One Click on a Bad Web Page Was Enough to Break Firefox and Tor
Researchers at Nebula Security say a now-patched Firefox flaw let attackers run code just by loading a page, and it worked against Tor Browser too.
Key points
- Nebula Security disclosed a Firefox flaw, tracked as CVE-2026-10702, that runs attacker code when a victim simply opens a malicious web page.
- The same bug also worked against Tor Browser, which is built on Firefox and used by journalists and activists to stay anonymous online.
- Mozilla rated the flaw High and shipped a fix in Firefox 151.0.3.
- Researcher Eten Zou confirmed no clicks or settings changes are needed for the attack to work.
- Update Firefox and Tor Browser now, and confirm that auto-updates actually completed.
A single visit to the wrong web page was enough to hand attackers control of Firefox, according to researchers at Nebula Security. Tor Browser, the privacy-focused browser used by reporters and activists, was vulnerable too.
The flaw lives in Firefox's JIT compiler, a just-in-time compiler being the piece of software that turns JavaScript into fast machine instructions on the fly. A bug there let an attacker's page run its own commands inside the browser without asking for anything first.
A booby-trapped site could read data from other tabs, drop malware on the machine, or in Tor's case quietly unmask the user's identity. Mozilla tracked the issue as CVE-2026-10702, rated it High, and patched it in Firefox 151.0.3. The Tor Project has pushed a matching update.
This is the second Firefox patch story we've covered since mid-July: our 15 July report on Firefox rushing out a fix after attack code appeared online showed how quickly these windows get exploited once proof-of-concept code circulates.
How does the attack actually work?
The victim opens a link. That's the whole attack. Nebula researcher Eten Zou, quoted in reporting by The Hacker News, said "no settings or additional user interaction are required." No download prompt, no fake login.
The attacker's JavaScript tricks Firefox's JIT into producing broken machine code. That code then runs with the browser's own privileges inside what engineers call the renderer process, the sandboxed part of Firefox that draws web pages. From there, a weak sandbox can get the attacker onto the wider system.
JIT bugs have been the standard route into browsers for years because JITs are, by design, converting hostile input into executable code as fast as possible. Making that safe is genuinely hard, and vendors keep finding out the hard way.
Should ordinary users worry?
Yes, but the fix is simple: update. Firefox 151.0.3 or later is protected. Tor Browser users should install the latest version from the Tor Project's own site.
People who leave browsers open for weeks are the most exposed, because auto-update only finishes when Firefox restarts. Close it fully and reopen it today.
For Tor users the exposure is more serious. This class of bug can strip away exactly the anonymity that Tor exists to provide. If you rely on it for source protection or personal safety, treat any browsing done on an unpatched version in recent weeks as potentially observed.
| Detail | Value |
|---|---|
| CVE ID | CVE-2026-10702 |
| Severity | High (Mozilla) |
| Fixed in | Firefox 151.0.3 |
| Also affected | Tor Browser (Firefox-based) |
| Reported by | Nebula Security (Eten Zou) |
What was actually reachable?
Any site could trigger it. Malicious ads on a legitimate site, a link in a chat message, a QR code on a poster: any of those ends with the browser loading a URL, and that was enough.
Restart your browser today, check the version number, and stop treating "I didn't click anything" as a defence.
