[CVE-2026-10702] IonStack Part I: Unsound IonBanana Peel in Ion Compiler, Slipping Through Firefox's SpiderMonkey JIT

CVE

CVE-2026-10702

Vendor

Mozilla

Product

Firefox / SpiderMonkey

Affected versions

Firefox < 151.0.3

Published

2026-07-10 00:00

Collected

2026-07-30 01:50

---
id: 5565
title: "[CVE-2026-10702] IonStack Part I: Unsound IonBanana Peel in Ion Compiler, Slipping Through Firefox's SpiderMonkey JIT"
cve: CVE-2026-10702
severity: high
vendor: "Mozilla"
product: "Firefox / SpiderMonkey"
affected_versions: "Firefox < 151.0.3"
source_domain: nebusec.ai
source_url: "https://nebusec.ai/research/ionstack-part-1-cve-2026-10702/"
published_at: "2026-07-10T00:00:00Z"
tags: ["rce", "featured", "vulnerability-research", "browser-security", "firefox", "jit", "spidermonkey", "cve-2026-10702", "nebusec", "tor-browser"]
phying_url: "https://phying.com/item/5565"
lang: en
---

# [CVE-2026-10702] IonStack Part I: Unsound IonBanana Peel in Ion Compiler, Slipping Through Firefox's SpiderMonkey JIT

## Summary

NebuSec details CVE-2026-10702, a SpiderMonkey Ion JIT miscompilation that can lead to arbitrary code execution in the Firefox content process and also affects Tor Browser. Mozilla fixed the issue in Firefox 151.0.3.

## Why it matters

A JIT miscompilation reaches arbitrary code execution in the Firefox content process and also affects Tor Browser, underscoring the residual risk in heavily audited JavaScript engines.

## Intelligence Metadata

- **Sources:** nebusec.ai
- **CVE:** CVE-2026-10702
- **Vendor:** Mozilla
- **Product:** Firefox / SpiderMonkey
- **Affected versions:** Firefox < 151.0.3
- **Published:** 2026-07-10T00:00:00Z
- **Original:** https://nebusec.ai/research/ionstack-part-1-cve-2026-10702/
- **Phying News:** https://phying.com/item/5565