One Click on a Bad Web Page Was Enough to Break Firefox and Tor

Key points

• Nebula Security disclosed a Firefox flaw, tracked as CVE-2026-10702, that runs attacker code when a victim simply opens a malicious web page.
• The same bug also worked against Tor Browser, which is built on Firefox and used by journalists and activists to stay anonymous online.
• Mozilla rated the flaw High and shipped a fix in Firefox 151.0.3.
• Researcher Eten Zou confirmed no clicks, prompts or settings changes are needed for the attack to work.
• Users should update Firefox and Tor Browser now, and check that auto-updates actually completed.

A single visit to the wrong web page was enough to hand attackers control of Firefox, according to researchers at Nebula Security. The same trick worked on Tor Browser, the privacy-focused browser used by reporters, activists and anyone who wants to hide their location online.

The flaw sits in the part of Firefox that speeds up JavaScript, the code that makes web pages interactive. That component, called the JIT (short for just-in-time compiler, a piece of software that turns web code into fast machine instructions on the fly), had a bug that let an attacker's page run its own commands inside the browser.

In practice, that means a booby-trapped site could do things the browser is never meant to allow: read data from other tabs, drop malware on the machine, or in Tor's case, quietly unmask who the user is.

Mozilla has tracked the issue as CVE-2026-10702 and rated it High. It was patched in Firefox 151.0.3. The Tor Project has pushed its own matching update.

How does the attack actually work?

The victim just opens a link. That is the whole attack. Nebula researcher Eten Zou, quoted in reporting by The Hacker News, said "no settings or additional user interaction are required." No download prompt. No fake login. No dodgy PDF.

Under the hood, the attacker's JavaScript tricks Firefox's JIT into producing broken machine code. That broken code then runs with the browser's own privileges inside what engineers call the renderer process, the sandboxed part of Firefox that draws web pages. From there, a second bug or a weak sandbox can get the attacker onto the wider system.

The failure mode here is familiar. JIT bugs have been the go-to route into browsers for years because JITs are, by design, taking hostile input and turning it into executable code as fast as possible. That is a hard problem to make safe.

Should ordinary users worry?

Yes, but the fix is simple: update. Firefox users on 151.0.3 or later are protected. Tor Browser users should install the latest version from the Tor Project's own site and nowhere else.

One thing the post-mortem will say is that people who leave browsers open for weeks are the most exposed, because auto-update only finishes when Firefox restarts. Close it fully and reopen it.

For Tor users specifically, the stakes are higher. A bug like this can strip away the anonymity that Tor exists to provide. If you rely on Tor for source protection or personal safety, assume any browsing done on an unpatched version in recent weeks could have been observed, and act accordingly.

What was actually reachable?

Any site could trigger it. That is the uncomfortable part. Malicious ads on a legitimate site, a link in a chat message, a QR code on a poster: all of those end with the browser loading a URL, and loading the URL was enough.

Operational takeaway: restart your browser today, confirm the version number, and stop treating "I clicked nothing" as a defence.