Researchers Show a Single Malicious Webpage Visit Can Compromise Tor Browser

Here's a critical heads-up: Researchers from Nebula Security have demonstrated a severe vulnerability, CVE-2026-10702, in Firefox's JIT engine that could lead to arbitrary code execution by simply visiting a malicious webpage. This flaw was specifically used to compromise Tor Browser.

Technical Breakdown:

• Vulnerability: CVE-2026-10702, a critical Just-In-Time (JIT) bug in Firefox.
• Impact: Arbitrary code execution within the browser's renderer process, meaning an attacker could run code on a victim's machine.
• Exploitation: Zero-click exploitation in the practical sense; no user interaction beyond visiting a malicious site is required. This makes it highly dangerous.
• Affected Versions: Firefox versions prior to 151.0.3, and consequently, Tor Browser versions built on those vulnerable Firefox branches.
• MITRE ATT&CK: Primarily Initial Access via Drive-by Compromise (T1189), leading to Execution (TA0002), likely through Command and Scripting Interpreter (T1059.006) leveraging the JIT.

Defense: Prioritize updating Firefox to version 151.0.3 or higher. For Tor Browser users, ensure you're running the absolute latest stable version to receive the critical underlying Firefox patches.

Source: https://thehackernews.com/2026/07/researchers-show-single-malicious.html