Executive Summary
Nebula Security has identified a critical browser-to-kernel exploitation chain named IonStack. The primary entry point is CVE-2026-10702, a high-severity just-in-time (JIT) miscompilation vulnerability in Firefox's SpiderMonkey engine. This flaw allows for arbitrary code execution within the browser's renderer process simply by visiting a malicious webpage, requiring no additional user interaction. The vulnerability significantly impacts both Firefox and the Tor Browser, which relies on Firefox's codebase.
The exploit chain progresses by leveraging a second vulnerability, CVE-2026-43499 (dubbed GhostLock), which is a long-standing use-after-free (UAF) flaw in the Linux kernel's futex implementation. By combining these two vulnerabilities, attackers can transition from a sandboxed web content process to full root access on targeted systems. Nebula Security demonstrated this chain against Android 17 on ARM64, though the browser flaw itself is architecture-independent.
This discovery highlights the persistent risks within complex JIT compilers and the potential for 'forever-day' kernel vulnerabilities to be weaponized in mobile and desktop environments. Organizations should prioritize updating Firefox to version 151.0.3 or later and monitor for kernel patches addressing the GhostLock futex vulnerability.