指针，导致 Use-After-Free。
• 利用流程包括：回收被释放内存、泄露隐藏类指针、构造伪造对象、篡改 Uint8Array 以获得任意读写能力，最终通过 WebAssembly 重定向注入 ARM64 Shellcode。
• 第二阶段利用 Linux 内核 futex 漏洞 CVE-2026-43499（GhostLock），在 Android 17 ARM64 设备上实现从 sandboxed content process 到 kernel 的权限提升。
• Mozilla 修复方案是移除 ObjectToIterator 中的自定义只别处理逻辑，并调整相关迭代器操作，确保 mutation 操作不会被误认为无害 load。

行业启示

• 浏览器 JIT 编译器的复杂优化逻辑易引入隐蔽的语义错误，建议加强形式化验证或约束检查机制，尤其在涉及内存生命周期管理的代码路径上。
• 即使浏览器沙箱严格，若底层操作系统（如 Android）内核防护较弱，仍可能形成“浏览器→内核”的完整攻击链，需推动端到端纵深防御策略。
• 安全研究团队主动公开 exploit 材料虽有助于透明化和补丁开发，但也可能被滥用；应建立分级披露机制，平衡风险传播与社区响应速度。